Data Processing Agreement: Texas First Rentals Test Run

"Agreement" means the AnswerShare Master Agreement that Customer accepted on 16 October 2026 together with AnswerShare's proposal for Texas First Rentals: the End User License Agreement, version 2026-06-18, published at https://answershare.com/eula, including its Part 2, Data Processing Addendum. [CONFIRM: that this acceptance is the agreement governing the Test Run.]

"Applicable Privacy Law" means the Texas Data Privacy and Security Act (Texas Business and Commerce Code, chapter 541) and any other United States privacy law that applies to the processing under this DPA.

"Customer Personal Data" means personal data, as defined in section 541.001 of the Texas Business and Commerce Code, that AnswerShare processes on Customer's behalf in the Test Run. As that section provides, it does not include deidentified data or publicly available information.

"Rewrite Rule" means the rewrite rules in Customer's Vercel project configuration [CONFIRM: file name, next.config.js or vercel.json] that send to AnswerShare's endpoint (a) page requests whose user agent matches the named list of AI crawlers in the rule, and (b) requests for /llms.txt and /llms-full.txt. The rule names the search-engine crawlers it excludes.

"Test Run" means the trial described in the Test-Run Plan, from the first deployment of the Rewrite Rule, including to a Vercel preview, until the end date in that plan. [CONFIRM: start and end dates.]

"Subprocessor" means a third party that AnswerShare engages to process Customer Personal Data.

This DPA supplements Part 2 of the Agreement for the Test Run. Where the two conflict, this DPA controls for processing in the Test Run. [CONFIRM: supplement Part 2 rather than replace it.]

Customer is the controller and AnswerShare is the processor of Customer Personal Data.

Each party handles the other's business contact details (names, work email addresses and work phone numbers of the people working on the Test Run) as an independent controller, to administer the Agreement. This DPA does not cover that information.

Clause 6.3 sets out how records of requests received through the Rewrite Rule are kept.

AnswerShare will process Customer Personal Data only on Customer's documented instructions. This DPA, the Agreement and the Test-Run Plan are those instructions. They authorize only the following:

• (a)receiving requests sent by the Rewrite Rule and returning the machine-readable version of the requested public page or file;
• (b)recording those requests to measure how AI systems read Customer's site, to detect faults and misuse, and to check that the Rewrite Rule matches only the intended crawlers;
• (c)collecting Customer's public site content when Customer's publish webhook reports a change, and in a scheduled check of Customer's sitemap;
• (d)reading aggregate Google Analytics 4 and Search Console reports, read-only, if Customer grants access;
• (e)receiving any aggregate request counts by AI-crawler user agent that Customer chooses to export from Vercel for the baseline (Customer will send daily counts, not raw request logs) [CONFIRM: matches the measurement plan];
• (f)running measurement prompts about Customer's market and brand on the AI answer engines listed in Annex C and recording their answers; and
• (g)reporting results to Customer.

AnswerShare will tell Customer promptly if it believes an instruction would break Applicable Privacy Law, and need not follow that instruction until Customer confirms or changes it.

AnswerShare will not sell Customer Personal Data, use it for targeted advertising, or use it to train any third-party foundation model or general-purpose machine-learning model. Aggregate counts that identify no person, such as the number of requests per crawler per day, are not Customer Personal Data.

Customer may change these instructions in writing. Changes to the Rewrite Rule, including its crawler list and the address of AnswerShare's endpoint, take effect only when Customer reviews, merges and deploys them.

Purpose: to test whether serving a machine-readable version of Customer's public pages to AI crawlers improves how AI systems read, cite and recommend Customer, and to measure the result against a baseline.

Nature: automated receipt, storage, analysis and reporting, as described in Annex A. AnswerShare does not set cookies, does not add scripts to Customer's pages, and does not receive the forms, quote requests or other information that people enter on Customer's site.

The people and organizations whose data may be processed are:

• (a)operators of AI crawlers and AI assistants, such as OpenAI, Anthropic, Perplexity and Google, whose systems request Customer's pages, including fetches an assistant makes while answering a person's question;
• (b)anyone who requests /llms.txt or /llms-full.txt from Customer's site; and
• (c)anyone who sends a request whose user agent imitates a listed AI crawler.

People browsing Customer's site, and the search-engine crawlers named in the Rewrite Rule (Googlebot in all its variants, Google-InspectionTool, Bingbot, Applebot, DuckDuckBot, YandexBot and Baiduspider), do not match the page rule. Vercel serves their page requests, and those requests do not reach AnswerShare.

Annex A lists the data AnswerShare receives and keeps in the Test Run.

AnswerShare does not ask for, and Customer will not send, sensitive data as defined in Applicable Privacy Law, or data about known children.

Most requests under clause 4.3(a) come from networks run by AI companies, and their IP addresses identify company infrastructure rather than a person. AnswerShare still treats every IP address it receives through the Rewrite Rule as personal data, because a request under clause 4.3(b) or 4.3(c) may come from an individual.

Processing begins when Customer first deploys the Rewrite Rule, including to a Vercel preview, and continues for the Test Run.

