Earlier versions

Effective date: October 19, 2026
Last updated: October 19, 2026
Version: 1.3

1. Agreement to these Terms

These Terms of Service ("Terms") are a binding agreement between On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS ("Storm OS," "we," "us"), and the person or organization that creates a Workspace or uses the Service ("you," "Customer").

The "Service" means the Storm OS marketing site and the Storm OS application, both at storm-os.app (including the application's installable Progressive Web App), our APIs, and any related support and documentation.

By creating an account, accepting an invitation to a Workspace, installing the app, or otherwise using the Service, you agree to these Terms. If you do not agree, do not use the Service.

If you accept these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" means that entity.

The "Early Access Period" runs from August 1, 2026 through December 31, 2026. Storm OS is in early access during that time, and the third party services it runs on are still being selected, configured and tuned. Where these Terms, the Privacy Policy or the Data Processing Addendum promise a period of notice before a change takes effect, that period does not apply during the Early Access Period. We still tell you what changed and when, as soon as we reasonably can, and every right you have to object, to terminate or to export your data is unchanged. From January 1, 2027 those notice periods apply in full.

2. What Storm OS is (and is not)

Storm OS is relationship and pipeline management software for founders and small startup teams. It helps you track customers, investors, and partners in one place: records, pipelines, tasks, notes, and reporting.

Storm OS is a software tool. It is not a broker-dealer, investment adviser, placement agent, law firm, accounting firm, or fundraising intermediary, and nothing in the Service is legal, tax, accounting, investment, or fundraising advice. Nothing in the Service constitutes an offer or solicitation to buy or sell securities. You are solely responsible for your fundraising, sales, and partnership activities and for complying with the laws that govern them.

3. Definitions

4. Accounts, eligibility, and sign-in

4.1 Eligibility. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account. The Service is intended for business use and is not directed to children.

4.2 Account security. You are responsible for safeguarding credentials and for all activity under your account. Enable multi-factor authentication where offered. Notify us promptly at security@storm-os.com if you suspect unauthorized access.

4.3 Sign-in with Google. You may sign in using a Google Account. If you do:

• Your use of those identity providers remains governed by their own terms and privacy policies. We are not responsible for their services.
• We use only the minimum identity information needed to authenticate you and create your profile: your unique Google identifier, your email address and whether Google has verified it, and your name. Google's sign-in response can also carry your profile picture, which we do not read or keep. We do not request access to your Gmail, calendar, files, or contacts as part of sign-in.
• If we later offer features that require additional permissions, we will ask you to authorize those permissions separately, describe what they do at the point of consent, and let you decline without losing access to sign-in.
• You may disconnect Storm OS at any time from your Google Account permissions page. Disconnecting removes our ability to authenticate you via Google; it does not by itself delete your Workspace or Customer Data (see §14).
• If we add further sign-in providers, we will update these Terms and the Privacy Policy before that option becomes available to you.

4.4 Invitations and membership. Workspace Admins may invite, deactivate, and change the roles of Authorized Users. If you join a Workspace created by someone else, you understand that the Workspace's owner controls that Workspace, including its data, permissions, and continued existence, and may remove your access at any time.

5. Your data, your ownership

5.1 Ownership. As between you and Storm OS, you own all Customer Data. We claim no ownership rights in it.

5.2 Limited license to us. You grant us a worldwide, non-exclusive, royalty-free license to host, store, transmit, copy, index, display, back up, and otherwise process Customer Data solely to: (a) provide, secure, and maintain the Service for you; (b) prevent or address technical problems, abuse, or security incidents; and (c) comply with law. This license ends when the Customer Data is deleted, except for backups pending expiry.

5.3 What we will not do. We will not sell, rent, or license Customer Data. We will not use Customer Data to serve advertising. We will not use Customer Data to train machine-learning or generative AI models, whether our own or a third party's.

5.4 Who can access Customer Data. Access is limited to: (a) Authorized Users of the Workspace, as governed by that Workspace's permission and sharing settings; (b) Integrations that you or a Workspace Admin explicitly connect; (c) our subprocessors, which receive data to provide their services to us and are listed, with what each one receives, at storm-os.app/subprocessors; and (d) a small number of Storm OS personnel under the narrow, audited circumstances described in our Privacy Policy (support you request, and investigation of security or availability incidents). We do not browse Workspaces.

5.5 Your responsibility for the data you upload. Storm OS is a relationship tool, which means you will store information about third parties such as prospects, investors, partners, and their staff. You represent that you have a lawful basis to collect and process that information, that you will honor applicable notice and rights obligations toward those individuals, and that you will not upload information you are not permitted to hold. For personal data subject to the GDPR, UK GDPR, or similar laws, you are the controller and we act as your processor (see §6).

5.6 Sensitive data. Do not upload government identification numbers, payment card numbers, health records, precise biometric data, or information subject to sector-specific regimes such as HIPAA, PCI-DSS, GLBA, FERPA, or ITAR/EAR-controlled technical data. The Service is not designed for those categories and we disclaim liability arising from them.

6. Data protection roles

For Customer Data, you are the controller (or business) and we are the processor (or service provider). Our DATA PROCESSING ADDENDUM ("DPA") governs that processing, including subprocessors, security measures, international transfer mechanisms, breach notification, and assistance with data-subject requests. The DPA is incorporated into these Terms by reference and applies automatically where required by law. For Account Data and for our own operational and security telemetry, we act as a controller; see the Privacy Policy.

7. Acceptable use

You will not, and will not permit anyone to:

1. Use the Service in violation of any law, including data protection, anti-spam (CAN-SPAM, CASL, PECR, GDPR Art. 6/21), securities, sanctions, or export control laws.
2. Upload or transmit malware, or attempt to gain unauthorized access to the Service, other Workspaces, or any system or data you are not permitted to access.
3. Probe, scan, or load-test the Service, or conduct penetration testing, without our prior written permission (request at security@storm-os.com).
4. Reverse engineer, decompile, or attempt to derive source code, except to the extent that restriction is unenforceable by law.
5. Resell, sublicense, or provide the Service as a service bureau to third parties, or build a competing product using our confidential information.
6. Scrape or use automated means to extract data from the Service other than through our documented API and within published rate limits.
7. Circumvent usage limits, rate limits, or access controls.
8. Upload content that is unlawful, infringing, defamatory, harassing, or that you lack the right to store.
9. Use the Service to send unsolicited bulk communications, or to build or enrich contact lists in ways that violate applicable law.
10. Misrepresent your identity or affiliation, including in Workspace invitations.

We may suspend access without notice if we reasonably believe conduct threatens the security, integrity, or availability of the Service or another customer's data. We will restore access promptly once the risk is resolved.

7.1 Marketing sending. Storm OS sends a Workspace's marketing email from that Workspace's own sending domain once the domain is verified, and a Workspace that connects MailChimp sends through its MailChimp account instead. If you use the Service to send marketing email to your own contacts, you warrant that you have valid consent, under CAN-SPAM, CASL, PECR, GDPR, and other applicable law, for every recipient on every list you use, and you will not use a purchased or scraped list. We may pause a send in progress or block a Workspace from sending if it crosses our deliverability thresholds for bounce or spam-complaint rates, and will restore it once the underlying list is fixed. Campaign email a Workspace sends carries no line naming Storm OS. Email that Storm OS sends from its own address on a Workspace's behalf, such as proposals, invoices, Room invitations and form replies, says that it was sent via Storm OS.

8. Progressive Web App and offline use

Storm OS is installable as a Progressive Web App and caches a working subset of your Workspace on your device so it works offline.

• Cached data is scoped to the signed-in user and Workspace and is cleared when you sign out.
• Your operating system or browser may evict cached data without warning. Cached data is not a backup.
• Changes made offline are queued locally and applied when connectivity returns. Where two people edited the same record, the app will surface a conflict for you to resolve. You are responsible for reviewing and resolving conflicts.
• Device-level security is your responsibility: use a device passcode, and use the in-app lock and remote sign-out features if a device is lost.

9. Integrations and third-party services

You may connect Integrations to a Workspace. MailChimp, your own Stripe account for invoice payments, and your own AI provider key are Integrations. When you connect one, you authorize us to exchange the data necessary for that Integration to function. Integrations are provided by third parties under their own terms; we do not control them, do not warrant them, and are not liable for their acts or omissions, including their handling of data you direct us to send them. Disconnecting an Integration stops future exchange but does not retrieve data already shared.

10. Beta and early-access features

We may label features "beta," "preview," or "early access." Those features are provided as-is, may change or be withdrawn without notice, may be less reliable, and are excluded from any service commitments. Do not rely on them for business-critical processes.

