Data Processing Addendum
KISAES, LLC, doing business as OwnerTrack ("OwnerTrack", "we", "us"). Effective date: November 16, 2026.
This Data Processing Addendum (this "DPA") forms part of the OwnerTrack Terms of Service (the "Terms") between OwnerTrack and each lender that holds an OwnerTrack account (the "Lender", "you"). It applies automatically when you accept the Terms; no separate signature is needed. If you would like a countersigned copy for your records, email info@kisaes.com.
In short: you control your borrowers' information. We process it only to run the Service for you, protect it with the safeguards in Annex 2, tell you promptly if there is a security incident, use only the subprocessors listed in Annex 3, never sell it, and never use it to train AI models.
1. Definitions
Words defined in the Terms have the same meaning here. In addition:
• "Applicable Data Protection Laws" means the U.S. federal and state privacy, data-protection and data-security laws that apply to our processing of Personal Data under the Terms, including, where they apply, the Gramm-Leach-Bliley Act and its implementing rules (including the FTC Safeguards Rule, 16 CFR Part 314, and Regulation P / the FTC Privacy Rule) and the State Privacy Laws.
• "Customer Data" means information you, your authorized users, or your borrowers provide to the Service for processing on your behalf.
• "Data Subject" means the identified or identifiable individual to whom Personal Data relates, such as a borrower.
• "Personal Data" means Customer Data that is "personal data", "personal information", "nonpublic personal information" or a similar term under Applicable Data Protection Laws. It does not include information about you and your own staff that we collect to run your account (that information is covered by our Privacy Policy).
• "Process" or "Processing" means any operation performed on Personal Data, such as collecting, recording, storing, calculating, retrieving, using, transmitting, disclosing, or deleting it.
• "Security Incident" means a breach of our security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in our possession or control. It does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as failed sign-in attempts, pings, port scans, or blocked network attacks.
• "State Privacy Laws" means the comprehensive state consumer privacy laws in effect in the United States, and their regulations, to the extent they apply to our Processing of Personal Data.
• "Subprocessor" means a third party we engage to Process Personal Data in connection with the Service.
2. Roles and scope
2.1 You are the controller (or "business") of Personal Data about your borrowers and loans. You decide what to enter and how it is used. OwnerTrack is your processor and service provider (and a "service provider" for purposes of the Gramm-Leach-Bliley Act). The details of our Processing are described in Annex 1.
2.2 This DPA stays in effect for as long as we Process Personal Data for you, including after your account closes and until the data is deleted as described in Section 9.
2.3 If this DPA conflicts with the Terms on a matter of data protection, this DPA controls.
3. Your instructions
3.1 We will Process Personal Data only on your documented instructions. By using the Service, you instruct us to Process Personal Data to provide the Service as described in the Terms, the Privacy Policy and this DPA, including to send statements, notices and messages you set up, to operate the borrower portal you enable, and, if you turn it on, to operate the AI assistant.
3.2 If you need us to do something outside what the Service normally does, we will discuss it with you and agree to it in writing first.
3.3 We will tell you if we believe an instruction violates Applicable Data Protection Laws, unless the law prohibits us from doing so.
4. Financial-privacy (GLBA) commitments
4.1 We understand that you may be a "financial institution" under the Gramm-Leach-Bliley Act and that borrower information in the Service may be "nonpublic personal information" or "customer information".
4.2 We will not use or disclose nonpublic personal information we receive from you except to perform the Service for you, as permitted by the exceptions in 16 CFR 313.14 and 313.15 (and the equivalent provisions of Regulation P), or as required by law.
4.3 We will implement and maintain appropriate safeguards for customer information, as described in Section 5 and Annex 2. This DPA is intended to serve as the contract with a service provider that the FTC Safeguards Rule (16 CFR 314.4(f)) asks financial institutions to have in place.
4.4 On reasonable request, no more than once per year, we will answer a written security questionnaire and provide a summary of our safeguards so you can oversee us as your service provider, as described in Section 8.
5. Security
5.1 Security measures. We will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as described in Annex 2 (the "Security Measures"). We may update the Security Measures over time, but we will not materially reduce the overall protection of Personal Data.
5.2 Our personnel. Anyone we authorize to access Personal Data is bound by confidentiality obligations, and access is limited to what is needed to provide the Service and support.