At the end of the Test Run, unless the parties extend it in writing: Customer removes the Rewrite Rule and its publish webhook; AnswerShare stops measurement for Customer and removes its analytics access.

Records of requests received through the Rewrite Rule. [DECISION for Robert: choose Option A or Option B and delete the other before this draft is sent.]

• Option AAnswerShare keeps these records, including IP addresses and request headers (with cookie and credential values removed), for research on how AI systems and search engines crawl and use websites, for as long as AnswerShare holds the data, as its published privacy policy states. For that research AnswerShare acts as an independent controller of these records, not as Customer's processor, and clause 13 does not apply to them. Reports to Customer show aggregate counts and never IP addresses.
• Option BThese records are Customer Personal Data. AnswerShare keeps them for the Test Run and [CONFIRM: 12] months after it ends, to support the results report, and then deletes them, or permanently removes their IP addresses and request headers and keeps only aggregate counts.

Public site content and measurement records are kept for the engagement plus 12 months and then deleted, unless Customer asks in writing for earlier deletion. Aggregate analytics exports are kept for the same period.

AnswerShare will ensure that each person who processes Customer Personal Data is subject to a duty of confidentiality with respect to that data. Today those people are AnswerShare's co-founders, Robert Maynard and Kevin Myers. [CONFIRM: a written confidentiality obligation binds each of them.]

AnswerShare also uses AI software agents to operate and maintain its systems. They act under the supervision of those people, with access those people grant, and run on the model providers listed in Annex C.

Customer dashboards and reports show aggregate crawler activity and never IP addresses.

AnswerShare will maintain the measures in Annex B for the Test Run and will not reduce them materially.

Taking into account the nature of the processing and the information available to it, AnswerShare will help Customer meet its obligations on the security of processing, including for any personal data collected, stored or processed by an AI system.

AnswerShare will notify Customer without undue delay, and within [CONFIRM: 24] hours, after confirming a breach of security of its systems that affects Customer Personal Data.

The notice will state, as far as then known: what happened, the data and approximate number of people affected, the likely consequences, the steps taken or proposed, and a contact. AnswerShare will send updates as it learns more and will cooperate with Customer on any notice Customer must give under chapter 521 of the Texas Business and Commerce Code or other law.

Notices go by email and phone to Customer's notice contacts. [CONFIRM: Customer's notice contacts.]

AnswerShare will pass to Customer, without undue delay, any request from a consumer about Customer Personal Data, and will not answer it except on Customer's instruction. Taking into account the nature of the processing, AnswerShare will help Customer respond. AnswerShare's records hold no names or accounts, so it can find a person's records only by an IP address and time that Customer supplies.

AnswerShare will give Customer the information it needs to conduct and document a data protection assessment of the Test Run.

On reasonable request, AnswerShare will make available to Customer all information in its possession that is necessary to demonstrate its compliance with chapter 541 of the Texas Business and Commerce Code.

AnswerShare will allow, and cooperate with, reasonable assessments by Customer or an assessor Customer designates who is bound by confidentiality, on 30 days' written notice, during business hours and limited to the Test Run processing. Unless a security incident or a regulator requires otherwise, assessments take place no more than once during the Test Run.

AnswerShare does not hold a SOC 2 report or an ISO 27001 certification. It meets this clause through clauses 11.1 and 11.2.

Customer authorizes AnswerShare to use the Subprocessors listed in Annex C.

AnswerShare will engage each Subprocessor under a written contract that requires the Subprocessor to meet AnswerShare's obligations under this DPA with respect to Customer Personal Data. [CONFIRM: each Subprocessor's data processing terms are in place.]

AnswerShare will give Customer 30 days' written notice before adding or replacing a Subprocessor. Customer may object on reasonable data-protection grounds. If the objection is not resolved, Customer may end the Test Run by removing the Rewrite Rule.

AnswerShare remains responsible to Customer for each Subprocessor's performance of these obligations.

At Customer's direction, after the Test Run ends, AnswerShare will delete or return all Customer Personal Data within 30 days of Customer's request, unless law requires AnswerShare to keep it. Clause 6.3 governs records of requests received through the Rewrite Rule.

Returned data is provided as CSV or JSON files.

Copies in AnswerShare's hosting providers' automatic backups expire on the provider's backup schedule [CONFIRM: backup retention period] and are not restored or used in the meantime.

On request, AnswerShare will confirm the deletion in writing.

This DPA starts when both parties sign it and ends when the Test Run ends. If the parties continue the service after the Test Run under the Agreement, this DPA continues until the parties replace it.

Clauses 7, 9, 11 and 13 continue for as long as AnswerShare holds Customer Personal Data.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement (section 12 of the End User License Agreement), except where Applicable Privacy Law does not allow liability to be limited.

As section 541.104(d) of the Texas Business and Commerce Code provides, this DPA does not relieve either party of the liabilities that come with its role in the processing.

This DPA is governed by the law that governs the Agreement [CONFIRM: Arizona, under section 16 of the End User License Agreement, or Texas for this DPA]. Applicable Privacy Law applies by its own terms.

Notices under this DPA are given in writing to the contacts each party names on signature.

This DPA may be signed electronically and in counterparts.