DATA PROCESSING AGREEMENT
Last updated September 12, 2026
This Data Processing Agreement ("DPA") forms part of the agreement between CMO Success, LLC, a Delaware limited liability company doing business as Bright Growth ("Bright Growth"), and the customer identified in the applicable engagement agreement, order form, or Terms of Service (the "Customer") governing Customer's use of Bright Growth's services, including the AI CMO Operating System Platform at app.brightgrowth.io (the "Agreement"). This DPA applies to the extent that Bright Growth processes Customer Personal Data (defined below) on Customer's behalf.
Order of precedence. If there is a conflict, the Standard Contractual Clauses (where they apply) prevail over this DPA, and this DPA prevails over the Agreement with respect to the processing of Customer Personal Data.
1. Definitions
1.1 "Data Protection Laws" means all laws applicable to the processing of personal data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the Virginia Consumer Data Protection Act, and other comprehensive US state privacy laws.
1.2 "Customer Personal Data" means personal data or personal information contained in Customer Content that Bright Growth processes on Customer's behalf.
1.3 "Customer Content" means documents, information, and materials Customer or its authorized users provide to Bright Growth in connection with an engagement, including materials uploaded to Customer's workspace on the Platform, materials contributed to that workspace by a Specialist Consultant, data the Platform reads from a Connected Source under Section 4.3, and Customer-Extracted Findings submitted under Section 4.5.
1.4 "Platform" means the AI CMO Operating System Platform at app.brightgrowth.io.
1.5 "Specialist Consultant" means a third-party functional expert who participates in Customer's engagement under a direct contract with Customer, as described in Section 6.5, whether or not Customer grants that consultant access to Customer's workspace on the Platform.
1.6 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 for transfers to processors (Module Two).
1.7 "Subprocessor" means a third party engaged by Bright Growth to process Customer Personal Data on Bright Growth's behalf.
1.8 "Connected Source" means a third-party business system (such as a CRM, marketing automation platform, or web analytics tool) or communications source (such as a meeting-notes tool, team messaging, or email) that Customer authorizes the Platform to access on a read-only basis under Section 4.3.
1.9 The terms "controller," "processor," "data subject," "personal data," "personal data breach," and "processing" have the meanings given in the GDPR; "business," "service provider," "sell," and "share" have the meanings given in the CCPA.
1.10 "Alignment Survey" means a questionnaire the Platform sends, at Customer's instruction, to individuals Customer identifies (typically Customer's own executives and the counterparts of its marketing function), and whose responses the Platform collects, scores, and presents in Customer's workspace.
1.11 "Customer-Extracted Finding" means a structured marketing finding that Customer, using its own systems and its own AI provider account, derives from communications Customer holds, and submits to the Platform through Bright Growth's ingestion interface, without the underlying communication being transmitted to or accessed by the Platform.
1.12 "Team Onboarding Survey" means a questionnaire the Platform sends, at Customer's instruction, to individuals Customer identifies as members of Customer's marketing team, each of whom answers individually and under their own name, and whose responses the Platform collects and presents, attributed to each respondent, to Customer's engagement lead.
2. Roles and scope
2.1 Bright Growth as processor. For Customer Personal Data contained in Customer Content, Customer is the controller (or a processor acting for another controller) and Bright Growth is a processor (and, under the CCPA, a service provider).
2.2 Bright Growth as independent controller. Bright Growth acts as an independent controller, and this DPA does not apply, for (a) account, administrative, and technical data of Customer's users (signup email address, authentication and security logs, application error reports, internal signup notifications), (b) data Bright Growth compiles independently of Customer, including its Investor Directory, Partner (Vendor) Directory, and industry benchmark data, and (c) the complimentary Marketing Snapshot described in Section 21 of the Terms of Service, including the requester's work email address, the company and competitor website addresses submitted, the publicly available information Bright Growth's software researches, and the resulting automated assessment. Bright Growth's processing as a controller is described in its privacy notice at brightgrowth.io/privacy.
2.4 When a Snapshot requester becomes a Customer. If a party that requested a Marketing Snapshot later enters into an Engagement Agreement, this DPA applies from that point to Customer Personal Data in Customer Content thereafter. It does not apply retroactively to the Snapshot itself or to the information gathered to produce it, which remains controller processing under Section 2.2(c).
2.3 Details of processing are set out in Annex I.
3. Customer instructions
3.1 Bright Growth will process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law to which Bright Growth is subject (in which case Bright Growth will inform Customer of that legal requirement before processing, unless the law prohibits doing so). The Agreement, this DPA, and Customer's use of the Platform's features constitute Customer's documented instructions.
