QuickPoolQuote Data Processing Addendum
Exhibit B to the Master Services Agreement | Version 2.0 | Version date: October 20, 2026
This Data Processing Addendum ("DPA") is part of the QuickPoolQuote Master Services Agreement ("Agreement") between Quick Pool Quote LLC, an Arizona limited liability company doing business as QuickPoolQuote ("QuickPoolQuote," "we," "us"), and the Builder identified in the signup or order form ("Builder," "you"). It applies whenever QuickPoolQuote processes Personal Information on Builder's behalf through the Service. Capitalized terms not defined here have the meaning given in the Agreement. If this DPA conflicts with the Agreement on a data protection matter, this DPA controls.
1. Definitions
"Personal Information" means information that identifies, relates to, or can reasonably be linked to an individual or household, and that QuickPoolQuote processes on Builder's behalf. It includes the homeowner names, email addresses, phone numbers, property addresses, build timelines, and design selections submitted through Builder's instance of the Service.
"Applicable Privacy Laws" means United States federal and state laws on privacy, data protection, and data security that apply to the processing, including the California Consumer Privacy Act as amended and other state consumer privacy laws, to the extent they apply.
"Security Incident" has the meaning given in Section 7.6 of the Agreement, as it applies to Personal Information.
2. Roles
For Personal Information that homeowners submit through Builder's instance of the Service, Builder is the business or controller and QuickPoolQuote is Builder's service provider or processor. QuickPoolQuote does not use that Personal Information for its own purposes.
QuickPoolQuote acts as an independent business only for (a) account, billing, and contact information about Builder and Builder's personnel, and (b) usage and performance data about Builder's account that does not contain homeowner Personal Information. That information is not covered by this DPA.
3. Instructions and permitted use
3.1 QuickPoolQuote will process Personal Information only (a) to provide, support, secure, and maintain the Service for Builder, (b) to deliver the homeowner's design and estimate and the lead to Builder, (c) as described in Section 7.2 of the Agreement and Annex 1, and (d) on Builder's other lawful, documented instructions. The Agreement and this DPA are Builder's complete instructions at signing.
3.2 QuickPoolQuote will not (a) sell Personal Information or share it for cross-context behavioral advertising, (b) retain, use, or disclose it outside the direct business relationship with Builder or for any purpose other than those in Section 3.1, or (c) combine it with information from other sources, except as Applicable Privacy Laws allow for a service provider.
3.3 QuickPoolQuote will comply with Applicable Privacy Laws that apply to it as Builder's service provider or processor and will give the same level of privacy protection those laws require. QuickPoolQuote will tell Builder if it determines it can no longer meet its obligations, and Builder may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.
3.4 QuickPoolQuote will tell Builder if it believes an instruction violates Applicable Privacy Laws and may pause the affected processing until the instruction is corrected.
3.5 Builder is responsible for the lawfulness of its collection and use of Personal Information, including privacy notices and any consent required for its own follow-up contact, as set out in Sections 7.4 and 8 of the Agreement.
4. Personnel
QuickPoolQuote will limit access to Personal Information to personnel and providers who need it for the Service and who are bound by confidentiality obligations.
5. Security
QuickPoolQuote will maintain reasonable administrative, technical, and organizational measures appropriate to the Personal Information, as described in Section 7.5 of the Agreement and Annex 2. Annex 2 describes QuickPoolQuote's configuration as of the date of this DPA. Measures may change over time, but QuickPoolQuote will not materially reduce the overall level of protection. The certifications and audits referred to in Annex 2 belong to QuickPoolQuote's providers, not to QuickPoolQuote.
6. Security Incidents
6.1 QuickPoolQuote will notify Builder without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Builder's Personal Information, whether QuickPoolQuote discovers it or a provider reports it. QuickPoolQuote becomes aware when it learns of the incident, and the period does not restart when a report reaches a different person or when the incident is later confirmed. The notice may be preliminary, even if the investigation is not complete.
6.2 The notice will describe what QuickPoolQuote then knows about the nature of the incident, the information involved, and the steps taken, and QuickPoolQuote will send updates as it learns more. Notices will go to Builder's notice email. Builder may send questions and instructions about an incident to help@quickpoolquote.app.
