Nest.

Data Processing Addendum

Effective date: October 14, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Mule Digital LLC (“Mule Digital,” “we,” “us”), which operates the Nest platform, and the customer (“Customer,” “you”). It applies where we process, on your behalf, the personal information of your clients, leads, and contacts (“Client Personal Information”) that you submit to the Service. For your own account information, our Privacy Policy governs.

1. Roles of the parties

For Client Personal Information, you are the controller (and, under California law, the “business”) and we are your processor (and “service provider”). You determine the purposes and means of processing; we process only as described here and on your documented instructions. You are responsible for the lawfulness of the Client Personal Information you provide and for having all necessary consents, notices, and lawful bases to provide it and have us process it.

2. Scope, instructions, and service-provider restrictions

We will process Client Personal Information only: (a) to provide, maintain, secure, and troubleshoot the Service; (b) as documented in this DPA and the product’s configuration and features as you use them; and (c) as otherwise instructed by you in writing, unless legally required to do otherwise (in which case we will inform you unless prohibited by law). We will tell you if we believe an instruction violates applicable data-protection law.

Service-provider restrictions. For nonpublic personal information of your clients and prospects, Mule Digital acts solely as your service provider. It will not use or disclose that information except to provide the Service to you, to comply with law, or as you instruct. It will not sell or share it, will not use it for its own marketing, and will not itself use it to train AI models (see Section 7 of the Terms for AI providers, whose retention and training practices we do not control). Aggregated or de-identified data will be de-identified so it cannot reasonably be re-identified and will not be used to market to your clients.

Health information. You will not upload nonpublic personal health information unless you have obtained any authorization required by law. Nest does not sign business associate agreements and is not designed for protected health information.

3. Nature and details of processing

  • Subject matter and duration: processing for the term of the Terms and any wind-down period.
  • Nature and purpose: hosting, storage, organization, retrieval, transmission, display, AI-assisted drafting, email you send to your contacts, and deletion of Client Personal Information to provide the CRM, document vault, communications, illustration, and related features.
  • Categories of data subjects: your clients, prospects, leads, and contacts.
  • Categories of data: identifiers and contact details; policy, product, and insurance information; financial and commission-related information; documents you upload; voice memo audio and transcripts; notes and communications; and records synchronised from your own Salesforce org if you connect it. You control what you submit; the Service is not designed for, and you should not submit, unnecessary sensitive data.

4. Confidentiality

We ensure that personnel authorized to process Client Personal Information are bound by appropriate confidentiality obligations and access it only as needed to provide the Service.

5. Security measures

We maintain appropriate technical and organizational measures designed to protect Client Personal Information, including encryption in transit (TLS 1.2+), application-layer encryption (AES-256-GCM) of vault documents and of integration and carrier portal credentials, role- and account-scoped access controls, and an audit log of security-relevant actions such as document downloads and record changes. Database backups are stored privately and kept for 14 days. Webhook and ingest signing secrets that you create in Settings > API are stored without application-layer encryption because they must be readable to sign and verify requests. Message attachments, voice memo audio, and quote and illustration share links are not encrypted at the application layer; share links expire after 7 days. Other database records, such as contacts and notes, are stored with our database provider without application-layer encryption. On written request we will provide a short annual security summary instead of on-site audits. These measures are described further in the Privacy Policy.

6. Sub-processors

You authorize us to engage the sub-processors needed to operate the Service. We use them under their standard data-processing terms, which contain confidentiality and security obligations. Our current sub-processors include:

  • Clerk: identity and authentication
  • Nile: database hosting (United States)
  • Vercel: application hosting, Blob storage, Web Analytics, Speed Insights, BotID bot detection, and the AI Gateway
  • Anthropic: AI text generation and analysis (via the Vercel AI Gateway); notes, transcripts, E&O documents, and client data in prompts
  • Google: AI text generation (via the Vercel AI Gateway)
  • OpenAI: voice transcription (via the Vercel AI Gateway)
  • Stripe: payment processing
  • Resend: transactional email, and email you send to your own contacts
  • Upstash: rate limiting
  • DocuSign: e-signature, not active today; applies only once that integration is enabled and you connect your own account
  • U.S. Census Bureau: address geocoding of imported addresses and office addresses (no names)
  • Salesforce: record import (accounts, contacts, leads, policies, campaign history, activity history, and files and attachments), only if you connect your own org