3.2 Bright Growth will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
4. Customer obligations
4.1 Customer is responsible for the lawfulness of the Customer Personal Data it provides, including having any necessary notices, consents, and legal bases to share it with Bright Growth for processing under the Agreement, including personal data about Customer's own personnel appearing in uploaded documents or in Specialist Consultant interview notes.
4.2 Data Customer must not provide. Customer will not upload or otherwise provide (a) contact-level records of Customer's own customers or prospects (names, email addresses, phone numbers), or (b) sensitive or special-category personal data (including health information, government identifiers, and financial account numbers). The Platform and the Services are not designed for either. A Connected Source may inherently contain such records; that is not a breach of this Section, because Bright Growth reads Connected Sources in place and persists only the aggregate results and derived findings described in Section 13.5 and Annex I; contact-level records from a Connected Source are never stored on the Platform. Bright Growth's obligations under this DPA do not extend to data uploaded in breach of this Section, other than to delete it on discovery or request. Where Customer submits a Customer-Extracted Finding, Section 4.5(b) governs the removal of the data this Section excludes from that finding and its supporting excerpt, and states what each party does if such data reaches Bright Growth in one.
4.3 Connected Sources. Where the Agreement includes connector or conversation-intelligence features, Customer controls which Connected Sources are linked to its workspace, and each connection Customer establishes (and its scope) constitutes a documented instruction under Section 3.1. Connections are read-only, and Customer may revoke any connection at any time from within the Platform, which stops further reads and deletes the stored credential for that connection. As between the parties:
(a) Lawful holding and recording consent. Customer is responsible for lawfully holding the communications and data in its Connected Sources, including obtaining any consents required to record or retain calls, meetings, and messages under applicable law (including one- and two-party consent statutes). Bright Growth reads only what Customer already lawfully holds and does not itself record any communication.
(b) Employee data and workforce notification. Customer is the controller of personal data relating to its own personnel contained in Connected Sources. Customer is responsible for any workforce notification, consultation (including with works councils or employee representatives), or other employee-data compliance obligation arising from its use of these features. The Platform aggregates personnel-related findings at the team level by default; enabling individual-level attribution is an administrative action taken by Customer in the Platform and is logged.
(c) Third-party vendor access. Where a Connected Source is a third-party vendor system (for example, a conversation-recording or revenue-intelligence tool), API or data access to that system is procured by Customer under Customer's own agreement with that vendor, and Customer is responsible for ensuring that agreement permits the access Customer configures.
4.4 Alignment Surveys. Where Customer uses an Alignment Survey, Customer selects the recipients and supplies their names, job titles, and work email addresses. Each roster Customer creates, and each wave Customer sends, constitutes a documented instruction under Section 3.1. As between the parties:
(a) Roster lawfulness and notice. Customer is responsible for the lawfulness of the recipient details it supplies and for having a valid basis to have them surveyed, and for giving its own personnel any notice or information they are owed under applicable law about the survey and its purpose.
(b) Attribution. Alignment Survey responses are attributed, not anonymous: a response is stored against the named recipient who gave it and is visible to Customer's authorized users. The Platform displays a notice to each recipient, before the first question, stating that responses are attributed, who will see them, what they are used for, and how long they are kept. Responses within a pair are not readable by anyone until both sides of that pair have submitted.
(c) No anonymous or workforce-wide instrument. The Platform does not currently offer an anonymous survey or a survey addressed to Customer's workforce at large. If Bright Growth makes such an instrument available, the parties will address the additional employee-data obligations that attach to it, including any workforce notification, works-council or employee-representative consultation, and employee-monitoring requirements under applicable law, before Customer uses it.
4.5 Customer-Extracted Findings. Where Customer submits Customer-Extracted Findings, the underlying communications are processed entirely within Customer's own systems and Customer's own AI provider account; Bright Growth neither accesses nor receives them. Each submission constitutes a documented instruction under Section 3.1. As between the parties:
(a) Lawful holding and recording consent. Customer is responsible for lawfully holding the communications from which it derives a Customer-Extracted Finding, including obtaining any consents required to record or retain calls, meetings, and messages under applicable law (including one- and two-party consent statutes). Bright Growth does not record any communication, does not receive the communications from which a Customer-Extracted Finding is derived, and does not access the systems in which Customer holds them.
