Doneven Ventures LLC d/b/a DV Technologies

SUBPROCESSOR LIST

Third parties that process personal information in connection with the Services

Version 1.1 | Effective Date: January 1, 2026 | Last Updated: January 1, 2026

Doneven Ventures LLC d/b/a DV Technologies engages the third parties below to process personal information in connection with the DV Operating System. Each is bound by a written agreement imposing data protection obligations no less protective than those in our Data Processing Addendum.

We provide at least thirty (30) days' notice before adding or replacing a subprocessor that processes personal information. To receive notifications, email privacy@dv-technologies.com with the subject line "Subprocessor notifications."

1. CORE INFRASTRUCTURE (ALL CUSTOMERS)

• Lovable (application platform) - Application hosting, build and deployment, managed backend. Data: all Customer Data. Location: United States.

• Supabase (database, authentication, storage) - PostgreSQL, identity, file and photo storage. Data: all Customer Data, credentials, files. Location: United States.

• Cloudflare - Edge compute, content delivery, network security. Data: data in transit; request metadata. Location: United States (global edge).

• Google (Google Analytics 4) - Aggregate website usage measurement on our public marketing website only. Data: truncated IP address, device and browser type, approximate location, and redacted page addresses. No Customer Data is sent. Storage on the visitor's device occurs only where the visitor accepts analytics cookies; advertising features, Google Signals, and ad personalization are disabled. Location: United States.

2. ARTIFICIAL INTELLIGENCE (WHERE AI FEATURES ARE ENABLED)

• Lovable AI Gateway - Routing of AI requests. Data: content submitted for AI processing. Location: United States.

• Google (Gemini models) - Transcription support, extraction, summarization, QA scoring, draft generation. Data: transcripts, message content, lead and job records submitted for processing. Location: United States.

• OpenAI - Text-to-speech for training narration; model access where routed. Data: training script text; content submitted for processing. Location: United States.

Our AI providers are contractually prohibited from using data submitted through the Services to train their own general-purpose models.

3. ELECTRONIC SIGNATURE (WHERE ENABLED)

• SignWell - Electronic signature delivery, execution, and audit trail. Data: document content, signer name, email, IP, signature timestamps. Location: United States.

• SignNow (alternative, where elected) - Same function and data categories. Location: United States.

4. OPTIONAL INTEGRATIONS (WHERE CUSTOMER OR COMPANY PROVISIONS THEM)

Providers in this section are engaged only where the integration is turned on for a customer, whether the customer holds the account itself or elects a DV-Managed Service under which Company holds and pays for the account. Company's data protection commitments and the notice period above apply the same way in both cases. Telephony and payment processing run on Company's own platform accounts for all customers where those features are enabled.

• Laxis - AI call note-taking and transcript delivery. Data: call audio, transcripts, summaries. Location: United States.

• Twilio (planned) - Voice, SMS, number provisioning. Data: phone numbers, call metadata, recordings, message content. Location: United States.

• Stripe or Paddle (planned) - Payment processing. Data: billing contact details, transaction records. Full card numbers are handled by the processor and are not stored by Company. Location: United States.

• Resend or equivalent (planned) - Transactional email. Data: recipient email, message content. Location: United States.

• Google (Workspace connections: Calendar, Gmail, Drive, Sheets, Docs) - Optional per-user connections a customer chooses to authorize. Data: calendar event titles, times, locations and attendee details; message content, files, and spreadsheet or document content the customer sends or reads through the connection. Access is limited to the scopes the user approves and can be disconnected at any time. Location: United States.

• Google, Microsoft, and Apple (sign-in providers) - Optional single sign-in for Authorized Users. Data: email address, name, and the provider account identifier. No Customer Data is sent to the sign-in provider. Location: United States.

• Microsoft 365 connections (planned) - Outlook mail and calendar, OneDrive files, Excel. Data: message content, event details, and file content the customer sends or reads through the connection. Location: United States.

• Accounting export target such as QuickBooks (planned) - Invoice and cost export. Data: invoice, job cost, and client billing records. Location: United States.

Where Company holds a provider account on a customer's behalf as a DV-Managed Service, Company remains the customer of record with that provider and that provider processes personal information as Company's subprocessor under the Data Processing Addendum. Customers may ask which provider and plan level Company holds for them at any time.

Items marked (planned) are not currently engaged. This list will be updated, with notice, before any planned provider begins processing customer data.

5. DATA LOCATION AND OBJECTIONS

All subprocessors listed above process personal information in the United States. We do not currently transfer personal information outside the United States. Customers may object to a new subprocessor in writing within fifteen (15) days of notice, on reasonable data protection grounds, as set out in Section 5 of the Data Processing Addendum.

Contact: privacy@dv-technologies.com

© 2026 Doneven Ventures LLC d/b/a DV Technologies. All rights reserved.

legal@dv-technologies.com | [Principal Place of Business Address], California