11. Fees, plans, and trials

Current plans and prices are published at https://storm-os.app/pricing. In summary:

• Storm Eye, the core relationship and pipeline module, is licensed per Workspace in a bundle that includes 5 users, at US$19 per month billed annually or US$24 per month billed monthly.
• Additional users beyond the included 5 are US$4 per user per month billed annually or US$5 per user per month billed monthly.
• Storm Project, Storm Marketing, and Storm Finance are optional modules licensed in blocks of 5 users at US$9 per block per month billed annually or US$12 per block per month billed monthly. Module blocks are allocated at the Workspace level and must cover every licensed Storm Eye user. A Workspace with 6 Storm Eye users therefore requires 2 blocks of any module it enables. Per-user module allocation is not offered.
• Early access accounts receive Storm Project, Storm Marketing, and Storm Finance at no charge for 12 months from the date the Workspace is created. At the end of that period those modules will be disabled unless you choose to license them. We will notify Workspace Admins by email at least 30 days before the promotional period ends, stating what will change and what it will cost. We will not begin charging you for a module you have not affirmatively chosen to license.
• AI credits. Each Workspace's plan includes a monthly allowance of AI credits, shown in the Service, that renews on the Workspace's billing date. AI-assisted features use credits when a member asks for them and they run on our accounts. Features that run on a Workspace's own AI provider key use none, except research's lookups with data providers, which always run on our accounts, and reading documents already filed, in the background, uses none. When a Workspace's credits are used up, those features pause until the allowance renews, and the rest of the Service keeps working.

All prices are in US dollars, which is currently the only supported billing currency.

AI-assisted features. While the Service is in early access we may introduce, adjust, meter, or withdraw AI allowances, and may change how AI usage is measured. Where a change would reduce an allowance included in a plan you are already paying for, we will give at least 30 days' notice by email to Workspace Admins, and you may terminate and export your data under §14.4 if you object. Some AI-assisted features may be offered as beta features under §10.

AI output can be inaccurate, incomplete, or unsuitable for your situation. You are responsible for reviewing it before acting on it, and §2 applies to anything it produces. Our commitment in §5.3 applies in full to these features: we will not use Customer Data to train machine-learning or generative AI models.

The AI-assisted features are on unless a Workspace Admin turns them off, during setup or at any time. When they run on our account, the content they work with is sent to Anthropic, PBC, under Anthropic's commercial terms, which do not permit Anthropic to train models on it, and Anthropic's data processing addendum. Anthropic states that it deletes API inputs and outputs within 30 days, except where it keeps them longer to enforce its usage policy (up to 2 years for content it flags) or to comply with the law. Where a Workspace routes a feature to its own AI provider key, that provider's terms with the Workspace apply to what runs on that key (§9). Research, unless a Workspace Admin turns it off, sends what it searches with to the data providers listed at storm-os.app/subprocessors. No field on a record is changed until a member accepts what research found, and a research run on a company also files the further company details the providers return, such as funding, technology and headcount, on that company's record.

Where fees apply: fees are stated in the applicable plan or order, are payable in advance, are billed to the payment method on file through our payment processor, are non-refundable except where required by law, and exclude taxes, which you are responsible for. We may change pricing on 30 days' notice effective at your next renewal. Non-payment may result in suspension after notice and a reasonable cure period. If we offer a free tier or trial, we may change or discontinue it at any time on reasonable notice.

12. Intellectual property; feedback

We and our licensors own the Service and all software, design, documentation, trademarks, and content within it, excluding Customer Data. We grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription, for your internal business purposes, subject to these Terms.

If you send us feedback, ideas, or suggestions, you grant us a perpetual, irrevocable, royalty-free license to use them without obligation to you. We will not identify you as the source without your permission.

13. Confidentiality

Each party may receive the other's non-public information. The receiving party will protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisors who need it and are bound by confidentiality. This does not apply to information that is public through no fault of the receiver, independently developed, or lawfully received from a third party. Compelled disclosure is permitted with prompt notice where legally allowed. Customer Data is your Confidential Information.

14. Term, termination, export, and deletion

14.1 Term. These Terms apply from your first use until terminated.

14.2 Termination by you. You may stop using the Service and delete your Workspace at any time from the Workspace Admin console.

14.3 Termination by us. We may terminate or suspend for material breach that remains uncured 10 days after notice, for non-payment, for conduct posing legal or security risk, or if we discontinue the Service (with at least 60 days' notice, and a pro-rata refund of prepaid unused fees).

14.4 Export window. For 30 days after termination, you may export your Customer Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships. Data portability is included in every plan.

14.5 Deletion. After the export window, we will delete Customer Data from active systems within 30 days and from backups within our normal backup expiry cycle (currently 35 days), except where retention is required by law. Deletion of individual records inside the Service follows the in-product lifecycle: soft delete, Recycle Bin restore for 30 days, then purge.

14.6 Survival. Sections 5.1, 12, 13, 15, 16, 17, 18, and 20 survive termination.

15. Disclaimers

Except as expressly stated in these Terms and to the fullest extent permitted by law, the Service is provided "as is" and "as available." We disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, error-free, or that it will meet your requirements, and we do not warrant results obtained from the Service, including scores, forecasts, or reports, which are indicative only. Some jurisdictions do not allow certain disclaimers; those disclaimers apply only to the extent permitted.

16. Limitation of liability

To the fullest extent permitted by law:

• Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid or owed to us in the 12 months before the event giving rise to the claim, or (b) US$100.
• These limits do not apply to: your breach of §7 (Acceptable Use), either party's indemnity obligations, your payment obligations, or liability that cannot be limited by law (including, in some jurisdictions, gross negligence, willful misconduct, death, or personal injury).

Nothing in these Terms limits rights that consumers or others have under mandatory local law.

17. Indemnification

17.1 By you. You will defend and indemnify us against third-party claims arising from Customer Data, your use of the Service in breach of these Terms or applicable law, or your infringement of a third party's rights.

17.2 By us. We will defend and indemnify you against third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a US patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Our obligation does not apply to claims arising from Customer Data, combination with items not supplied by us, or use of beta features. We may procure the right to continue, modify the Service, or terminate and refund prepaid unused fees.

17.3 Process. The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and provide reasonable cooperation.

18. Governing law and disputes

These Terms are governed by the laws of the Commonwealth of Pennsylvania, USA, without regard to conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Before filing a claim, the parties will attempt in good faith to resolve the dispute by notice to legal@storm-os.com and 30 days of discussion. Any unresolved dispute will be brought exclusively in the state or federal courts located in Allegheny County, Pennsylvania, and both parties consent to that jurisdiction and venue. Either party may seek injunctive relief in any court to protect intellectual property or confidential information.

If you are a consumer in the EU, UK, or another jurisdiction with mandatory local protections, nothing here deprives you of the right to bring proceedings in your home courts under local law.

19. Export controls and sanctions

You represent that you are not located in, ordinarily resident in, or organized under the laws of a country or region subject to comprehensive US sanctions, and that you are not on any US, UK, or EU restricted-party list. You will not use or export the Service in violation of US export control or sanctions laws.

20. General

20.1 Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email to Workspace Admins and by an in-app notice, and the change takes effect at the end of that period. Continued use after the effective date means acceptance. If you object, you may terminate and export your data under §14.4.

During the Early Access Period defined in §1, the 30 day period above does not apply. We will still tell Workspace Admins by email what changed, as soon as we reasonably can, and the change takes effect on the date the notice gives. Your right to object, to terminate and to export your data under §14.4 is unchanged. From January 1, 2027 the 30 day period applies in full.

20.2 Changes to the Service. We improve the Service continuously. We will not materially reduce core functionality without reasonable notice.

20.3 Assignment. You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets with notice to us. We may assign to an affiliate or successor.

20.4 Entire agreement. These Terms, the Privacy Policy, and the DPA are the entire agreement and supersede prior discussions. Terms on a purchase order or vendor portal have no effect.

20.5 Severability and waiver. If a provision is unenforceable, the rest remains in effect. A failure to enforce is not a waiver.

20.6 Force majeure. Neither party is liable for delays caused by events beyond reasonable control, excluding payment obligations.

20.7 Independent contractors. No agency, partnership, joint venture, or employment relationship is created.

20.8 Publicity. We will not use your name or logo publicly without your prior written consent.

21. Contact

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
General: hello@storm-os.com · Legal: legal@storm-os.com · Security: security@storm-os.com · Privacy: privacy@storm-os.com

Effective date: October 19, 2026
Last updated: October 19, 2026
Version: 1.3

The short version

• Your Workspace data is yours. We hold it only to run the product for you.
• We do not sell or share your data, we do not serve ads, and we do not use your data to train AI models.
• We ask for the minimum from Google: sign-in identity only. We do not read your mailbox, calendar, files, or contacts.
• The assistant and research are on unless a Workspace Admin turns them off, during setup or at any time. While they are on, the content they work with goes to the providers listed in §8.
• We do not browse your Workspace. Storm OS personnel access Workspace content only when you ask us to for support, or when we must to fix a security or availability incident. Every such session is logged, time-limited, and visible to your Workspace Admins.
• You can export everything and delete everything, at any time.