(b) Redaction before submission. Customer is responsible for removing personal contact details and the other excluded data described in Section 4.2 from a finding and its supporting excerpt before submitting it. Bright Growth applies an automated pattern check on receipt, which refuses a submission containing an email address or a telephone number; that check does not detect personal names, and it is an additional safeguard rather than a substitute for Customer's redaction. A submitted finding is held in a pending-review state and presented to Customer's authorized users for review under Section 13.5. Bright Growth will delete a submitted finding and its supporting excerpt promptly on becoming aware that it contains data Section 4.2 excludes, including on Customer's notice or request.
(c) Customer's own AI provider. Customer selects, contracts with, pays, and instructs its own AI provider, and Customer's use of that account is governed by Customer's agreement with that provider. As between the parties, that provider is accordingly engaged by Customer and processes Customer's communications on Customer's behalf and not on Bright Growth's, and is not a Subprocessor of Bright Growth within the meaning of Section 1.7; Customer's selection of, or change to, that provider is not a change to Bright Growth's Subprocessors and does not give rise to notice under Section 6.2. Section 13.2 concerns the AI provider accounts Bright Growth itself uses and does not apply to Customer's account, whose terms are a matter for Customer and its provider. Where Customer's chosen provider is also named as a Subprocessor in Annex III, that entity acts in two separate capacities, for Customer under Customer's agreement and for Bright Growth under Bright Growth's, and Annex III describes only the latter.
(d) Ingestion credentials. Customer is responsible for safeguarding any ingestion credential Bright Growth issues to it and for submissions made using that credential, and will notify Bright Growth promptly if it believes the credential has been compromised.
(e) Employee data and workforce notification. Customer is the controller of personal data relating to its own personnel contained in the communications from which it derives Customer-Extracted Findings. Customer is responsible for any workforce notification, consultation (including with works councils or employee representatives), or other employee-data compliance obligation arising from its use of this option. Findings relating to Customer's personnel are aggregated at the team level by default; individual-level attribution requires the administrative opt-in described in Section 4.3(b), and the Platform refuses a submission requesting individual-level attribution where that opt-in has not been enabled.
4.6 Team Onboarding Surveys. Where Customer uses a Team Onboarding Survey, Customer selects the recipients and supplies their names, job titles, and work email addresses. Each roster Customer creates, and each wave Customer sends, constitutes a documented instruction under Section 3.1. As between the parties:
(a) Roster lawfulness and notice. Customer is responsible for the lawfulness of the recipient details it supplies and for having a valid basis to have them surveyed, and for giving its own personnel any notice or information they are owed under applicable law about the survey and its purpose. Customer acknowledges that, because respondents answer individually and under their own name about their own workplace, this survey carries employee-monitoring and works-council exposure under applicable law (including GDPR Article 88 and national employment-data rules) that Customer, not Bright Growth, is responsible for assessing and satisfying.
(b) Attribution and readership. Team Onboarding Survey responses are attributed, not anonymous: a response is stored against the named recipient who gave it and is visible only to Customer's authorized users holding administrator-level access or above; an ordinary Customer user cannot read any recipient's response. The Platform displays a notice to each recipient, before the first question, stating that responses are attributed, who will see them, what they are used for, and how long they are kept. Unlike the Alignment Survey, a Team Onboarding Survey pairs no recipient with a counterpart, and there is accordingly no hold-back condition on when a response becomes visible.
(c) Engagement-close disposition. At the conclusion of the engagement for which a Team Onboarding Survey wave was sent, Customer, as controller, instructs Bright Growth to do one of three things with that wave: retain the responses as recorded; sanitise the wave, so that each respondent's name, job title, email address, and any other identifying detail is permanently removed while the wave's rated-question answers are retained and readable in aggregate; or delete the wave's recipients, responses, and answers entirely. Bright Growth acts on Customer's instruction; the choice is Customer's, not Bright Growth's. Sanitisation and deletion are irreversible, and Bright Growth offers Customer an export of the wave's data before either is carried out.
5. Confidentiality
5.1 Bright Growth will ensure that persons it authorizes to process Customer Personal Data are bound by written confidentiality obligations or are under an appropriate statutory duty of confidentiality, and access Customer Personal Data only as needed to deliver the engagement.
6. Subprocessors and other recipients
6.1 General authorization. Customer authorizes Bright Growth to engage the Subprocessors listed in Annex III.
6.2 Changes. Bright Growth will give Customer at least thirty (30) days' written notice (email to Customer's designated contact suffices) before adding or replacing a Subprocessor that will process Customer Personal Data. Customer may object in writing on reasonable data-protection grounds within that period; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected services and receive a pro-rata refund of prepaid fees.
6.3 Current list. Bright Growth will maintain the current Subprocessor list in Annex III and keep it consistent with the subprocessor disclosures in its published privacy notice.