6.3 QuickPoolQuote will cooperate in reasonable measures to contain and remediate the incident. Section 7.6 of the Agreement governs external notices. Neither party may delay a legally required notification.
7. Providers (subprocessors)
7.1 Builder authorizes QuickPoolQuote to use the providers listed in Schedule A to the Agreement to process Personal Information. QuickPoolQuote will have a written agreement with each provider that includes data protection obligations appropriate to the processing it performs, and QuickPoolQuote remains responsible for its providers' performance of those obligations.
7.2 If QuickPoolQuote chooses to add or replace a provider that processes Personal Information, it will update Schedule A and email Builder at least fifteen (15) days before the new provider begins processing. Builder may object on reasonable data protection grounds within those fifteen (15) days. QuickPoolQuote will not start the new processing for Builder's account while a timely objection is unresolved, unless an urgent security or service continuity need requires a replacement. In that case QuickPoolQuote will notify Builder as soon as practicable and Builder may object afterward.
7.3 Some providers change their own providers. QuickPoolQuote will notify Builder promptly after it learns of such a change that affects Personal Information, and Builder may object on the same grounds within fifteen (15) days after that notice. Where Applicable Privacy Laws require an opportunity to object before a provider's downstream provider begins processing, QuickPoolQuote will require advance notice from its provider where the provider's terms allow it, and will give Builder notice and an opportunity to object before the affected processing begins, to the extent that law requires.
7.4 If the parties cannot resolve an objection, Builder may terminate the affected Service and receive a refund of prepaid fees for the unused period. That is Builder's sole remedy for the objection itself. It does not limit rights arising from a separate breach of this DPA or rights that applicable law does not permit the parties to limit.
8. AI processing
8.1 The Service uses AI models only to generate concept images from the design a homeowner builds and to check those images against the design. Inputs are a screenshot of the three-dimensional design, the generated image, and a text description of the selections. QuickPoolQuote does not send homeowner names, email addresses, or telephone numbers to these models.
8.2 QuickPoolQuote does not use Personal Information to train or improve models it owns. The models are accessed through Lovable's AI gateway, and Lovable states that its AI providers are contractually restricted from training on or retaining customer data. QuickPoolQuote relies on that statement and does not independently guarantee how a model provider treats data.
8.3 Builder should treat AI images as the concept illustrations described in Section 6 of the Agreement.
9. Individual requests, assessments, and legal demands
9.1 QuickPoolQuote will reasonably assist Builder in responding to individual requests to access, correct, delete, or export Personal Information, as described in Section 7.7 of the Agreement, and will respond to Builder's request for that help within ten (10) business days. If a homeowner contacts QuickPoolQuote with such a request about Builder's data, QuickPoolQuote will forward it to Builder and will not respond on Builder's behalf except as instructed or required by law.
9.2 On request, QuickPoolQuote will give Builder information reasonably needed for a privacy or data protection assessment that Builder is required to perform about the Service.
9.3 If a government authority or other third party demands Personal Information, QuickPoolQuote will refer it to Builder where permitted, notify Builder before disclosing where law allows, and disclose only what is legally required.
10. Compliance information and assessments
10.1 On Builder's reasonable written request, and no more than once a year unless a Security Incident has occurred, QuickPoolQuote will provide information reasonably necessary to show compliance with this DPA, such as a written summary of its security practices and a completed questionnaire. Where QuickPoolQuote's providers permit, it will also share summaries of their independent audits and certifications, which may be subject to the provider's confidentiality terms. Those reports describe the provider's systems, not QuickPoolQuote's application.
10.2 If an Applicable Privacy Law requires that Builder be able to audit or inspect QuickPoolQuote's processing, QuickPoolQuote will allow a reasonable assessment, or, with Builder's consent, arrange a qualified independent assessment as that law requires. Any assessment must be scheduled in advance, be limited to the Service, protect other customers' information and QuickPoolQuote's security, and avoid unreasonable disruption. Builder bears its own costs unless the law requires otherwise.
10.3 The limits on frequency, notice, scope, and cost in this Section apply only to the extent they are consistent with Applicable Privacy Laws. They do not prevent a legally required assessment or reasonable follow-up on an identified failure to comply.