5.3 Security Incidents. We will notify you without undue delay, and in any event within 72 hours, after we confirm a Security Incident affecting your Personal Data. We will send the notice to the email address on your account and will include, to the extent known at the time, what happened, the types of data and approximate number of borrowers affected, what we have done to contain it, and steps we recommend you take. We will update you as we learn more, reasonably cooperate with your investigation, and give you the information you reasonably need to meet your own notification obligations, including any notice you must give to the Federal Trade Commission under 16 CFR 314.4(j). Our notice is not an admission of fault.
5.4 Your notification obligations. You are responsible for deciding whether a Security Incident must be reported to borrowers, regulators, or others, and for giving those notices. If a notice you give will name or describe OwnerTrack, where the law allows, please let us review it in advance so it accurately describes our role.
5.5 Your security responsibilities. You are responsible for how you use the Service, including keeping your sign-in credentials and devices secure, controlling who in your business has access, enabling the security features available to you (such as passkeys), and keeping your own exports of records you are required to retain.
6. Data you may and may not enter
6.1 The Service is designed for loan-servicing information, including borrower names, contact details, property addresses, loan terms, payment history, escrow items, the last four digits of a borrower's Social Security number and date of birth (for tax-form generation), and your own EIN or tax identifier.
6.2 You agree not to enter the following ("Restricted Data") into the Service: full Social Security numbers or other full government ID numbers, except in a field the Service specifically designates for that purpose; payment-card numbers; bank account numbers, routing numbers or online-banking credentials; passwords for other services; health or medical information; biometric information; personal information of children under 18; or information about people who are not parties to a loan you service.
6.3 You are responsible for giving any notices and obtaining any consents the law requires before you enter Personal Data into the Service or enable email or SMS to borrowers, including your own GLBA privacy notice to borrowers where it applies.
7. Requests from borrowers and other Data Subjects
7.1 The Service lets you view, correct, export and delete borrower records yourself. Where you need more help responding to a request from a borrower to access, correct or delete their information, we will provide reasonable assistance.
7.2 If we receive a request directly from one of your borrowers, we will tell you promptly (unless the law prohibits it) and direct the borrower to you. You are responsible for responding.
8. Information and audits
8.1 Once per year, or more often if a regulator with authority over you requires it, you may request information to verify our compliance with this DPA. We will respond to a reasonable written security questionnaire and provide a written summary of our Security Measures. If we later obtain an independent security assessment or certification (such as a SOC 2 report), we may provide it instead.
8.2 If you are legally required to do more than that, we will work with you in good faith on a reasonable scope, timing and confidentiality terms. Any on-site or third-party audit is at your expense, must be scheduled at least 30 days in advance, must not compromise the security of other customers' data, and is subject to a customary confidentiality agreement.
9. Return and deletion
9.1 While your account is open, you can export your data at any time using the Service's export features (including full JSON export).
9.2 When you close your account, or after we terminate it, export remains available for 30 days unless the law prevents it. We then delete Personal Data within 90 days of the closure, as described in the Privacy Policy.
9.3 We may keep Personal Data where the law requires it, and we keep audit logs and generated tax forms and statements for 7 years to support record-keeping obligations. Data in backups is deleted when the backups expire, as described in the Privacy Policy. Anything we keep remains protected by this DPA and is used only for the reason it was kept.
10. Subprocessors
10.1 You authorize us to use the Subprocessors listed in Annex 3 and in the Service Providers section of our Privacy Policy.
10.2 We have written agreements with each Subprocessor that require it to protect Personal Data and use it only to provide its service to us. We remain responsible for our Subprocessors' performance under this DPA.
10.3 Before a new Subprocessor begins Processing Personal Data, we will update the Privacy Policy and notify you by email at least 15 days in advance (or as soon as practical if we must change providers urgently to keep the Service running or secure). If you object on reasonable data-protection grounds, tell us in writing within 15 days of the notice and we will try in good faith to resolve it. If we cannot, you may close your account, and we will refund the unused portion of any per-loan fees you prepaid, prorated by month.
11. Artificial intelligence
11.1 The AI assistant is off unless your account administrator turns it on. When it is on, we Process the limited loan summary described in the Privacy Policy to answer your questions.
11.2 We will not use Personal Data to train, fine-tune, or improve any AI or machine-learning model, ours or anyone else's. We contractually prohibit our AI inference providers from using Personal Data to train their models.
11.3 The Service does not make automated decisions about borrowers. The assistant is read-only and cannot change a loan, assess a fee, or take any action.