6.4 Flow-down. Bright Growth will impose on each Subprocessor, by written agreement, data protection obligations materially no less protective than those in this DPA, and remains liable to Customer for each Subprocessor's performance.
6.5 Specialist Consultants are not Subprocessors. Specialist Consultants contract directly with Customer. Where a Specialist Consultant participates in Customer's engagement, Bright Growth may share Customer Content relevant to the consultant's portion of the work, at or with Customer's direction, and the consultant's confidentiality and data-handling obligations are established by Customer's agreement with the consultant. Bright Growth makes no representations or warranties regarding a Specialist Consultant's data practices, and processing performed by a Specialist Consultant outside the Platform is outside the scope of this DPA.
6.6 Specialist Consultants with Platform access. Where Customer's administrator grants a Specialist Consultant access to Customer's workspace on the Platform, that consultant is Customer's authorized user, accessing Customer Personal Data on Customer's behalf and under Customer's instructions, and not a Subprocessor, agent, or subcontractor of Bright Growth. Each grant Customer's administrator creates, its scope, and its duration constitute a documented instruction under Section 3.1. Bright Growth's obligations in respect of such access are limited to enforcing the access controls described in Annex II: consultant access is read-only, is limited to the document categories and assessment areas Customer's administrator selects, expires automatically after at most ninety (90) days unless renewed, and is revocable by Customer's administrator at any time. Customer is responsible for the consultant's use of the Platform and for any onward processing by the consultant, as it is for any other authorized user.
7. Security and personal data breach
7.1 Bright Growth will implement and maintain the technical and organizational measures described in Annex II, and may update them from time to time provided the updates do not materially reduce the overall level of protection.
7.2 Bright Growth will notify Customer without undue delay, and in any event within seventy-two (72) hours of confirming a personal data breach affecting Customer Personal Data. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed, and a contact point. Bright Growth will provide timely updates as material information becomes available. Bright Growth's notification is not an admission of fault.
8. Assistance
8.1 Data subject requests. Taking into account the nature of the processing, Bright Growth will assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligations to respond to data subject requests (access, rectification, erasure, restriction, portability, objection), including, where conversation-intelligence features are enabled, locating and deleting persisted findings and supporting excerpts that reference an identified data subject, and, where Alignment Surveys or Team Onboarding Surveys are used, locating and deleting an identified recipient's record and the responses stored against it. If Bright Growth receives such a request directly and can identify it as relating to Customer, it will forward the request to Customer without undue delay and will not respond substantively except to direct the requester to Customer, unless legally required.
8.2 DPIAs and consultations. Bright Growth will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent the required information is in Bright Growth's possession.
9. Return and deletion
9.1 During the engagement, Customer's users may export their uploaded documents on request to privacy@brightgrowth.io.
9.2 Upon termination or expiry of the Agreement, or earlier on Customer's written request, Bright Growth will delete or return (at Customer's choice) Customer Personal Data, including aggregate metrics, derived findings, and supporting excerpts created from Connected Sources or submitted as Customer-Extracted Findings, within thirty (30) days, except to the extent retention is required by law or the data resides in routine backups, in which case Bright Growth will isolate the data from further processing and delete it in the ordinary course of its backup cycle. Bright Growth will confirm completion in writing on request.
9.3 Alignment Survey retention. Alignment Survey recipient records and the responses stored against them are retained for three (3) years from the date of the survey wave, so that Customer can compare alignment across waves, and are then deleted. Bright Growth will delete them earlier on Customer's written request, or on the request of an individual recipient. Deleting a recipient record deletes the responses and answers stored against it. An evidence file a recipient attaches is stored as a Customer upload and is deleted separately on request.
9.4 Consultant-contributed material and consultant access at termination. Findings, notes, and other material a Specialist Consultant contributes to Customer's engagement, whether placed in Customer's workspace by Customer, by the consultant, or by Bright Growth at Customer's direction, are Customer Content. They are exportable under Section 9.1 and are deleted or returned with all other Customer Personal Data under Section 9.2. Any Platform access held by a Specialist Consultant ends no later than termination or expiry of the Agreement, and Bright Growth does not retain, reuse, or make available to any other customer material a consultant contributed to Customer's engagement.
9.5 Team Onboarding Survey retention. Team Onboarding Survey recipient records and the responses stored against them are retained for two (2) years from the date of the survey wave by default, and Bright Growth will apply a shorter or longer period on Customer's instruction. At the conclusion of the engagement, Customer's choice under Section 4.6(c) governs: the wave's responses are retained as recorded, sanitised of identifying detail while rated-question answers are kept in aggregate, or deleted. Bright Growth will delete recipient records and responses earlier on Customer's written request, or on the request of an individual recipient. Deleting a recipient record deletes the responses and answers stored against it.