The rest of this policy is the detail behind those statements.

1. Who we are and what this covers

On-Call CMO, doing business as Storm OS ("Storm OS," "we," "us"), 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA, operates the Storm OS marketing site and the Storm OS application, both at storm-os.app. The application is an installable Progressive Web App for managing customer, investor, and partner relationships.

This policy explains what personal data we handle, why, and what rights you have. It applies to visitors to our site, people who create or join a Workspace, and individuals whose information appears inside a customer's Workspace.

Two different roles. This distinction determines who you should contact about your data:

If your details appear in someone's Storm OS Workspace and you want them corrected or removed, contact that organization directly. If you contact us instead, we will forward your request to the relevant customer and, where the law requires, assist them in responding. See §12.

2. What we collect

2.1 Data you give us

2.2 Data we collect automatically

We do not use advertising cookies or cross-site tracking pixels. Google Analytics sets its cookies only on the pages and screens where it runs, listed above, and we configure it not to use Google signals or ad personalization. Everywhere else, the application sets only strictly necessary cookies: the httpOnly, Secure, SameSite=Lax cookies that sign you in and keep you signed in, a cookie that records only that you are signed in, so our site can take you straight to the application, and the fraud-prevention cookies of our payment processor, Stripe, whose payment form the application loads during onboarding and on the billing screen. Because they are strictly necessary, no consent is required for them.

Marketing email a Workspace sends to its own contacts is a different case. When a Workspace turns tracking on for a send, that message carries an open pixel and links rewritten through go.storm-os.app, or through a hostname on that Workspace's own domain, beside its sending domain, once the Workspace has published the record for one, to record opens and clicks for that Workspace's own reporting. The unsubscribe address in the message header always stays on go.storm-os.app, so unsubscribing keeps working even if the Workspace's own hostname stops. Tracking is the Workspace's choice, set per campaign and per sending domain, and it never applies to the application itself.

2.3 Data from third parties

• Identity provider (Google): see §3.
• Payment processor: subscription status and payment outcomes. Card numbers never reach our servers.
• Data you import: CSV/XLSX files you upload, and information from Integrations you connect. We do not buy or sell contact lists.
• Research, unless a Workspace turns it off: while the assistant and web research are on, a member who can edit a record can ask Storm OS to research that person or company, or a saved list of them. The run looks them up with the data providers listed in §8, which we pay for each lookup, and on the public web through Anthropic's web search, and shows what it found as suggestions, each with its source. No field on a record is changed until a member reviews and accepts a suggestion. A research run on a company also files the further company details the data providers return, such as funding, technology, headcount, industry codes, products and competitors, on that company's record. What Storm OS stores from a research run, including the providers' answers, is kept private to the Workspace that ran it, for the periods in §11. A request to erase a person from the research results a Workspace has saved for reuse is carried out for each Workspace separately, and everything else research keeps follows the periods in §11.

3. Signing in with Google

Storm OS offers "Sign in with Google" so you don't need another password. This section is the full disclosure of what that involves. Google is currently our only third-party sign-in provider. If we add another, we will update this policy before that option becomes available to you.

3.1 What we request

We request identity scopes only:

We neither request nor can access your Gmail mailbox, your Google Calendar, your Drive files, or your Google Contacts. No message content, no attachments, no meeting data.

3.2 What we do with it

We use this information solely to: authenticate you; create or match your Storm OS account; populate your display name; and send you transactional email at the address on file. We store the provider's unique identifier, your email address, and your name as your display name. We do not take your avatar from Google. We do not store tokens beyond what is needed to complete sign-in, and we do not use provider data for advertising, profiling, or model training.

3.3 Google API Services User Data Policy and Limited Use

Storm OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Storm OS interface;
• Do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit prior consent;
• Do not use Google user data for serving advertisements of any kind, including retargeting, personalized, or interest-based advertising;
• Do not sell Google user data; and
• Do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.

3.4 If we ever need more

Automatic email capture is on our roadmap. If we build it, mailbox access will be a separate, optional, clearly explained authorization that you can decline while continuing to use sign-in normally. Adding those permissions would require a new consent prompt from Google, so access cannot expand silently. We will update this policy and notify Workspace Admins before any such feature launches.

3.5 Revoking access

You can disconnect Storm OS at any time:

• Google: myaccount.google.com/permissions

Revoking stops us from authenticating you through Google. It does not delete your Workspace; to delete data, see §11.

4. Why we use your data, and our legal bases

5. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding 12 months.
• We do not serve advertising in Storm OS, and we do not let anyone pay to influence what you see.
• We do not use Customer Data to train, fine-tune, or evaluate machine-learning or generative AI models, ours or anyone else's.
• We do not disclose Customer Data to third parties except as described in §7.

6. Who can access Workspace data

This is the part most people actually want answered, so here it is plainly.

Access is limited to:

1. Authorized Users of your Workspace. What each one sees is governed by your Workspace's org-wide defaults, ownership, admin sharing rules, and individual record shares. Every record has an access explainer showing who can see it and why. Workspace Admins have full access to Workspace content by design, and their actions are audited.
2. Integrations you connect. Only the data required for that integration, only after a Workspace Admin authorizes it, and only for as long as it stays connected.
3. Our subprocessors (§8). Each receives data to provide its service to us, as §8 describes. Stripe also acts as an independent controller for purposes its own terms list, such as fraud prevention and legal compliance.
4. Storm OS personnel, narrowly and on the record. We do not browse Workspaces and we have no general-purpose window into your data. Our staff may access Workspace content only in these situations:

• You ask us to. Support may start a time-limited session acting as your user to reproduce a problem. Every session requires a stated reason, is capped at 60 minutes, displays a persistent banner in the app, is recorded in our platform audit log, and appears in your own Workspace audit log so your admins can see exactly who accessed what, when, and why.
• Security or availability incidents. Where we must investigate abuse, a breach, data corruption, or a serious outage, access is limited to what the investigation requires, is role-restricted, and is audited the same way.
• Legal compulsion. See §7.

Support sessions cannot change your password or email address, and cannot export your data, unless the operator holds an explicitly elevated support permission. Routine engineering does not use production Workspace data; development and testing run against synthetic seed data.

These limits are enforced technically as well as contractually: every row in our database carries a workspace identifier, Postgres row-level security is applied as defense in depth, access is resolved server-side by a single authorization module on every read and write, and audit writes are append-only.

7. When we disclose data

We disclose personal data only:

• To subprocessors who help us run the Service (§8).
• To Google, for site analytics: Google Analytics receives what §2.2 describes.
• At your direction: to Integrations you connect, or to recipients you share with.
• For legal reasons: to comply with a valid legal process, or to protect the rights, safety, or property of Storm OS, our customers, or the public. Where we are legally permitted, we will notify the affected customer before disclosing Customer Data so they can seek protective relief. We will push back on requests that are overbroad or defective.
• In a business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, data may transfer to the successor, which will remain bound by this policy or give notice before any material change. Google user data would transfer only with the affected user's explicit prior consent (§3.3).

8. Subprocessors

We use a small number of vendors to operate the Service. Current subprocessors:

Used for every Workspace

Used only while a Workspace has a feature on

The assistant and web research are on unless a Workspace Admin turns them off. Nothing is sent to these subprocessors while the assistant is off, and the three data providers are used only while web research is also on and a member runs research on a record or a saved list.

Anthropic publishes its own subprocessors, including any provider behind its web search, at anthropic.com/subprocessors.

Google also provides the site analytics described in §2.2. That covers visits to our own site, sign-up and onboarding, never Customer Data, so Google Analytics is not on this list.

Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations the Workspace controls. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it, and none of them is our subprocessor. With a Workspace's own Anthropic key, two things still run on our accounts: the background reading of documents already filed on people, companies and deals, and a research run's calls to the data providers above.

We maintain the current list at storm-os.app/subprocessors and will give Workspace Admins at least 30 days' notice before adding a new subprocessor that processes Customer Data, with an opportunity to object.

During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), that 30 day period does not apply, because the third party services we run on are still being selected and configured. We will tell Workspace Admins by email as soon as we reasonably can and update the subprocessors page, and the opportunity to object is unchanged. From January 1, 2027 the 30 day period applies in full.

9. International transfers

Storm OS is operated from the United States. Customer Data is hosted in the United States and Germany. While a Workspace has the assistant or research on, what is sent to the providers in §8 is processed in the locations listed there. Wherever your Workspace is hosted, our personnel, support, and administrative systems are located in the United States, so operating the Service involves processing your data in the US and in other countries whose data protection laws may differ from your own.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), executed in our Data Processing Addendum, as our primary transfer mechanism;
• supplementary technical and organizational measures, including encryption in transit and at rest, tenant isolation, least-privilege access, and a policy of challenging overbroad government requests; and
• where a subprocessor holds a valid certification, the EU-US Data Privacy Framework and its UK Extension and Swiss-US Framework, as an additional basis.