12. State Privacy Laws
To the extent State Privacy Laws apply to Personal Data, we:
• Process it only for the limited and specified purposes in the Terms and this DPA;
• will not sell or share it, or use it for targeted advertising;
• will not retain, use, or disclose it for any purpose other than providing the Service, or outside our direct business relationship with you, except as the law permits;
• will not combine it with personal information we receive from anyone else or collect on our own, except as needed to provide the Service and as the law permits;
• will provide the same level of protection the State Privacy Laws require, and tell you if we determine we can no longer meet our obligations; and
• allow you to take reasonable steps to stop and remediate any unauthorized use.
We certify that we understand and will comply with these restrictions.
13. General
13.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.
13.2 We may update this DPA to keep up with changes in the law or our Subprocessors. We will give at least 30 days' notice of material changes, and no change will materially reduce the protection of Personal Data without your agreement.
13.3 Notices under this DPA go to the email address on your account. Notices to us go to info@kisaes.com.
Annex 1 – Details of Processing
Processor: KISAES, LLC, doing business as OwnerTrack, 6041 S Brightwater Trl, Springfield, MO 65810. Privacy contact: info@kisaes.com.
Controller: The Lender that holds the OwnerTrack account. Contact: the email address on the account.
Nature and purpose: Hosting, calculating, storing and displaying loan-servicing records; generating statements, notices, payoff quotes and year-end tax forms; delivering email and SMS the Lender sets up; operating the borrower portal; and, if enabled, answering the Lender's questions with the AI assistant.
Data Subjects: Borrowers, co-borrowers and guarantors on loans the Lender services, and any authorized users the Lender adds.
Categories of Personal Data: Name, email address, phone number, mailing and property address; last four digits of Social Security number and date of birth (where entered for tax reporting); loan terms, balances, payment history, late fees, escrow items and disbursements; portal sign-in activity and preferences; messages between the Lender and borrower; payment confirmations; IP address and device information from portal use.
Sensitive data: Partial Social Security number and date of birth, protected by the Security Measures in Annex 2, including encryption at rest and exclusion from AI assistant summaries.
Frequency: Continuous, for as long as the Lender uses the Service.
Duration: For the life of the account and the retention periods in Section 9.
Annex 2 – Security Measures
We maintain the following measures, which we review and update as the Service and threats change:
• Encryption: All connections to the Service use HTTPS (TLS). Customer Data is encrypted at rest.
• Tenant isolation: Each Lender's data is logically separated from every other Lender's, and the Service enforces that separation on every request.
• Authentication: Lender passwords are stored only as salted hashes; passkeys are available. Borrower portal access uses expiring magic links or a hashed PIN. Sign-in attempts are rate-limited and protected against brute-force attacks.
• Administrative access: Access to production systems is limited to authorized OwnerTrack personnel who need it, through restricted, key-based administrative access that is not exposed to the public internet. Staff access to customer data is limited to what support requires and is logged.
• Audit logging: The Service records sign-ins and changes to loans and settings, including who made them.
• Backups and recovery: Customer Data is backed up [[CONFIRM: nightly]] and backups are retained for 30 days, so the Service can be restored after an outage or data loss.
• Hosting: The Service runs on DigitalOcean infrastructure in the United States, which provides physical and environmental security for its data centers.
• Vulnerability and change management: We apply security updates to servers and software dependencies, review changes before deployment, and monitor the Service for errors and suspicious activity.
• Data minimization in AI: AI assistant requests exclude borrower contact details, Social Security digits, dates of birth, documents and messages.
• Incident response: We maintain procedures to investigate, contain, and recover from Security Incidents and to notify affected Lenders as described in Section 5.3.
• Secure disposal: Deleted data is removed from active systems and expires from backups on the backup retention schedule.
Annex 3 – Subprocessors
DigitalOcean, LLC (United States) — Hosting, storage, backups, and AI inference (Gradient AI Platform)
Anthropic, PBC (United States) — AI inference, only when the account is configured to use Anthropic's API
Emailit (email delivery) — Delivery of statements, reminders, notices and portal links by email
Twilio, Inc. or TextLink — SMS delivery, only when the Lender enables SMS
Stripe, Inc. (United States) — Billing for the Lender's OwnerTrack subscription (does not receive borrower data)
The current list is always available in the Service Providers section of our Privacy Policy.
