Data Processing Addendum

Version 1.0, effective October 14, 2026.

About this addendum

This Data Processing Addendum ("DPA") is part of, and incorporated by reference into, the Yardstick Terms of Service between Yardstick Rental Software LLC, a North Carolina limited liability company ("Yardstick", "we", "us"), and the rental business that uses Yardstick ("Customer", "you"). It applies automatically whenever Yardstick processes Customer Personal Data on your behalf; no separate signature is needed. If you'd like a countersigned copy, email [email protected].

"Customer Personal Data" means personal information about your Renters, your team and other people that you or your Renters put into, or collect through, the Service, and that Yardstick processes on your behalf. It doesn't include information Yardstick handles as its own business (see section 1).

1. Roles

• You are the controller (or "business"). You decide what Customer Personal Data to collect, why, and what to do with it.
• Yardstick is your processor (or "service provider"). We process Customer Personal Data only to provide the Service to you, on your documented instructions.
• Your documented instructions are the Terms, this DPA, and the way you configure and use the Service (for example, turning identity verification or reminder emails on, turning automatic AI Damage Checks on or off, uploading photos, connecting QuickBooks or Xero, or asking us to export or delete data). We'll tell you if we believe an instruction breaks the law.
• Where Yardstick is a controller. Yardstick handles some information for its own business, under its Privacy Policy: business-user accounts, Terms-acceptance records, subscription billing, security and abuse prevention, support, sales inquiries, marketing preferences, product feedback and Yardstick's own product measurement. This DPA doesn't cover that information.

2. What we process, and why

Purposes: providing the Service: bookings, agreements, inspections and AI Damage Checks, identity verification, emails to your Renters, accounting sync, the activity log, exports, support, security and fixing problems.

Duration: for as long as you use the Service, and afterwards as described in section 9.

3. Our commitments

Yardstick will:

1. process Customer Personal Data only on your documented instructions and for the purposes above;
2. not sell or "share" it (as those words are used in the California Consumer Privacy Act and similar laws), and not use it for cross-context behavioral or targeted advertising;
3. not retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you, and not combine it with personal information from other sources, except as the law allows a service provider to do (for example, for security, fraud prevention and fixing errors);
4. not use it, including photos, to train AI models. Our AI provider, Anthropic, provides its API under commercial terms that don't permit it to train models on content we send;
5. make sure everyone at Yardstick with access to it is bound by confidentiality;
6. comply with the privacy laws that apply to us as a service provider or processor, give Customer Personal Data the level of protection those laws require, and tell you if we can no longer meet our obligations under them;
7. let you take reasonable steps to stop and fix any unauthorized use of Customer Personal Data, including by asking us to delete it.

4. Security

We keep reasonable technical and organizational security measures appropriate to the data. Today these include:

• designing the Service so each business can see only its own data, and checking that on every request;
• role-based access within each account (for example, only owners and managers can view "ID on file" photos, download an evidence file or override an identity-verification block);
• HTTPS for all traffic;
• hashed passwords, and secure links to Renters stored only in hashed form that expire;
• an activity log of important actions and who took them;
• limiting Yardstick staff access to Customer Personal Data to what's needed for support, security and running the Service.

5. Sub-processors

You give Yardstick general authorization to use sub-processors. The current list, with what each does, is on the Sub-processors page. We'll have a written contract with each sub-processor that protects Customer Personal Data at least as well as this DPA, and we remain responsible for their work.

Before we add or replace a sub-processor that will process Customer Personal Data in a material way, we'll update the Sub-processors page and tell you by email or in the Service, aiming to give at least 30 days' notice where reasonably practicable (an urgent replacement, for example to keep the Service running or secure, may need less). You can object on reasonable data-protection grounds by emailing [email protected] within that notice period. We'll discuss your concern in good faith and try to find a reasonable alternative. If your objection to a material new sub-processor is reasonable and we can't provide a reasonable alternative, you may terminate the affected part of the Service before the change affects your data, and we'll refund any prepaid fees for the unused part of your current billing period that are allocable to that affected part of the Service. There's no refund for any part of the Service already provided, and no broader refund applies.

6. Helping with Renter and consumer requests

If a Renter or other person asks you to access, correct or delete their information, you can do much of this in the app (for example, by editing a booking, deleting a booking that has no payment history, or exporting CSV files). Where you can't, email [email protected] and we'll help you respond without undue delay, taking into account the deadline the law gives you. If a person contacts us directly about Customer Personal Data, we'll pass the request to you and won't respond to it ourselves unless you ask us to or the law requires it.

7. Security incidents

If Yardstick confirms a security incident that led to unauthorized access to, or loss, disclosure or alteration of, Customer Personal Data (in our systems or a sub-processor's), we'll notify you without undue delay after we confirm it. We'll tell you what we know at the time, and add to that as more information becomes available: what happened, the kinds of data and people affected, what we're doing about it, and what you may need to do. We'll give you reasonable help to meet any obligation you have to notify Renters or regulators.

8. International transfers

Yardstick is based in the United States. Our sub-processors may process Customer Personal Data in the United States and in other countries where they operate, under their own safeguards. Where a law that applies to you requires a transfer mechanism, we'll work with you to put an appropriate one in place (for example, standard contractual clauses).

9. Return and deletion

• During your subscription, you can export your equipment, customers, bookings and invoices as CSV files and download reports, delete bookings that have no payment history (ask us to remove a deleted booking's photos as well), and remove team members. You can ask us for anything you can't do yourself, including copies of photos and signed agreements.
• When your subscription ends, your owners and managers keep read-only access and exports for the recovery period described in the Terms. Ending a subscription doesn't by itself delete Customer Personal Data.
• On your written request (from an owner, to [email protected]), we'll delete Customer Personal Data (for your whole account, or for a particular Renter across bookings, photos and the activity log) or return it in a reasonable format, except what we must keep by law, and confirm in writing when deletion is complete. Today we carry out these requests by hand.
• The Privacy Policy (section 10) sets retention targets for particular kinds of data, such as "ID on file" photos. Automated deletion on a schedule isn't yet switched on; until it is, those kinds of data are deleted on your request rather than automatically, and the Privacy Policy explains the current position. A legal hold you place on a rental keeps its photos and records until you lift it.
• Deleted data can stay in backups for some additional time until those backups age out. We won't restore it from a backup except to recover from a failure.

10. Audits and information

We'll make available the information reasonably needed to show that we meet this DPA. We'll start with documentation and remote evidence, such as written answers to a reasonable security and privacy questionnaire. Requests are normally limited to once a year, unless there has been a security incident affecting your data, a regulator requires it, or there's a material compliance concern. Any further audit is at your cost, on reasonable notice, during business hours, subject to confidentiality, and without access to other customers' data. Yardstick doesn't currently hold any security certification.

11. Your commitments

You will:

1. have a lawful basis, and give any notice and get any consent the law requires, for the Customer Personal Data you collect, including identity verification, ID photos, condition photos, AI Damage Checks on those photos, and emails (including reminders) to Renters;
2. not instruct us to process Customer Personal Data in a way that breaks the law;
3. handle Renter requests and complaints, and tell us promptly if you need our help;
4. keep your team's access appropriate and remove people who leave.

12. Order of precedence

If this DPA conflicts with the Terms, this DPA controls on how Customer Personal Data is processed.

Contact

Yardstick Rental Software LLC
1661 Cash Rd
Creedmoor, NC 27522
United States
Data-processing questions and sub-processor objections: [email protected]
Legal notices and countersigned copies: [email protected]