The Standard Contractual Clauses do not extend to a research data provider that offers no separate data protection terms (§8, DPA §7.4).

A copy of the relevant transfer mechanism is available on request at privacy@storm-os.com.

Storm OS is not currently self-certified under the EU-US Data Privacy Framework. Standard Contractual Clauses are our own transfer mechanism; the Framework is relevant only where a subprocessor is separately certified.

10. Security

We design for hard tenant isolation and least privilege. Our current measures include:

• In transit: TLS 1.2+ everywhere; HSTS.
• At rest: encryption at the storage layer for the database and blob storage.
• Credentials: passwords hashed with Argon2id with a strength requirement; passwords are never stored or logged in readable form.
• Sessions: short-lived access tokens plus rotating refresh tokens in httpOnly, Secure, SameSite=Lax cookies that are never readable by JavaScript; token-reuse detection invalidates the whole session family; per-device sign-out and "sign out everywhere."
• Multi-factor authentication: optional TOTP per user; Workspace Admins can require it for everyone.
• Tenant isolation: every row is workspace-scoped, Postgres row-level security applied as defense in depth, cross-tenant access tested in CI as a failing-closed test.
• Authorization: a single server-side module resolves access on every read and write, including search, reports, and offline sync, so clients never receive rows they aren't entitled to.
• Files: attachments and exports are stored privately and served only through short-lived signed URLs; nothing is publicly addressable.
• On your device: offline data is scoped to user and Workspace and wiped on sign-out; an optional app lock re-authenticates after inactivity; revoking a session remotely takes effect on the device's next connection.
• Operations: brute-force and rate limiting, append-only audit logging, error and performance monitoring, automated dependency vulnerability scanning, an automated test suite that gates every deployment and includes denied-path authorization tests on every endpoint, and least-privilege access for personnel bound by written confidentiality obligations. We have not yet commissioned an independent third-party penetration test. When we do, we will say so here and make the summary available to customers on request.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected Workspace Admins without undue delay and in any event within 48 hours of becoming aware, matching our contractual commitment in DPA §9, and will notify regulators and individuals where required by law. Report suspected vulnerabilities to security@storm-os.com.

11. How long we keep data

12. Your rights

If you are an Authorized User or account holder, you can view and update most of your data directly in the app: profile and preferences, active sessions and devices, notification settings, and Workspace export. For anything else, contact privacy@storm-os.com.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; obtain a portable copy; restrict or object to processing (including profiling); withdraw consent; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we do not collect it for the purposes the law targets); and appeal a refused request. We will not discriminate against you for exercising these rights.

To exercise a right, email privacy@storm-os.com. We will verify your identity by confirming control of the email address on the account, or by other proportionate means. We respond within 30 days (extendable by a further 60 where the law allows, with notice). You may use an authorized agent where the law provides for one.

If your information is in a customer's Workspace, that customer is the controller. Send your request to them. If you send it to us, we will route it to them within 10 business days and support them in responding; we will not unilaterally alter or delete their records.

Complaints. You may lodge a complaint with your local supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve it first.

EU/UK representative. Storm OS markets and sells the Service in the United States. Prices are quoted only in US dollars and the Service is offered only in English, so we do not consider ourselves to be offering goods or services to individuals in the EU or UK within the meaning of GDPR Article 3(2), and we have not appointed an Article 27 representative. If we begin actively marketing to the EU or UK, we will appoint one and update this policy before doing so.

13. Children

Storm OS is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@storm-os.com and we will delete it.

14. Automated decision-making

Storm OS computes two relationship scores: a Fit Score from criteria your Workspace Admin configures, and an Activity Score based on recency and type of interactions. Both are decision support. Each is shown with a full breakdown of how it was calculated, and can be manually overridden by your users. They are not used by us to make automated decisions producing legal or similarly significant effects about any individual.

15. Changes to this policy

We will update this policy as the product changes. For material changes we will notify Workspace Admins by email and post an in-app notice at least 30 days before the change takes effect, and update the "Last updated" date above. During the Early Access Period defined in the Terms of Service, the 30 day period does not apply, as Terms of Service §1 describes. Where the change requires consent, we will ask for it. We keep prior versions of this policy, the Terms of Service and the Data Processing Addendum at storm-os.app/privacy/archive.

16. Contact us

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA

Privacy: privacy@storm-os.com · Security: security@storm-os.com · Storm OS has not appointed a Data Protection Officer, as it is not required to do so under GDPR Article 37. Privacy inquiries are handled at the address above.

Effective date: October 19, 2026
Last updated: October 19, 2026
Version: 1.3

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the Storm OS Terms of Service at https://storm-os.app/terms (the "Agreement") between:

Processor / Service Provider: On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS, of 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA ("Storm OS," "we," "us"); and

Controller / Business: the customer that has accepted the Agreement ("Customer," "you").

This DPA applies where Storm OS processes Personal Data on Customer's behalf in providing the Service, and it applies automatically, with no signature required, from the date Customer accepts the Agreement. Customer may also request a countersigned copy at legal@storm-os.com.

This DPA does not apply to Account Data, security telemetry, or diagnostic data for which Storm OS acts as a controller in its own right. That processing is governed by the Privacy Policy.

2. Definitions

3. Roles of the parties

3.1 Customer is the Controller (and Business) of Customer Personal Data. Storm OS is the Processor (and Service Provider) and processes Customer Personal Data only on Customer's documented instructions.

3.2 Customer determines what Personal Data it puts into the Service, why, and who may access it. Customer is responsible for having a lawful basis for that processing, for providing any required notices to Data Subjects, and for the accuracy and legality of Customer Personal Data. This matters more than usual for a relationship management product: Customer Personal Data will typically include information about prospects, investors, partners, and their staff who have not interacted with Storm OS directly.

3.3 Where Customer is itself a processor for another controller, Customer warrants that it has authority to appoint Storm OS as a subprocessor on the terms of this DPA, and references to Customer's instructions include instructions from that controller as passed through by Customer.

3.4 For any processing outside the scope of §1, each party acts as an independent controller.

3.5 Marketing sending. Where Customer uses the Service to send marketing email to its own contacts, Customer is the Controller of the recipient list it sends to, and warrants that it holds valid consent, under applicable law, for every recipient on that list. Storm OS processes the recipient list, the message content, and the resulting engagement events as Processor, on Customer's instructions, under this DPA, once Customer's sending domain is verified.

3.6 The assistant and research. The assistant and web research are on unless a Workspace Admin turns them off, during setup or at any time. Leaving either on, which is part of Customer's configuration of the Service, and an Authorized User then asking for a summary, a document reading or a research run, or filing a document, are Customer's instructions under §4.2 to process the Customer Personal Data involved with the Subprocessors that Annex III lists for that feature, on the terms §7 describes for each of them. A research run looks a person or company up with third-party data providers and on the public web. No field on a record is changed until an Authorized User accepts what the run found, and a research run on a company also files the further company details the data providers return, such as funding, technology, headcount, industry codes, products and competitors, on that company's record. What Storm OS stores from a research run, including the data providers' answers, is kept within Customer's Workspace, and Storm OS never shows it to another customer.

4. Instructions

4.1 Storm OS will process Customer Personal Data only:
(a) as necessary to provide, secure, and maintain the Service under the Agreement;
(b) in accordance with Customer's further documented instructions, where those instructions are consistent with the Agreement and technically feasible; and
(c) as required by applicable law, in which case Storm OS will inform Customer of that requirement before processing unless the law prohibits it on important grounds of public interest.

4.2 The Agreement, this DPA, Customer's configuration of the Service, and Customer's use of Service features constitute Customer's complete documented instructions.

4.3 Storm OS will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until it is amended or confirmed. Storm OS may decline instructions that would require material changes to the Service or that it reasonably believes to be unlawful.

4.4 Prohibited uses. Storm OS will not:
(a) Sell or Share Customer Personal Data, as those terms are defined in the CCPA;
(b) retain, use, or disclose Customer Personal Data for any purpose other than performing the Service, including any commercial purpose of its own, except as permitted by Data Protection Laws;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Storm OS and Customer;
(d) combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interactions with a Consumer, except as permitted for a Service Provider under the CCPA; or
(e) use Customer Personal Data to train, fine-tune, benchmark, or evaluate machine-learning or generative artificial intelligence models, whether Storm OS's own or a third party's.