11. Return and deletion
11.1 At Builder's direction, QuickPoolQuote will return or delete Personal Information at the end of the Services, subject to the following periods unless Applicable Privacy Laws require earlier action: Builder may request an export of available data during the subscription and for 30 days after termination; QuickPoolQuote will delete Personal Information from active systems no later than 90 days after termination; and residual backups will be deleted or overwritten in the ordinary backup cycle, no later than 180 days after termination. Section 15 of the Agreement also applies.
11.2 Any retention that the law permits or requires will be limited to the minimum information, purpose, access, and duration necessary. Retained Personal Information remains subject to this DPA and will not be used for unrelated purposes. QuickPoolQuote will not use retained backups for any purpose other than restoring the Service, and will reapply deletions if it restores a backup.
12. Data location and transfers
12.1 Personal Information is hosted by QuickPoolQuote's providers in the regions shown in Schedule A to the Agreement. QuickPoolQuote's database and file storage are hosted in the United States. Other infrastructure and AI processing used by Lovable may take place in other regions listed on Lovable's provider list, and providers may process Personal Information in the United States and other countries as shown there.
12.2 Some providers receive information directly from a visitor's browser, such as an IP address and device information, under their own terms and privacy notices. Google Maps is an example.
12.3 QuickPoolQuote does not intend to process Personal Information subject to the EU or UK GDPR. If Builder expects such data, the parties will first agree on additional terms under Section 7.9 of the Agreement.
13. Aggregated and de-identified information
QuickPoolQuote may use aggregated or de-identified information only as allowed in Section 7.8 of the Agreement, and not to train AI models. It will take reasonable measures to ensure the information cannot be associated with an individual, will publicly commit not to reidentify it, and will contractually require the same of any recipient.
14. Liability and term
A breach of this DPA is treated as a breach of Section 7 of the Agreement for purposes of Section 13, including the higher cap in Section 13.3 and the recoverable costs described in Section 13.1. The caps in Section 13 are not cumulative and do not reset by claim, incident, or exhibit. This DPA applies for as long as QuickPoolQuote processes Personal Information for Builder, and continues for any Personal Information QuickPoolQuote retains after termination.
Annex 1: Details of processing
| Item | Description |
|---|---|
| Subject matter | Operating Builder's instance of the QuickPoolQuote design and estimate tool and delivering leads. |
| Duration | The subscription term and the post-termination periods in Section 15 of the Agreement. |
| Nature and purpose | Collecting, hosting, storing, generating designs and estimates, emailing results, support, security, and deletion. |
| Individuals | Homeowners and prospective customers who use Builder's instance. |
| Categories of Personal Information | Name, email address, phone number, property address and map location, build timeline, design selections and generated images, the content of estimate and lead emails, and hashed IP addresses used to limit abuse. |
| Sensitive data | None intended. Builder must not submit sensitive information as listed in Section 2 of the Agreement. |
Annex 2: Security measures (as of the date of this DPA)
- Data is encrypted in transit between users and the Service, and is stored using encryption provided by QuickPoolQuote's hosting and database providers.
- Public access to database tables is closed. For tables containing Personal Information, row-level security is enabled and the anonymous and signed-in public roles have no permissions. Data is read and written through server-side functions that use a protected service credential.
- Prices are calculated on the server. The homeowner's browser receives the options and the estimate for the design they build, not the builder's price tables.
- Design images are kept in private storage and delivered through time-limited links.
- Abuse controls apply to lead submission and image generation, including a hidden bot trap, rate limits per visitor, and daily caps per builder.
- API keys and other credentials are kept in the hosting platform's secrets management.
- Each builder's data is logically separated by builder, and administrative access to production systems is limited to authorized personnel.
- The hosting platform runs an automated security scan each time the Service is published, and QuickPoolQuote runs deeper scans periodically.
- QuickPoolQuote's hosting provider reports that it holds SOC 2 Type II and ISO 27001 certifications. These are the provider's certifications, not QuickPoolQuote's.
The list of providers is in Schedule A to the Agreement, which QuickPoolQuote keeps current as described in Section 7.