Data Processing Addendum

1. Parties and Scope

This Data Processing Addendum (“DPA”) forms part of the Sento Terms of Service between sento LLC (“Sento,” “Processor,” “we,” or “us”) and the customer organization that subscribes to the Platform (“Customer,” “Tenant,” or “Controller”).

This DPA governs Sento's processing of Customer Personal Data (including Job Data and Authorized User workforce data) in connection with the Services. It applies under the CCPA/CPRA, the Texas Data Privacy and Security Act, the Virginia Consumer Data Protection Act, and other applicable U.S. state privacy laws, as well as analogous controller/processor frameworks.

2. Roles

• Customer (Tenant) is the Data Controller (and “business” under CCPA/CPRA) for Job Data, lead and messaging payloads, publisher feedback content containing end-customer fields, technician location telemetry used for Customer operations, and settlement/ledger records Customer configures.
• Sento is the Data Processor (and “service provider” / “contractor” as applicable) and processes such data only on Customer’s documented instructions as set out in the Terms of Service, the Privacy Policy, this DPA, and in-product configuration.
• Sento is independently a Controller only for account, billing, authentication, platform security, and product-improvement data relating to Customers and Authorized Users as described in the Privacy Policy.
• End customers of Customer’s field-service business do not have standalone Sento accounts; their information appears only as Job Data within Customer’s tenant.

3. Nature and Purpose of Processing

Sento processes Customer Personal Data to:

• Provide multi-tenant field operations software (dispatch, jobs, leads, inventory, analytics, settlements);
• Ingest inbound WhatsApp leads via Meta Cloud API and parse structured fields (rules, templates, and optional AI);
• Send publisher-only outbound WhatsApp templates configured by Customer;
• Support internal live fleet visibility, dispatch proximity scoring, and proof-of-service location snapshots during active duty;
• Calculate and display Customer-configured financial ledgers, commissions, and settlements; and
• Secure the Platform, prevent abuse, and comply with law.

Sento does not process Job Data to sell personal information, to build advertising profiles, or for Sento's independent commercial purposes unrelated to providing the Services.

4. Publisher Closed-Loop Data Flows

Where Customer enables publisher WhatsApp notifications, Meta Cloud API template messages may include end-customer name, phone number, and service address in template body parameters. That Job Data originated from (or was supplied through) the Publisher's lead relationship or Customer's workspace and is returned only to the originating Publisher contact as an operational status / job-feedback loop.

This closed-loop disclosure is performed solely at Customer's direction. It does not constitute a “sale” or “sharing” of personal information for cross-context behavioral advertising under CCPA/CPRA or analogous state privacy laws. Customer remains responsible for the lawfulness of disclosing Job Data to its Publishers.

5. Core Corporate Subprocessors

Customer authorizes Sento to engage the following material corporate subprocessors (and their affiliates) as needed to provide the Services:

• OpenAI, L.L.C. (OpenAI API Platform) — optional AI-assisted lead parsing of raw inbound message text. Under OpenAI’s published business/API data controls: API inputs and outputs are not used to train OpenAI models by default; API content may be retained temporarily (typically up to thirty (30) days) for abuse monitoring and safety unless a Zero Data Retention arrangement applies to Sento’s OpenAI organization.
• Meta Platforms, Inc. (WhatsApp Cloud API) — inbound lead webhooks and publisher-only outbound template delivery, which may include Job Data parameters (name, phone, address) in template bodies.
• Twilio Inc. — optional telephone number provisioning and voice verification flows related to WhatsApp / phone-line activation.
• Stripe, Inc. — SaaS subscription billing and, where enabled by Customer, connected payment processing rails.
• Cloud infrastructure, database, caching, monitoring, and email providers that host or support the Platform.

Sento will remain responsible for subprocessors' performance insofar as they process Customer Personal Data on Sento's behalf, subject to the limitations of liability in the Terms of Service.

6. Customer Instructions and Compliance

Customer instructs Sento to process Customer Personal Data to provide the Services. Customer represents and warrants that it:

• has a lawful basis to collect and process the data it submits to the Platform;
• has provided all notices and obtained all consents required for workforce location monitoring, messaging, and Job Data;
• will not instruct Sento to process data in violation of applicable law; and
• is solely responsible for consumer privacy requests, wage-and-hour compliance, and Electronic Monitoring Notices applicable to its technicians (including NY, CT, DE, and CA).

7. Security

Sento implements administrative, technical, and organizational measures designed to protect Customer Personal Data, including encryption in transit, tenant isolation, role-based access controls, credential hashing, webhook verification where configured, and audit logging of sensitive actions, as further described in the Privacy Policy.

8. Personal Data Breach Notification

Upon becoming aware of a Personal Data Breach affecting Customer Personal Data processed under this DPA, Sento will notify Customer without undue delay and, where feasible, within seventy-two (72) hours after confirmation, and will provide information reasonably available to assist Customer in meeting its own notification obligations. Sento will take reasonable steps to mitigate and remediate the breach. Customer is responsible for notifying affected individuals and regulators where legally required, except to the extent law obligates Sento to notify directly.

9. Assistance with Data Subject / Consumer Requests

Taking into account the nature of processing, Sento will provide reasonable assistance to Customer in responding to verified requests from individuals regarding Job Data or other Customer-controlled personal data, including access, deletion, and correction requests under applicable U.S. state privacy laws. Individuals whose information appears only in Job Data should contact Customer in the first instance.

10. Return or Deletion

Upon termination of the Services, Customer is responsible for exporting Customer Data before access ends. Thereafter Sento will delete or anonymize Customer Personal Data in accordance with the Privacy Policy retention schedules and applicable law, except where retention is required for legal, security, tax, accounting, or dispute-resolution purposes.

11. International Transfers

Customer Personal Data may be processed and stored in the United States and other countries where Sento or its subprocessors operate. Where required, Sento will use appropriate transfer safeguards consistent with the Privacy Policy.

12. Hierarchy and Acceptance

In the event of a conflict between this DPA and the Terms of Service regarding processing of Customer Personal Data, this DPA controls. By creating a workspace, checking the signup acceptance box, or continuing to use the Services after notice of this DPA, Customer agrees to this DPA.

13. Contact

Questions about this DPA may be directed to the contacts below.