4.5 Storm OS certifies that it understands the restrictions in §4.4 and will comply with them.

4.6 Aggregated and deidentified data. Storm OS may create and use aggregated or deidentified data derived from operating the Service (for example, volumetric and performance statistics) for capacity planning, security, and product improvement, provided such data cannot reasonably be used to identify any Data Subject or Customer, Storm OS commits to maintaining it in deidentified form, does not attempt to reidentify it, and contractually obligates any recipient to the same.

5. Confidentiality and personnel

5.1 Storm OS will treat Customer Personal Data as Customer's Confidential Information under the Agreement.

5.2 Storm OS will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations that survive termination of employment, are trained on their data protection responsibilities, and are granted access only on a least-privilege, need-to-know basis.

5.3 Personnel access to Workspace content. Storm OS does not routinely access Customer Personal Data. Personnel may access it only:
(a) at Customer's request, to provide support, via a support session that requires a stated reason, is capped at 60 minutes, displays a persistent in-app banner to the acting user, is recorded in Storm OS's platform audit log, and is written to Customer's own Workspace audit log so Customer's administrators can see who accessed what, when, and why;
(b) as strictly necessary to investigate or remediate a security incident, data corruption, abuse, or a serious availability failure, limited to what the investigation requires and audited on the same terms; or
(c) where compelled by law, subject to §10.6.

Support sessions cannot change a user's password or email address, and cannot export Customer Data, unless the acting operator holds an explicitly elevated support permission. Development and testing are performed against synthetic seed data.

6. Security

6.1 Storm OS will implement and maintain the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

6.2 Storm OS may update those measures over time provided the overall level of protection is not materially reduced.

6.3 Customer is responsible for the security decisions within its control: configuring Workspace access defaults, sharing rules and roles; enabling and enforcing multi-factor authentication; managing membership and promptly deactivating departed users; and securing the devices on which the Progressive Web App is installed.

7. Subprocessors

7.1 General authorization. Customer grants Storm OS general authorization to engage Subprocessors, subject to this §7. The Subprocessors engaged as at the effective date are listed in Annex III and maintained at https://storm-os.app/subprocessors.

7.2 Notice and objection. Storm OS will give Customer at least 30 days' notice before adding or replacing a Subprocessor that processes Customer Personal Data, by email to Workspace Admins and by updating the subprocessors page. Customer may object on reasonable data protection grounds within that period by written notice to privacy@storm-os.com. The parties will discuss the objection in good faith; if Storm OS cannot offer a reasonable alternative, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid unused fees.

7.2.1 Early Access Period. During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), the 30 days' notice in §7.2 does not apply, because the third party services Storm OS runs on are still being selected and configured. Storm OS will notify Customer by email as soon as reasonably practicable and update the subprocessors page. Customer's right to object under §7.2, and to terminate without penalty if Storm OS cannot offer a reasonable alternative, is unchanged. From January 1, 2027 the 30 days' notice applies in full.

7.3 Flow-down and liability. Storm OS will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each Subprocessor's performance. A research data provider that offers no separate data protection terms processes lookups under its published terms instead, as its row in Annex III states.

7.4 Where a Subprocessor is located outside the EEA, UK, or Switzerland, Storm OS will ensure an appropriate transfer mechanism is in place under §10, except with a research data provider that offers no separate data protection terms (§7.3).

8. Data subject rights and assistance

8.1 Self-service first. The Service gives Customer the tools to respond to most Data Subject requests directly: search, record edit and delete, soft delete with a 30-day Recycle Bin, merge, and full Workspace export in CSV/JSON. Customer will use those tools where they are sufficient.

8.2 Assistance. Taking into account the nature of the processing, Storm OS will provide reasonable assistance, by appropriate technical and organizational measures and insofar as possible, to help Customer fulfill its obligations to respond to requests for access, rectification, erasure, restriction, portability, and objection.

8.3 Requests received by Storm OS. If Storm OS receives a request from a Data Subject relating to Customer Personal Data, it will not respond substantively other than to acknowledge and redirect, and will notify Customer without undue delay (and in any event within 10 business days) so Customer can respond as Controller. Storm OS will not alter or delete Customer's records in response to such a request without Customer's instruction.

8.4 Further assistance. Storm OS will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities under GDPR Articles 35 and 36, and with Customer's obligations under Articles 32 to 36 generally, taking into account the information available to Storm OS.

8.5 Assistance beyond what is reasonably required by Data Protection Laws, or that is disproportionate in scope or frequency, may be chargeable at Storm OS's then-current professional services rates, on prior notice.

9. Personal Data Breach

9.1 Storm OS will notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it, by email to Workspace Admins and the security contact on file.

9.2 The notification will include, to the extent known and as it becomes known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point for further information. Where information is not available at the time of notification, Storm OS will provide it in phases without further undue delay.

9.3 Storm OS will take reasonable steps to contain, investigate, and remediate the breach, and will preserve relevant logs and evidence.

9.4 Storm OS's notification is not an acknowledgment of fault or liability. Customer is responsible for determining whether the breach requires notification to Supervisory Authorities or Data Subjects and for making those notifications. Storm OS will not notify any Supervisory Authority or Data Subject on Customer's behalf without Customer's prior consent, except where independently required to do so by law.

9.5 Customer will keep an accurate security contact email current in the Workspace Admin console.

10. International transfers

10.1 Customer acknowledges that Storm OS is established in the United States and that provision of the Service involves transfer of Customer Personal Data to the United States and, where applicable, to Subprocessor locations identified in Annex III.

10.2 EEA transfers. Where Customer Personal Data is transferred from the EEA to a country that is not the subject of an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller;
• Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party controller;
• Clause 7 (docking clause) applies;
• Clause 9, Option 2 (general written authorization) applies, with the notice period specified in §7.2 of this DPA;
• Clause 11(a) optional language (independent dispute resolution) does not apply;
• Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• Clause 18(b): disputes will be resolved before the courts of Ireland;
• Annex I to the SCCs is populated by Annexes I(A), I(B), and I(C) of this DPA;
• Annex II to the SCCs is populated by Annex II of this DPA;
• Annex III to the SCCs (where used) is populated by Annex III of this DPA.

10.3 UK transfers. The UK Addendum is incorporated and applies to transfers from the UK, completed as set out in Annex IV.

10.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" does not limit Data Subjects in Switzerland from bringing proceedings in their place of habitual residence; and the SCCs also protect the data of legal entities until the FADP no longer extends to them.

10.5 Supplementary measures. In addition to the SCCs, Storm OS applies the measures in Annex II, including encryption in transit and at rest, tenant isolation enforced in the database layer, least-privilege and audited personnel access, and the government-request handling in §10.6, as supplementary measures supporting the transfer.

10.6 Government access requests. If Storm OS receives a legally binding request from a public authority for Customer Personal Data, it will: (a) review the request for lawfulness and challenge it where there are reasonable grounds to consider it unlawful, overbroad, or defective, seeking interim relief where appropriate; (b) disclose only the minimum data legally required; and (c) notify Customer of the request before disclosure where legally permitted, or, if prohibited, seek a waiver of the prohibition and provide such information as it is lawfully able, as promptly as possible. Storm OS will document such requests and provide the information required by Clause 15 of the SCCs.

10.7 Alternative mechanisms. If a transfer mechanism relied on here is invalidated, amended, or superseded, the parties will work in good faith to implement a valid alternative (including any successor clauses) without undue delay, and Storm OS may update this DPA accordingly on notice.

11. Audit and information rights

11.1 Storm OS will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. In the first instance this will be satisfied by: this DPA and its Annexes, the Privacy Policy, the subprocessors page, and a completed standard security questionnaire (Storm OS will use commercially reasonable efforts to complete Customer's own questionnaire once per twelve-month period).

11.2 Where the documentation in §11.1 is genuinely insufficient to demonstrate compliance, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality that does not compete with Storm OS, subject to: at least 30 days' prior written notice; no more than once per twelve-month period except following a Personal Data Breach affecting Customer or where required by a Supervisory Authority; conduct during normal business hours; a scope limited to Storm OS's processing of Customer Personal Data; and no access to other customers' data, to Storm OS's own confidential commercial information, or to production Personal Data of any kind.

11.3 Customer bears its own audit costs and will reimburse Storm OS's reasonable costs for audits beyond the first in any twelve-month period.

11.4 Where the SCCs apply, this §11 is the parties' agreed means of exercising the audit rights in Clause 8.9, without limiting those rights where they cannot be limited by law.

12. Return and deletion

12.1 On termination or expiry of the Agreement, Customer may export Customer Personal Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships, for 30 days, using the Workspace export in the Admin console.

12.2 After the export period, Storm OS will delete Customer Personal Data from active systems within 30 days, and it will age out of backups within Storm OS's rolling backup expiry cycle (currently 35 days). Storm OS will certify deletion in writing on request.

12.3 Storm OS may retain Customer Personal Data to the extent required by applicable law, and will continue to protect it under this DPA for as long as it is retained.