10. Audit and information rights
10.1 Bright Growth will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including by completing Customer's written security questionnaires (no more than once per twelve-month period, absent a personal data breach or material change).
10.2 Bright Growth will provide copies of third-party security attestations or audit reports as and when they become available. (Customer acknowledges that, as of the DPA effective date, Bright Growth has not yet completed a SOC 2 or ISO 27001 audit; its current measures are described in Annex II.)
10.3 Where Data Protection Laws grant Customer a mandatory audit right that cannot be satisfied under 10.1–10.2, Customer (or an independent auditor that is not a Bright Growth competitor, bound by confidentiality) may audit Bright Growth's relevant processing operations, no more than once per twelve-month period, on at least thirty (30) days' notice, during business hours, at Customer's expense, in a manner that does not permit access to any other customer's data.
11. International transfers
11.1 Bright Growth is based in the United States, and Customer Personal Data is processed in the United States (and in other countries where Subprocessors operate, as listed in Annex III).
11.2 Where Customer transfers personal data subject to the GDPR to Bright Growth, the SCCs (Module Two: controller-to-processor) are incorporated into this DPA by reference, completed as follows: Clause 7 (docking) included; Clause 9 Option 2 (general authorization, 30 days' notice); Clause 11 optional language not included; Clause 17 governed by Irish law; Clause 18 courts of Ireland; Annexes I–III of this DPA serve as the SCC Annexes.
11.3 For transfers subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum (mandatory clauses of the ICO Addendum B1.0); for Swiss transfers, the SCCs apply with the adaptations required by the Swiss FDPIC (references to the GDPR read as the Swiss FADP; supervisory authority: FDPIC).
11.4 Bright Growth does not currently rely on the EU-U.S. Data Privacy Framework.
12. CCPA service-provider terms
12.1 Bright Growth is a "service provider" with respect to Customer Personal Data. Bright Growth will not (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than performing the services under the Agreement or as permitted by the CCPA; (c) retain, use, or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information it receives from other sources, except as permitted by the CCPA. Bright Growth certifies that it understands and will comply with these restrictions, and will notify Customer if it determines it can no longer meet its CCPA obligations, in which case Customer may take reasonable steps to stop and remediate unauthorized use.
13. AI processing
13.1 Bright Growth may use AI-assisted tools, including large language models accessed through a commercial Anthropic (Claude) account, on or off the Platform, to augment the services, including analyzing Customer Content and drafting Customer's audit, plan, and execution deliverables.
13.2 Bright Growth will use only AI provider accounts whose commercial terms provide that customer-submitted content is not used to train the provider's models absent a separate opt-in, and Bright Growth will not opt Customer Content into any such training.
13.3 Documents the Platform generates under an Engagement Agreement are produced by AI-assisted software and reviewed by Bright Growth personnel; each generated document displays whether it has been reviewed, a document marked "pending review" has not yet been reviewed by a person, and the reviewed state records who reviewed it and when and cannot be set from within Customer's workspace. Uploaded Customer Content analyzed by the Platform is transmitted to the AI provider named in Annex III for that purpose. A complimentary Marketing Snapshot is generated automatically and is not reviewed by Bright Growth personnel before delivery; it is produced under Section 2.2(c) rather than under this DPA, from publicly available information rather than Customer Content, and Section 21 of the Terms of Service governs it. In neither case does Bright Growth use Customer Personal Data to make automated decisions producing legal or similarly significant effects concerning any individual (GDPR Art. 22): automated assessments evaluate an organization's publicly visible marketing, not any individual.
13.4 Any addition of a new AI provider that will process Customer Content is a Subprocessor change subject to Section 6.2.
13.5 Conversation intelligence. Where Customer enables conversation-intelligence features, AI-assisted analysis reads communications from Customer's Connected Sources to extract structured marketing findings (for example, commonly raised objections, competitor mentions, or sources of customer awareness). The Platform persists only (a) the structured findings, each carrying its source reference, extraction-model provenance, and a confidence level, and (b) short supporting excerpts, subject before storage to an automated pattern check for email addresses and telephone numbers, which does not detect personal names. Full conversations, recordings, and transcripts are never persisted on the Platform. Findings do not modify any Customer canonical document or deliverable without review and approval by Customer's authorized users, and Customer controls the review and approval policy for findings in its workspace. Findings relating to Customer's personnel are aggregated at the team level by default, per Section 4.3(b) or, for Customer-Extracted Findings, Section 4.5(e).
