Doneven Ventures LLC d/b/a DV Technologies

SUBPROCESSOR LIST

Third parties that process personal information in connection with the Services

Version 1.0 | Effective Date: January 1, 2026 | Last Updated: January 1, 2026

Doneven Ventures LLC d/b/a DV Technologies engages the third parties below to process personal information in connection with the DV Operating System. Each is bound by a written agreement imposing data protection obligations no less protective than those in our Data Processing Addendum.

We provide at least thirty (30) days' notice before adding or replacing a subprocessor that processes personal information. To receive notifications, email privacy@dvtechnologies.com with the subject line "Subprocessor notifications."

1. CORE INFRASTRUCTURE (ALL CUSTOMERS)

• Lovable (application platform) - Application hosting, build and deployment, managed backend. Data: all Customer Data. Location: United States.

• Supabase (database, authentication, storage) - PostgreSQL, identity, file and photo storage. Data: all Customer Data, credentials, files. Location: United States.

• Cloudflare - Edge compute, content delivery, network security. Data: data in transit; request metadata. Location: United States (global edge).

2. ARTIFICIAL INTELLIGENCE (WHERE AI FEATURES ARE ENABLED)

• Lovable AI Gateway - Routing of AI requests. Data: content submitted for AI processing. Location: United States.

• Google (Gemini models) - Transcription support, extraction, summarization, QA scoring, draft generation. Data: transcripts, message content, lead and job records submitted for processing. Location: United States.

• OpenAI - Text-to-speech for training narration; model access where routed. Data: training script text; content submitted for processing. Location: United States.

Our AI providers are contractually prohibited from using data submitted through the Services to train their own general-purpose models.

3. ELECTRONIC SIGNATURE (WHERE ENABLED)

• SignWell - Electronic signature delivery, execution, and audit trail. Data: document content, signer name, email, IP, signature timestamps. Location: United States.

• SignNow (alternative, where elected) - Same function and data categories. Location: United States.

4. OPTIONAL INTEGRATIONS (ONLY WHERE CUSTOMER PROVISIONS THEM)

• Laxis - AI call note-taking and transcript delivery. Data: call audio, transcripts, summaries. Location: United States.

• Twilio (planned) - Voice, SMS, number provisioning. Data: phone numbers, call metadata, recordings, message content. Location: United States.

• Stripe or Paddle (planned) - Payment processing. Data: billing contact details, transaction records. Full card numbers are handled by the processor and are not stored by Company. Location: United States.

• Resend or equivalent (planned) - Transactional email. Data: recipient email, message content. Location: United States.

• Google Workspace / Microsoft 365 calendar (planned) - Calendar sync. Data: event titles, times, locations, attendee details. Location: United States.

• Accounting export target such as QuickBooks (planned) - Invoice and cost export. Data: invoice, job cost, and client billing records. Location: United States.

Items marked (planned) are not currently engaged. This list will be updated, with notice, before any planned provider begins processing customer data.

5. DATA LOCATION AND OBJECTIONS

All subprocessors listed above process personal information in the United States. We do not currently transfer personal information outside the United States. Customers may object to a new subprocessor in writing within fifteen (15) days of notice, on reasonable data protection grounds, as set out in Section 5 of the Data Processing Addendum.

Contact: privacy@dvtechnologies.com

© 2026 Doneven Ventures LLC d/b/a DV Technologies. All rights reserved.

legal@dvtechnologies.com | [Principal Place of Business Address], California