13. General

13.1 Order of precedence. In the event of conflict, the SCCs prevail over this DPA, and this DPA prevails over the rest of the Agreement, in each case only as to the subject matter of the conflict.

13.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws prohibit that limitation. Nothing in this §13.2 limits any Data Subject's rights under the SCCs.

13.3 Term. This DPA takes effect with the Agreement and continues until Storm OS ceases to process Customer Personal Data, at which point the obligations that by their nature should survive will do so.

13.4 Changes. Storm OS may update this DPA where required by changes in Data Protection Laws, changes to the Service, or the introduction of new transfer mechanisms, on at least 30 days' notice to Workspace Admins, provided no update materially reduces the protections afforded to Customer Personal Data. During the Early Access Period defined in the Terms of Service, that notice period does not apply, as Terms of Service §1 describes.

13.5 Governing law. Except where the SCCs, UK Addendum, or Data Protection Laws require otherwise, this DPA is governed by the law and venue specified in the Agreement.

13.6 Contact. Data protection matters: privacy@storm-os.com. Security matters and incident reports: security@storm-os.com. Contractual matters: legal@storm-os.com.

Annex I(A): Parties

Data exporter (Controller / Processor): the Customer identified in the Agreement.
Contact: the Workspace Admin email address and any privacy contact designated by Customer in the Workspace Admin console.
Activities relevant to the transfer: use of the Storm OS relationship and pipeline management service.
Role: Controller (or Processor where §3.3 applies).
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Data importer (Processor): On-Call CMO d/b/a Storm OS, 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA.
Contact: privacy@storm-os.com.
Activities relevant to the transfer: hosting and operating the Storm OS application, database, file storage, transactional and marketing email, and support, and AI-assisted features and record research unless Customer turns them off.
Role: Processor.
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Annex I(B): Description of processing

Categories of Data Subjects

• Customer's Authorized Users: founders, employees, contractors, advisors, and observers with Workspace access
• Customer's prospects, leads, and customers, and their employees and representatives
• Current and prospective investors, and the employees and representatives of funds and syndicates
• Partners, resellers, referrers, and their employees and representatives
• Any other individual whose details Customer chooses to record in its Workspace

Categories of Personal Data

• Identity and contact: name, job title, employer, email address, telephone number, postal or business address, social profile URLs, website and domain
• Account and authentication (Authorized Users): password hash, Google identity provider subject identifier, MFA enrollment status, session and device metadata, IP address at sign-in
• Relationship and workflow: relationship role and sub-type, engagement level, ownership, introductions and associations, pipeline and stage, opportunity value and line items, tasks, next steps, loss reasons, tags, relationship fit and activity scores
• Interaction records: notes, logged activities, meeting and call records entered by users, timeline events
• Content: attachments and documents uploaded by Authorized Users, which may contain Personal Data determined solely by Customer
• Custom fields: additional fields defined by Customer, the content of which is determined solely by Customer
• Audit: actor, timestamp, device summary, and before/after values for audited actions
• Marketing email engagement: open and click events, and the user agent and IP address at the event, for marketing email a Workspace sends to its own contacts
• Form and landing page submissions: the answers a person submits on a Workspace's public form or landing page, the page and step it was submitted on, the time, and, where the form collects them, the referring site and campaign (UTM) parameters
• Research results: unless Customer turns research off, the values a research run found about a person or company, the source of each, and the data providers' answers

Sensitive data. The Service is not designed for and Customer is contractually prohibited from submitting special category data under GDPR Article 9, data relating to criminal convictions and offenses under Article 10, government identifiers, payment card numbers, health records, precise biometric data, or precise geolocation. If Customer nonetheless submits such data through free-text fields, custom fields, or attachments, Customer does so as Controller and at its own risk, and the restrictions in the Agreement apply.

Frequency of transfer: continuous, for the duration of the Agreement.

Nature of the processing: collection, recording, organization, structuring, storage, retrieval, consultation, use, indexing, deduplication and merging, scoring, AI-assisted summarization, extraction and drafting, and research with third-party data providers and the public web unless Customer turns them off, synchronization to Authorized Users' devices for offline use, backup, disclosure to Authorized Users and authorized Integrations, marketing email composition, sending, and engagement tracking where a Workspace enables it, erasure, and destruction.

Purpose of the processing: providing the Storm OS relationship and pipeline management service to Customer under the Agreement, including hosting, synchronization, notification, reporting, support, security, marketing email sent by Customer to its own contacts where Customer enables it, and AI-assisted features and record research unless Customer turns them off.

Duration: for the term of the Agreement, plus the retention and deletion periods in §12 of this DPA.

Subprocessor processing: as described in Annex III, for the duration of the Agreement or until the Subprocessor is replaced.

Annex I(C): Competent Supervisory Authority

Where the data exporter is established in an EEA Member State, that Member State's Supervisory Authority.

Where the data exporter is not established in the EEA but falls within the territorial scope of the GDPR under Article 3(2) and has appointed a representative under Article 27, the Supervisory Authority of the Member State in which that representative is established.

Where the data exporter is not established in the EEA and has not appointed a representative, the Supervisory Authority of Ireland, consistent with the choice of law in §10.2. Storm OS has not appointed an Article 27 representative, on the basis that it markets the Service in the United States only, quotes prices solely in US dollars, and offers the Service solely in English. It will appoint one and update this Annex before actively marketing to the EU or UK.

Annex II: Technical and organizational measures

Storm OS maintains the following measures. Detail is current as at the effective date and may be updated under §6.2.

Pseudonymization and encryption

• TLS 1.2 or higher for all data in transit, with HSTS enforced on storm-os.app and its subdomains
• Encryption at rest at the storage layer for the Postgres database, blob storage, and backups
• Passwords hashed with Argon2id and a minimum strength requirement; passwords never stored or logged in recoverable form
• Attachments and export bundles stored privately and served only through short-lived signed URLs; no publicly addressable object storage

Confidentiality and access control

• Multi-tenant isolation: every tenant row carries a workspace identifier; Postgres row-level security is applied as defense in depth; cross-tenant access is covered by a fail-closed test in continuous integration
• A single server-side authorization module resolves access on every read and write, and the same module trims list, search, report, and offline-sync results, so clients never receive records they are not entitled to
• Capability roles (Admin, Manager, Member, Read-Only) combined with per-object access defaults, admin sharing rules, and per-record shares, all configurable by Customer
• Short-lived access tokens plus rotating refresh tokens stored in httpOnly, Secure, SameSite=Lax cookies, never readable by client-side script; refresh-token reuse detection invalidates the entire session family
• Optional TOTP multi-factor authentication per user; Workspace-wide MFA enforcement available to Customer administrators
• Per-device session listing with individual and global sign-out; deactivating a member immediately revokes sessions and API access
• Least-privilege personnel access; support access to Workspace content only under the reason-gated, time-capped, dual-audited process in §5.3
• Brute-force protection with per-account and per-IP throttling and progressive delays

Integrity

• Append-only audit logging of authentication, membership, role, permission and sharing changes, schema changes, merges, deletions, purges and restores, imports and undo, exports, branding changes, and support sessions, retained 400 days and exportable by Customer administrators
• Idempotency keys on unsafe endpoints and per-mutation identifiers on offline sync, preventing duplicate application of retried writes
• Field-level conflict detection with explicit user resolution for concurrent offline edits
• Soft deletion with a 30-day Recycle Bin; merges reversible for 7 days; imports undoable for 7 days, keeping any field edited since the import
• Schema-level input validation on every API payload

Availability and resilience

• Serverless architecture with automatic scaling and no single points of manual intervention
• Managed database with point-in-time recovery and automated backups
• Documented disaster recovery procedure with restore drills and recorded RTO/RPO targets
• Error monitoring, function error-rate dashboards, dead-letter queue with retry for background jobs

Testing and assurance

• Automated unit, integration, and end-to-end test suites gating every deployment, including negative authorization tests on every endpoint
• Dependency vulnerability scanning
• Automated unit, integration, and end-to-end test suites gating every deployment, including denied-path authorization tests on every endpoint, with severity-1 and severity-2 findings remediated before release. Storm OS has not yet commissioned an independent third-party penetration test; it will update this Annex and notify Customers when one is completed

Device and endpoint measures (Progressive Web App)

• Offline data scoped to the signed-in user and Workspace, and wiped on sign-out
• Authentication never stored in JavaScript-readable browser storage
• Optional app lock requiring re-authentication after inactivity
• Remote session revocation honored on the device's next connection
• Attachment binaries not stored offline

Organizational measures

• Written confidentiality obligations for all personnel with access
• Data protection and security awareness training
• Documented incident response procedure with defined notification timelines
• Subprocessor due diligence and contractual flow-down of these obligations, except as §7.3 describes
• Development and testing against synthetic seed data

Measures for transfers

• The government-request handling process in §10.6
• Storm OS does not currently publish a periodic transparency report. It will notify affected Customers of compelled disclosures directly, as set out in §10.6

Annex III: Subprocessors

Used for every Workspace

Used only while a Workspace has a feature on

The assistant and web research are on unless a Workspace Admin turns them off. Nothing is sent to these Subprocessors while the assistant is off, and the three data providers are used only while web research is also on and an Authorized User runs research on a record or a saved list.