13.6 Tenant-only findings. Findings, excerpts, and aggregate metrics derived from Customer's Connected Sources or submitted as Customer-Extracted Findings are used solely to deliver Customer's engagement. Bright Growth will not include them in cross-customer benchmarks, aggregations, or any shared or contributed data layer, will not make them available to any other customer, and will not use them to train AI models.
13.7 Customer-side extraction. Where a finding is a Customer-Extracted Finding, the extraction is performed by Customer using Customer's own AI provider account rather than by Bright Growth, and no conversation, recording, or transcript is transmitted to Bright Growth or to Bright Growth's AI provider. The persistence, review, and approval commitments in Section 13.5 apply to Customer-Extracted Findings once received. Section 13.2 applies to AI provider accounts used by Bright Growth. Bright Growth may make available to Customer an extraction recipe for this purpose; Customer determines whether to use it, what material to run it against, in which account to run it, and may modify it. Where a finding is a Customer-Extracted Finding, the extraction-model provenance recorded with it under Section 13.5 is as reported by Customer at the time of submission; Bright Growth records what Customer submits and does not independently verify which model produced the finding.
14. Liability, term, and general
14.1 Each party's liability arising out of or related to this DPA (including the SCCs) is subject to the exclusions and limitations of liability in the Agreement, except where Data Protection Laws do not permit such limitation.
14.2 This DPA takes effect on the effective date of the Agreement and remains in force as long as Bright Growth processes Customer Personal Data, surviving termination of the Agreement until all Customer Personal Data is deleted or returned under Section 9.
14.3 This DPA is governed by the law governing the Agreement (California), except where the SCCs require otherwise.
Annex I: Details of processing
A. List of parties. Data exporter: Customer (controller), as identified in the Agreement; contact per the Agreement. Data importer: CMO Success, LLC dba Bright Growth (processor), 946 Teresita Blvd, San Francisco, CA 94127, USA; privacy@brightgrowth.io.
B. Description of transfer/processing.
• Subject matter and nature: hosting, storage, organization, analysis (including AI-assisted analysis per Section 13), and preparation of deliverables from Customer Content, to deliver marketing audit, plan, and execution services; and AI-assisted research of publicly available information about Customer's own organization and about competitors Customer names, to produce briefs, diagnostics, and ongoing monitoring findings in Customer's workspace (personal data reached this way is limited to what is already public, for example, the names and roles of executives on a company website, and is processed only to assess the organization). Where Customer uses an Alignment Survey under Section 4.4: sending survey invitations and reminders to the recipients Customer identifies, collecting their responses, scoring those responses against a fixed published rubric, and presenting the result in Customer's workspace for Customer's review. Where Customer uses a Team Onboarding Survey under Section 4.6: sending survey invitations and reminders to the recipients Customer identifies, collecting their individual responses, and presenting them, attributed to each respondent, to Customer's engagement lead; the Platform performs no scoring of these responses. Where Customer connects sources under Section 4.3: read-only access to Customer's business systems to compute aggregate marketing metrics (only the aggregates are persisted), and, where conversation-intelligence features are enabled, read-only, AI-assisted analysis of communications in Customer's Connected Sources to extract structured marketing findings (only findings and short redacted excerpts are persisted, per Section 13.5). Where Customer submits Customer-Extracted Findings under Section 4.5: receipt, validation, and storage of structured findings and their short supporting excerpts, derived by Customer within Customer's own systems and Customer's own AI provider account; Bright Growth neither accesses nor receives the underlying communications.
• Duration: the term of the Agreement, plus the deletion period in Section 9.
• Categories of data subjects: Customer's employees and other personnel; Customer's authorized Platform users (including Specialist Consultants Customer grants access to); individuals publicly associated with Customer's organization or a named competitor (for example, executives named on a public website), to the extent referenced in public-web research; individuals incidentally referenced in Customer Content (e.g., personnel named in documents or in Specialist Consultant interview notes); where Customer connects communications sources, participants in Customer's business communications (Customer personnel and third parties such as Customer's customers and prospects), whose communications are read in place; where Customer uses an Alignment Survey, the individuals Customer identifies as recipients (typically Customer's own executives and the counterparts of its marketing function), who are not Platform users; where Customer uses a Team Onboarding Survey, the members of Customer's marketing team Customer identifies as recipients, who are not Platform users.