Salesforce is your own account that you connect; it is not our sub-processor. DocuSign and other integrations that are not yet available are not in use and will be added to this list before they are enabled. We will give at least 30 days’ email notice before adding or replacing a sub-processor, except that where a replacement is needed urgently for security, legal, or service-continuity reasons we may replace a sub-processor first and will notify you as soon as reasonably practicable afterward, and your objection right in this Section then applies from the date of that notice. If you reasonably object on data-protection grounds, you may notify us promptly and, if we cannot reasonably accommodate the objection, you may cancel the affected Service as your exclusive remedy. Cancellation does not entitle you to a refund (see Section 9.3 of the Terms).

7. Assistance with data-subject requests

Taking into account the nature of the processing, we will provide reasonable assistance, including the Service’s self-service access, export, correction, and deletion tools, to help you respond to requests from data subjects to exercise their rights. If we receive such a request directly, we will, unless legally required to act, refer the requester to you.

8. Security incidents

Mule Digital will notify you without undue delay, and in any event within seventy-two (72) hours after confirming a Security Incident affecting Customer Data (including Client Personal Information), or as soon thereafter as is reasonably practicable where confirmation or containment is delayed by circumstances outside our reasonable control. The notice will include, as known, its nature, the categories and approximate number of records and individuals affected, timing, the measures taken, and a contact. Mule Digital will reasonably cooperate so you can meet state insurance data-security and breach-notification duties. You remain responsible for notices to regulators and clients unless agreed otherwise in writing. “Security Incident” means a breach of security in our own systems that results in unauthorized access to, or acquisition, loss, alteration, or disclosure of, Customer Data. A Security Incident is “confirmed” when a member of our team has verified that it occurred. Unsuccessful attempts and activity that does not compromise Customer Data, such as pings, port scans, blocked log-in attempts, and denial-of-service attacks that do not result in unauthorized access, are not Security Incidents. Our notice of, or response to, a Security Incident is not an admission of fault or liability.

9. Deletion and return

On termination, you may export Client Personal Information through the Service for 30 days. After that period we may delete Client Personal Information. When you close your account, identifying data is removed or anonymised within about 30 days; records we retain for legal, financial, and audit purposes (such as policy, commission, and audit records) are kept without the identifying fields. Database backups are kept for 14 days, so removed data can remain in backups for up to 14 days after that.

10. Audits and information

On reasonable written request, and no more than once per year unless required by a regulator or following a breach, we will make available information reasonably necessary to demonstrate compliance with this DPA, such as an annual security summary, subject to confidentiality and to protecting the security of the Service and other customers.

11. California service-provider terms

With respect to personal information subject to the CCPA/CPRA, we act as a “service provider.” We will not: (a) sell or share such personal information; (b) retain, use, or disclose it for any purpose other than the business purposes specified in this DPA, or as otherwise permitted by the CCPA; (c) retain, use, or disclose it outside the direct business relationship; or (d) combine it with personal information from other sources except as permitted by the CCPA. We will notify you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorized use. We certify that we understand and will comply with these restrictions.

12. International transfers

The Service is operated for United States customers and their U.S.-based data subjects. If processing of personal data subject to non-U.S. law becomes in scope, the parties will put in place an appropriate transfer mechanism (such as the Standard Contractual Clauses) before such processing.

13. Liability, disputes, and precedence

Each party’s liability under this DPA is subject to the disclaimers, exclusive remedy, limitations and exclusions of liability, time limit, and dispute-resolution provisions of the Terms of Service, and disputes about this DPA are resolved under the Terms’ individual arbitration, class and jury waiver, Michigan law, and venue provisions. If there is a conflict between this DPA and the Terms, the Terms control, including their sections on refunds, exclusive remedy, warranty, liability, time limit, and dispute resolution, unless this DPA expressly overrides a specific Section of the Terms by number. On the technical handling of Client Personal Information, this DPA otherwise controls.

14. Contact

Mule Digital LLC
Nest
2120 University Park Dr, Okemos, MI 48864
hello@nestannuity.com