Anthropic publishes its own subprocessors, including any provider behind its web search, at https://www.anthropic.com/subprocessors.

Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations under §9 of the Terms. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it and on the Workspace's instruction, and none of them is a Storm OS Subprocessor. With a Workspace's own Anthropic key, two things still run on Storm OS's accounts: the background reading of documents already filed on people, companies and deals, which uses Storm OS's Anthropic account, and a research run's calls to the data providers above.

The current list is maintained at https://storm-os.app/subprocessors.

Annex IV: UK International Data Transfer Addendum

Completed in accordance with the UK Addendum (version B1.0).

Table 1: Parties. As set out in Annex I(A). Start date: the date Customer accepted the Agreement.

Table 2: Selected SCCs, Modules and Selected Clauses. The SCCs as incorporated by §10.2 of this DPA, including the modules and optional clauses selected there, and Annexes I to III as populated by this DPA.

Table 3: Appendix Information.

• Annex 1A (List of Parties): Annex I(A) of this DPA
• Annex 1B (Description of Transfer): Annex I(B) of this DPA
• Annex II (Technical and organisational measures): Annex II of this DPA
• Annex III (List of Sub processors): Annex III of this DPA

Table 4: Ending the Addendum when the Approved Addendum Changes. Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.

Acceptance

This DPA is accepted by Customer on acceptance of the Agreement and requires no signature. A countersigned PDF is available on request at legal@storm-os.com.

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
privacy@storm-os.com · security@storm-os.com · legal@storm-os.com

Effective date: October 4, 2026
Last updated: October 3, 2026
Version: 1.2

1. Agreement to these Terms

These Terms of Service ("Terms") are a binding agreement between On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS ("Storm OS," "we," "us"), and the person or organization that creates a Workspace or uses the Service ("you," "Customer").

The "Service" means the Storm OS marketing site and the Storm OS application, both at storm-os.app (including the application's installable Progressive Web App), our APIs, and any related support and documentation.

By creating an account, accepting an invitation to a Workspace, installing the app, or otherwise using the Service, you agree to these Terms. If you do not agree, do not use the Service.

If you accept these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" means that entity.

The "Early Access Period" runs from August 1, 2026 through December 31, 2026. Storm OS is in early access during that time, and the third party services it runs on are still being selected, configured and tuned. Where these Terms, the Privacy Policy or the Data Processing Addendum promise a period of notice before a change takes effect, that period does not apply during the Early Access Period. We still tell you what changed and when, as soon as we reasonably can, and every right you have to object, to terminate or to export your data is unchanged. From January 1, 2027 those notice periods apply in full.

2. What Storm OS is (and is not)

Storm OS is relationship and pipeline management software for founders and small startup teams. It helps you track customers, investors, and partners in one place: records, pipelines, tasks, notes, and reporting.

Storm OS is a software tool. It is not a broker-dealer, investment adviser, placement agent, law firm, accounting firm, or fundraising intermediary, and nothing in the Service is legal, tax, accounting, investment, or fundraising advice. Nothing in the Service constitutes an offer or solicitation to buy or sell securities. You are solely responsible for your fundraising, sales, and partnership activities and for complying with the laws that govern them.

3. Definitions

4. Accounts, eligibility, and sign-in

4.1 Eligibility. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account. The Service is intended for business use and is not directed to children.

4.2 Account security. You are responsible for safeguarding credentials and for all activity under your account. Enable multi-factor authentication where offered. Notify us promptly at security@storm-os.com if you suspect unauthorized access.

4.3 Sign-in with Google. You may sign in using a Google Account. If you do:

• Your use of those identity providers remains governed by their own terms and privacy policies. We are not responsible for their services.
• We use only the minimum identity information needed to authenticate you and create your profile: your unique Google identifier, your email address and whether Google has verified it, and your name. Google's sign-in response can also carry your profile picture, which we do not read or keep. We do not request access to your Gmail, calendar, files, or contacts as part of sign-in.
• If we later offer features that require additional permissions, we will ask you to authorize those permissions separately, describe what they do at the point of consent, and let you decline without losing access to sign-in.
• You may disconnect Storm OS at any time from your Google Account permissions page. Disconnecting removes our ability to authenticate you via Google; it does not by itself delete your Workspace or Customer Data (see §14).
• If we add further sign-in providers, we will update these Terms and the Privacy Policy before that option becomes available to you.

4.4 Invitations and membership. Workspace Admins may invite, deactivate, and change the roles of Authorized Users. If you join a Workspace created by someone else, you understand that the Workspace's owner controls that Workspace, including its data, permissions, and continued existence, and may remove your access at any time.

5. Your data, your ownership

5.1 Ownership. As between you and Storm OS, you own all Customer Data. We claim no ownership rights in it.

5.2 Limited license to us. You grant us a worldwide, non-exclusive, royalty-free license to host, store, transmit, copy, index, display, back up, and otherwise process Customer Data solely to: (a) provide, secure, and maintain the Service for you; (b) prevent or address technical problems, abuse, or security incidents; and (c) comply with law. This license ends when the Customer Data is deleted, except for backups pending expiry.

5.3 What we will not do. We will not sell, rent, or license Customer Data. We will not use Customer Data to serve advertising. We will not use Customer Data to train machine-learning or generative AI models, whether our own or a third party's.

5.4 Who can access Customer Data. Access is limited to: (a) Authorized Users of the Workspace, as governed by that Workspace's permission and sharing settings; (b) Integrations that you or a Workspace Admin explicitly connect; (c) our subprocessors, which receive data to provide their services to us and are listed, with what each one receives, at storm-os.app/subprocessors; and (d) a small number of Storm OS personnel under the narrow, audited circumstances described in our Privacy Policy (support you request, and investigation of security or availability incidents). We do not browse Workspaces.

5.5 Your responsibility for the data you upload. Storm OS is a relationship tool, which means you will store information about third parties such as prospects, investors, partners, and their staff. You represent that you have a lawful basis to collect and process that information, that you will honor applicable notice and rights obligations toward those individuals, and that you will not upload information you are not permitted to hold. For personal data subject to the GDPR, UK GDPR, or similar laws, you are the controller and we act as your processor (see §6).

5.6 Sensitive data. Do not upload government identification numbers, payment card numbers, health records, precise biometric data, or information subject to sector-specific regimes such as HIPAA, PCI-DSS, GLBA, FERPA, or ITAR/EAR-controlled technical data. The Service is not designed for those categories and we disclaim liability arising from them.

6. Data protection roles

For Customer Data, you are the controller (or business) and we are the processor (or service provider). Our DATA PROCESSING ADDENDUM ("DPA") governs that processing, including subprocessors, security measures, international transfer mechanisms, breach notification, and assistance with data-subject requests. The DPA is incorporated into these Terms by reference and applies automatically where required by law. For Account Data and for our own operational and security telemetry, we act as a controller; see the Privacy Policy.

7. Acceptable use

You will not, and will not permit anyone to:

1. Use the Service in violation of any law, including data protection, anti-spam (CAN-SPAM, CASL, PECR, GDPR Art. 6/21), securities, sanctions, or export control laws.
2. Upload or transmit malware, or attempt to gain unauthorized access to the Service, other Workspaces, or any system or data you are not permitted to access.
3. Probe, scan, or load-test the Service, or conduct penetration testing, without our prior written permission (request at security@storm-os.com).
4. Reverse engineer, decompile, or attempt to derive source code, except to the extent that restriction is unenforceable by law.
5. Resell, sublicense, or provide the Service as a service bureau to third parties, or build a competing product using our confidential information.
6. Scrape or use automated means to extract data from the Service other than through our documented API and within published rate limits.
7. Circumvent usage limits, rate limits, or access controls.
8. Upload content that is unlawful, infringing, defamatory, harassing, or that you lack the right to store.
9. Use the Service to send unsolicited bulk communications, or to build or enrich contact lists in ways that violate applicable law.
10. Misrepresent your identity or affiliation, including in Workspace invitations.

We may suspend access without notice if we reasonably believe conduct threatens the security, integrity, or availability of the Service or another customer's data. We will restore access promptly once the risk is resolved.