• Categories of personal data: business contact and professional information (names, titles, work contact details); personal data incidentally contained in business documents; Platform user account data to the extent processed on Customer's behalf; where Customer connects communications sources, the content of business communications read in place, of which only derived findings and short excerpts subject to an automated pattern check are persisted; where Customer submits Customer-Extracted Findings, the content of the finding and its short supporting excerpt as Customer submits them, Bright Growth having no access to the communication they were derived from; for Alignment Survey recipients, name, job title, and work email address, the recipient's own responses (ratings and other selections, free-text commentary, stated confidence, and any evidence file the recipient attaches), and delivery metadata (whether and when the invitation was sent, opened, reminded, and completed, and how long the response took); for Team Onboarding Survey recipients, name, job title, and work email address, the recipient's own responses (ratings and other selections and free-text commentary, which may name colleagues or former managers in answer to specific questions), and delivery metadata (whether and when the invitation was sent, opened, reminded, and completed, and how long the response took).
• Excluded data (per Section 4.2): contact-level records of Customer's own customers or prospects; sensitive/special-category data. Not intentionally processed or persisted; where present in a Connected Source, read in place only, per Section 4.2.
• Frequency: continuous during the engagement; Connected Source reads run on a schedule or on demand while a connection is active; Alignment Surveys are sent per wave, on Customer's instruction; Team Onboarding Surveys are sent per wave, on Customer's instruction, typically once at the start of an engagement.
• Retention: duration of active engagement; deletion per Section 9. A supporting excerpt is never retained longer than the finding it supports. Alignment Survey recipient records and responses are retained for three years from the survey wave, per Section 9.3. Team Onboarding Survey recipient records and responses are retained for two years from the survey wave by default, per Section 9.5, subject to Customer's engagement-close disposition choice under Section 4.6(c).
C. Competent supervisory authority (where the SCCs apply): determined per SCC Clause 13 based on the data exporter's establishment or representative.
Annex II: Technical and organizational measures
Stated as actually implemented and re-verified against the live system on 2026-09-02; updated as Bright Growth's security roadmap progresses. Nothing here is planned or partial.
• Tenant isolation: database-level row-level security scoping every read and write to the user's organization on every table in the database, with no exceptions; each customer workspace is isolated from every other customer's, enforced per-command in the database, not only in application code. An automated check that fails the build if any table lacks row-level security runs on every code change and daily; a separate automated isolation test suite runs daily.
• Storage access control: customer documents reside in a single private, organization-scoped storage bucket with no public access; object downloads are gated by the same database-level access rules (an object is retrievable only if the caller can see its catalog record), and storage paths are constrained to the owning organization. An automated check that the bucket is private and policy-covered runs on every code change.
• Role-based access: owner/admin/member/viewer roles with per-document minimum-role gating; unclassified documents default to deny. A separate consultant role has no standing rights of its own: its access exists only through a grant (below).
• Consultant access controls: a Specialist Consultant's access is read-only, scoped by the granting administrator to selected document categories and assessment areas, checked live on every query, expires automatically after at most ninety (90) days, and is revocable by Customer's administrator at any time; revocations are recorded in the audit log. Connector credentials, company profile, membership, and entitlement tables are never within a consultant's scope.
• Access provisioning: accounts obtain workspace membership only through invitations issued by Bright Growth or by Customer's own administrators; there is no self-service joining of another organization's workspace. New-account creation triggers an internal notification for review.
• Encryption in transit: HTTPS/TLS across the Platform and websites.
• Authentication and session verification: passwords hashed and managed by the authentication provider; Bright Growth has no access to plaintext credentials. Every request to the Platform is verified at the network edge, before any page or data is served, by checking the session token's signature; requests without a valid session are refused except for the public sign-in, password-reset, Snapshot-request, survey, and legal pages.
• Browser-side protections: an enforcing Content-Security-Policy on every page restricts script sources to the Platform itself and two named, version-pinned libraries; every third-party script carries an integrity hash so a modified copy will not execute; pages cannot be framed by other sites.
• Least-privilege internal access: internal access limited to personnel who need it to operate the services and deliver the engagement. Bright Growth staff access to the Platform runs through individually named operator accounts (one exists today), each with an active/revoked status; there are no shared or generic administrator accounts.
• Audit log: sign-ins, membership additions and removals, role and entitlement changes, consultant revocations, diagnostic submissions and approvals, and privileged diagnostic runs by Bright Growth staff (which require a stated reason from a fixed list) are recorded in an append-only audit log whose actor field is set by the database, not the caller. Two limits are stated rather than hidden: the log is tamper-evident, not tamper-proof; and not every read of customer data by Bright Growth staff is yet recorded.
