This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Cuco's House LLC, a Texas limited liability company doing business as WolfIT (“WolfIT”), and the customer that accepts it (“Customer”). It takes effect when Customer accepts the Terms. Capitalized terms not defined here have the meaning given in the Terms.
“Customer Personal Data” means personal information contained in Customer Data or in Licensed Data that WolfIT processes on Customer’s behalf.
“Data Subject” means the identified or identifiable individual to whom Customer Personal Data relates.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
“Subprocessor” means a third party engaged by WolfIT to process Customer Personal Data, including any Data Partner that provides Licensed Data.
“Controller,” “processor,” “business,” “service provider,” “sell,” and “share” have the meanings given in the applicable Privacy and Data Protection Laws.
2.1 Customer is the controller (or business) of Customer Personal Data. WolfIT is Customer’s processor (or service provider). Data Partners, including FullEnrich Corp, act as WolfIT’s Subprocessors when they process data to fulfill Customer’s requests. Customer acts as controller and WolfIT as processor; a Data Partner acting under this DPA is a subsequent subprocessor.
2.2 This DPA does not cover: (a) the WolfIT Corpus, which WolfIT compiles from publicly available sources on its own behalf and which is governed by the Privacy Policy and the Data Sources & Accuracy Statement; and (b) account, billing, and usage information about Customer and its Authorized Users, which WolfIT processes as an independent controller under the Privacy Policy.
2.3 If a Data Partner provides information from its own database as an independent controller, the Service will identify that Data Partner and link to its privacy notice, which describes its processing.
2.4 Annex 1 describes the processing. Annex 2 identifies the Subprocessors. Annex 3 describes WolfIT’s security measures.
Customer will: (a) have a lawful basis for all Customer Personal Data it provides or requests, and give any notice or obtain any consent that Privacy and Data Protection Laws require; (b) use Licensed Data only for its Internal Business Purposes and in accordance with Section 8A of the Terms; (c) give only lawful instructions and not upload sensitive personal information (such as government identifiers, financial account numbers, health information, precise geolocation, or information about children) unless a Service feature expressly allows it; (d) respond to Data Subject requests it receives, and honor opt-out and do-not-contact requests; and (e) ensure its Authorized Users comply with this DPA. Customer is responsible for their acts and omissions.
By accepting the Terms, Customer expressly consents to the processing of personal data described in this DPA in compliance with Privacy and Data Protection Laws, and to the engagement of the Subprocessors identified in Annex 2, including the designation of FullEnrich Corp as a Subprocessor.
4.1 Instructions. WolfIT processes Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA, and Customer’s use of the Service are those instructions. WolfIT will tell Customer if it believes an instruction violates Privacy and Data Protection Laws.
4.2 Confidentiality. WolfIT grants access to Customer Personal Data only to personnel who need it to provide the Service and who are bound by confidentiality obligations.
4.3 Security. WolfIT maintains the technical and organizational measures described in Annex 3.
4.4 Service-provider commitments. WolfIT will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than providing the Service, or outside the direct business relationship with Customer; or (c) combine it with personal information WolfIT receives from or on behalf of another person, except as Privacy and Data Protection Laws permit. WolfIT will comply with applicable Privacy and Data Protection Laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized use. WolfIT certifies that it understands these restrictions.
4.5 No reuse of Licensed Data. Licensed Data obtained for Customer is never made available to another customer and is never used for WolfIT’s own purposes. If another customer requests the same information, it is obtained separately for that customer.
5.1 Customer gives general authorization for WolfIT to use the Subprocessors identified in Annex 2. WolfIT imposes data protection obligations on each Subprocessor that are no less protective than this DPA and remains responsible for its Subprocessors’ performance. A Data Partner’s own subprocessors are listed in Annex 2 and in our Subprocessor List, as last provided to WolfIT by that Data Partner.
5.2 WolfIT will notify Customer, by email or in the Service, at least seven (7) days before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it is not resolved, Customer may stop using the affected feature or terminate the affected subscription, without an early termination fee under Section 4.3 of the Terms, and receive a prorated refund of prepaid fees for the unused period.
WolfIT will promptly forward to Customer any request it receives from a Data Subject about Customer Personal Data, and will help Customer respond through the Service’s tools (search, correction, deletion, and export of Customer Data). Customer authorizes each Data Partner to handle Data Subject requests relating to the Data Partner’s service, to delete or restrict the data it holds, and to keep a general refusal list of individuals who asked to be deleted or not to be processed, applied to all of its clients. A Data Partner may honor an opt-out or deletion request addressed directly to it (for example, through a “Do not sell my information” form) and remove the affected Licensed Data without notice to Customer.
WolfIT will notify Customer without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Security Incident. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, a contact point, the likely consequences, and the measures taken or proposed. Information may be provided in phases. For an incident at a Subprocessor, WolfIT will notify Customer promptly after the Subprocessor informs WolfIT. A notice is not an acknowledgment of fault or liability.
Taking into account the nature of the processing, WolfIT will provide reasonable assistance with data protection impact assessments and consultations with regulators that Privacy and Data Protection Laws require of Customer. Assistance beyond the Service’s standard tools may be charged at reasonable cost.