• Backups and recovery: the database provider takes daily backups, retained for seven (7) days, after which they expire, so that data deleted under Section 9 leaves routine backups within that window; a full restore to a separate environment was rehearsed successfully in August 2026 and is documented in a recovery runbook.
• Preview environment: code changes are previewed against a separate database project containing synthetic data only; no preview build reaches production customer data.
• Public-endpoint abuse controls: the unauthenticated Snapshot-request endpoint enforces per-address and per-company rate limits and a daily spending cap; the authentication provider rate-limits sign-up emails.
• Connected Source credential handling: OAuth tokens and service credentials for Connected Sources are stored in a managed secrets vault, are never accessible to client applications or other customers, and are invalidated when Customer revokes a connection; revocation stops all further reads.
• Findings pipeline safeguards: AI extraction over communications runs without any tool or write access (extraction output is data, never an action); every finding is validated server-side against a versioned schema before persistence regardless of which model produced it; excerpts pass an automated pattern check for email addresses and telephone numbers before storage, which does not detect personal names and is additional to the redaction required before an excerpt is created or submitted; findings enter a pending-review state by default and are subject to Customer's review-and-approval controls, and no finding modifies a Customer canonical document or deliverable without approval by Customer's authorized users.
• Alignment Survey access control: a recipient's invitation token and any partially saved answers are withheld from every signed-in application role at the database's column level, so they cannot be retrieved even by an authorized user of the customer's own workspace; the schema stores only a hash of an invitation token, with no field in which a usable token could be held. Invitation links are 256-bit random tokens that stop working once the recipient submits, when the wave closes, or when Customer's administrator revokes the recipient; an unknown or expired link returns the same generic response, so links cannot be enumerated. Responses within a pair are unreadable (enforced by a database policy rather than by the interface) until both sides of that pair have submitted. Recipient records are readable only within the customer's own workspace.
• Infrastructure: hosted on the providers listed in Annex III, each operating its own certified data centers and platform security programs.
• Certifications: Bright Growth itself does not yet hold SOC 2 or ISO 27001; a certification roadmap is in progress, and reports will be made available under Section 10.2 when they exist. Bright Growth does not currently claim encryption-at-rest guarantees beyond its providers' own, enforced multi-factor authentication for customer users, a third-party penetration test, or a web application firewall.
Annex III: Subprocessors
Supabase, Inc.: authentication, database, encrypted credential vault, private file storage, and server-side functions for Platform workspaces. Location: USA (AWS us-east-1).
Netlify, Inc.: hosting and serving of the Platform, including the network-edge session check described in Annex II. Location: USA.
Resend, Inc.: transactional email (confirmations, password resets, invitations), Alignment Survey and Team Onboarding Survey invitations and reminders to the recipients Customer identifies, Snapshot-ready notifications, and internal account-creation notifications. Location: USA.
Anthropic, PBC: AI-assisted analysis and drafting via a commercial account, used by Bright Growth on or off the Platform (Section 13). Uploaded Customer Content analyzed by the Platform is transmitted to Anthropic for that analysis. Where the Platform runs automated web research, search queries are executed through Anthropic's web-search tool and the search subprocessors named on Anthropic's own published subprocessor list; those queries contain search terms about the organization being researched, never Customer account data. Location: USA.
Functional Software, Inc. (Sentry): application error monitoring for the Platform. When a page in a signed-in Platform session encounters an error, Sentry receives the technical error details, the page address, browser and device information and, as with any web request, the user's IP address. Bright Growth does not configure Sentry to attach a user's name, email address, or account identifier, and the Sentry project is set not to store IP addresses with error reports. Location: USA.
GitHub, Inc. (a Microsoft company): private source-code repository in which Bright Growth stores its engagement working files, including audit, plan, and execution deliverables prepared for Customer outside the Platform. Location: USA.
Note: Platform pages, including the public sign-in, Snapshot-request, and survey pages, load open-source script libraries and fonts from content delivery networks (currently jsDelivr, Google Fonts, and Sentry's script CDN), which receive user IP addresses and standard technical request data to serve those files; they do not receive Customer Content. Google (Analytics/Tag Manager) and Squarespace serve only Bright Growth's marketing site and do not process Customer Content. Where Customer connects its own business systems under Section 4.3 (for example, HubSpot or Google Analytics), those vendors are Customer's providers, not Bright Growth's Subprocessors.
Execution. This DPA is incorporated by reference into the Agreement and takes effect without signature. Customers who require a countersigned standalone copy for their records may request one at privacy@brightgrowth.io.