9.1 Customer Data is returned and deleted as described in Section 15 of the Terms: export within thirty (30) days of termination, deletion from production systems after that, and encrypted backups kept no more than thirty (30) additional days.
9.2 Licensed Data is deleted from the Service without undue delay, and in any event within fourteen (14) days, when Customer deletes it, stops using the Service, or its subscription ends. Licensed Data that Customer exported or sent to its own CRM or internal systems during the subscription may be kept by Customer solely for its Internal Business Purposes, as set out in Section 8A.6 of the Terms; Customer remains the controller of that copy. Licensed Data is not included in the post-termination export.
9.3 A Data Partner may keep the data submitted for an enrichment request for a limited period under its own terms (for example, up to three months, then automatic deletion) and deletes it when its agreement with WolfIT ends.
9.4 On written request, WolfIT will confirm in writing that deletion has occurred.
10.1 WolfIT will make available the information reasonably necessary to demonstrate compliance with this DPA: this DPA, a summary of its security measures, the Subprocessor list, and answers to a reasonable security questionnaire, no more than once every twelve (12) months.
10.2 Customer, or an independent auditor bound by confidentiality, may audit WolfIT only (a) when required by law or a regulator, or (b) when there is documented indication of non-compliance with this DPA. Audits require thirty (30) days’ written notice, take place during business hours no more than once every twelve (12) months, are at Customer’s cost, and give no access to other customers’ data.
10.3 WolfIT, and Data Partners through WolfIT, may verify Customer’s compliance with this DPA and Section 8A of the Terms. Customer will provide the information requested within thirty (30) days.
WolfIT stores Customer Personal Data in the United States. Subprocessors may process it in the United States and the European Union, as listed in Annex 2. Where the transfer rules of the EU or UK GDPR apply, the parties will rely on the Standard Contractual Clauses adopted by the European Commission.
Each party’s liability under this DPA is subject to the limitations and exclusions in Section 19 of the Terms. Customer’s breach of Section 3 of this DPA is treated as a breach of Section 8A of the Terms for purposes of Sections 19 and 20 of the Terms.
This DPA lasts as long as WolfIT processes Customer Personal Data. If it conflicts with the Terms on the processing of personal information, this DPA controls; a signed order form controls over both. WolfIT may update this DPA to reflect changes in law or in a Data Partner’s requirements, with notice as described in Section 25 of the Terms.
Subject matter: providing the Service under the Terms.
Duration: the subscription term, plus the deletion periods in Section 9.
Nature: collection, storage, organization, retrieval, enrichment through Data Partners, display, AI-assisted summarization and drafting, and deletion.
Purpose: Customer’s CRM, prospecting, and account management for its own business.
Data Subjects: contacts at Customer’s prospects, customers, and partners (businesses and public organizations), and Customer’s Authorized Users.
Personal data: name, job title, employer, work email, business and mobile phone numbers, business address, professional profile URL submitted for enrichment, and notes, tasks, and correspondence about the business relationship.
Sensitive data: none intended.
The Subprocessors are those listed at wolfit.ai/legal/subprocessors, as updated under Section 5.
FullEnrich Corp (Delaware; 28 Geary St, Ste 650, San Francisco, CA 94108) is the Data Partner that finds work email addresses and telephone numbers when Customer asks the Service to find or unlock a contact. Role: subsequent subprocessor. Processing: “waterfall” enrichment of the details submitted for the search (name, company, company website, and professional profile URL where available), verification of the results, and temporary storage. Retention: enrichment data is stored by FullEnrich for three (3) months by default and then deleted automatically; all personal data processed for WolfIT is deleted when WolfIT’s agreement with FullEnrich ends. Location: FullEnrich is a United States company; its hosting stores data in the European Union, and some of its subprocessors are in the European Union and the United Kingdom.
FullEnrich’s subprocessors, as provided to WolfIT on November 3, 2026: DigitalOcean, LLC (cloud hosting; United States, storage in the European Union); Enrow and Icypeas (email generation; European Union); Datagma (enrichment; European Union); BounceBan (email deliverability; United States); EmailListVerify / CyberPanda (email deliverability; European Union); ListMint (email deliverability; United States); Telesign and Trestle (phone verification; United States); HLR Lookup (phone verification; United Kingdom).
FullEnrich also obtains data from integrated data providers that supply information from their own databases. Those providers are not subprocessors of Customer Personal Data under this DPA.
Account isolation: every record is scoped to its account; Licensed Data is stored per account and is never read across accounts.
Encryption: TLS in transit; encryption at rest in the managed database.
Secrets: API keys are held only in server-side secret storage, never in code or in the browser.
Access control: role-based access in the Service; production access limited to the owner of WolfIT.
Logging: a log of every request to a Data Partner, including the account, the user, and the credits used.
Abuse limits: rate limits, confirmation of credits before an unlock, and minimal data in responses.
Integrations: Data Partner callbacks are authenticated and processed once.
Backups: managed database backups and point-in-time recovery retained no more than thirty (30) days.
Deletion: a daily job removes Licensed Data whose retention has ended, and data is deleted on account closure.
Incident response: Security Incidents are handled and notified as set out in Section 7.