7.1 Marketing sending. Storm OS sends a Workspace's marketing email from that Workspace's own sending domain once the domain is verified, and a Workspace that connects MailChimp sends through its MailChimp account instead. If you use the Service to send marketing email to your own contacts, you warrant that you have valid consent, under CAN-SPAM, CASL, PECR, GDPR, and other applicable law, for every recipient on every list you use, and you will not use a purchased or scraped list. We may pause a send in progress or block a Workspace from sending if it crosses our deliverability thresholds for bounce or spam-complaint rates, and will restore it once the underlying list is fixed. Campaign email a Workspace sends carries no line naming Storm OS. Email that Storm OS sends from its own address on a Workspace's behalf, such as proposals, invoices, Room invitations and form replies, says that it was sent via Storm OS.

8. Progressive Web App and offline use

Storm OS is installable as a Progressive Web App and caches a working subset of your Workspace on your device so it works offline.

• Cached data is scoped to the signed-in user and Workspace and is cleared when you sign out.
• Your operating system or browser may evict cached data without warning. Cached data is not a backup.
• Changes made offline are queued locally and applied when connectivity returns. Where two people edited the same record, the app will surface a conflict for you to resolve. You are responsible for reviewing and resolving conflicts.
• Device-level security is your responsibility: use a device passcode, and use the in-app lock and remote sign-out features if a device is lost.

9. Integrations and third-party services

You may connect Integrations to a Workspace. MailChimp, your own Stripe account for invoice payments, and your own AI provider key are Integrations. When you connect one, you authorize us to exchange the data necessary for that Integration to function. Integrations are provided by third parties under their own terms; we do not control them, do not warrant them, and are not liable for their acts or omissions, including their handling of data you direct us to send them. Disconnecting an Integration stops future exchange but does not retrieve data already shared.

10. Beta and early-access features

We may label features "beta," "preview," or "early access." Those features are provided as-is, may change or be withdrawn without notice, may be less reliable, and are excluded from any service commitments. Do not rely on them for business-critical processes.

11. Fees, plans, and trials

Current plans and prices are published at https://storm-os.app/pricing. In summary:

• Storm Eye, the core relationship and pipeline module, is licensed per Workspace in a bundle that includes 5 users, at US$19 per month billed annually or US$24 per month billed monthly.
• Additional users beyond the included 5 are US$4 per user per month billed annually or US$5 per user per month billed monthly.
• Storm Project, Storm Marketing, and Storm Finance are optional modules licensed in blocks of 5 users at US$9 per block per month billed annually or US$12 per block per month billed monthly. Module blocks are allocated at the Workspace level and must cover every licensed Storm Eye user. A Workspace with 6 Storm Eye users therefore requires 2 blocks of any module it enables. Per-user module allocation is not offered.
• Early access accounts receive Storm Project, Storm Marketing, and Storm Finance at no charge for 12 months from the date the Workspace is created. At the end of that period those modules will be disabled unless you choose to license them. We will notify Workspace Admins by email at least 30 days before the promotional period ends, stating what will change and what it will cost. We will not begin charging you for a module you have not affirmatively chosen to license.
• AI allocations. Some plans include an allowance of AI-assisted features. These allowances are still being finalized and are subject to change.

All prices are in US dollars, which is currently the only supported billing currency.

AI-assisted features. While the Service is in early access we may introduce, adjust, meter, or withdraw AI allowances, and may change how AI usage is measured. Where a change would reduce an allowance included in a plan you are already paying for, we will give at least 30 days' notice by email to Workspace Admins, and you may terminate and export your data under §14.4 if you object. Some AI-assisted features may be offered as beta features under §10.

AI output can be inaccurate, incomplete, or unsuitable for your situation. You are responsible for reviewing it before acting on it, and §2 applies to anything it produces. Our commitment in §5.3 applies in full to these features: we will not use Customer Data to train machine-learning or generative AI models.

The AI-assisted features are off until a Workspace Admin turns the assistant on. When they run on our account, the content they work with is sent to Anthropic, PBC, under Anthropic's commercial terms, which do not permit Anthropic to train models on it, and Anthropic's data processing addendum. Anthropic states that it deletes API inputs and outputs within 30 days, except where it keeps them longer to enforce its usage policy (up to 2 years for content it flags) or to comply with the law. Where a Workspace routes a feature to its own AI provider key, that provider's terms with the Workspace apply to what runs on that key (§9). Research, where a Workspace Admin also allows it, sends what it searches with to the data providers listed at storm-os.app/subprocessors. No field on a record is changed until a member accepts what research found, and a research run on a company also files the further company details the providers return, such as funding, technology and headcount, on that company's record.

Where fees apply: fees are stated in the applicable plan or order, are payable in advance, are billed to the payment method on file through our payment processor, are non-refundable except where required by law, and exclude taxes, which you are responsible for. We may change pricing on 30 days' notice effective at your next renewal. Non-payment may result in suspension after notice and a reasonable cure period. If we offer a free tier or trial, we may change or discontinue it at any time on reasonable notice.

12. Intellectual property; feedback

We and our licensors own the Service and all software, design, documentation, trademarks, and content within it, excluding Customer Data. We grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription, for your internal business purposes, subject to these Terms.

If you send us feedback, ideas, or suggestions, you grant us a perpetual, irrevocable, royalty-free license to use them without obligation to you. We will not identify you as the source without your permission.

13. Confidentiality

Each party may receive the other's non-public information. The receiving party will protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisors who need it and are bound by confidentiality. This does not apply to information that is public through no fault of the receiver, independently developed, or lawfully received from a third party. Compelled disclosure is permitted with prompt notice where legally allowed. Customer Data is your Confidential Information.

14. Term, termination, export, and deletion

14.1 Term. These Terms apply from your first use until terminated.

14.2 Termination by you. You may stop using the Service and delete your Workspace at any time from the Workspace Admin console.

14.3 Termination by us. We may terminate or suspend for material breach that remains uncured 10 days after notice, for non-payment, for conduct posing legal or security risk, or if we discontinue the Service (with at least 60 days' notice, and a pro-rata refund of prepaid unused fees).

14.4 Export window. For 30 days after termination, you may export your Customer Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships. Data portability is included in every plan.

14.5 Deletion. After the export window, we will delete Customer Data from active systems within 30 days and from backups within our normal backup expiry cycle (currently 35 days), except where retention is required by law. Deletion of individual records inside the Service follows the in-product lifecycle: soft delete, Recycle Bin restore for 30 days, then purge.

14.6 Survival. Sections 5.1, 12, 13, 15, 16, 17, 18, and 20 survive termination.

15. Disclaimers

Except as expressly stated in these Terms and to the fullest extent permitted by law, the Service is provided "as is" and "as available." We disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, error-free, or that it will meet your requirements, and we do not warrant results obtained from the Service, including scores, forecasts, or reports, which are indicative only. Some jurisdictions do not allow certain disclaimers; those disclaimers apply only to the extent permitted.

16. Limitation of liability

To the fullest extent permitted by law:

• Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid or owed to us in the 12 months before the event giving rise to the claim, or (b) US$100.
• These limits do not apply to: your breach of §7 (Acceptable Use), either party's indemnity obligations, your payment obligations, or liability that cannot be limited by law (including, in some jurisdictions, gross negligence, willful misconduct, death, or personal injury).

Nothing in these Terms limits rights that consumers or others have under mandatory local law.

17. Indemnification

17.1 By you. You will defend and indemnify us against third-party claims arising from Customer Data, your use of the Service in breach of these Terms or applicable law, or your infringement of a third party's rights.

17.2 By us. We will defend and indemnify you against third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a US patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Our obligation does not apply to claims arising from Customer Data, combination with items not supplied by us, or use of beta features. We may procure the right to continue, modify the Service, or terminate and refund prepaid unused fees.

17.3 Process. The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and provide reasonable cooperation.

18. Governing law and disputes

These Terms are governed by the laws of the Commonwealth of Pennsylvania, USA, without regard to conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Before filing a claim, the parties will attempt in good faith to resolve the dispute by notice to legal@storm-os.com and 30 days of discussion. Any unresolved dispute will be brought exclusively in the state or federal courts located in Allegheny County, Pennsylvania, and both parties consent to that jurisdiction and venue. Either party may seek injunctive relief in any court to protect intellectual property or confidential information.

If you are a consumer in the EU, UK, or another jurisdiction with mandatory local protections, nothing here deprives you of the right to bring proceedings in your home courts under local law.

19. Export controls and sanctions

You represent that you are not located in, ordinarily resident in, or organized under the laws of a country or region subject to comprehensive US sanctions, and that you are not on any US, UK, or EU restricted-party list. You will not use or export the Service in violation of US export control or sanctions laws.

20. General

20.1 Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email to Workspace Admins and by an in-app notice, and the change takes effect at the end of that period. Continued use after the effective date means acceptance. If you object, you may terminate and export your data under §14.4.

During the Early Access Period defined in §1, the 30 day period above does not apply. We will still tell Workspace Admins by email what changed, as soon as we reasonably can, and the change takes effect on the date the notice gives. Your right to object, to terminate and to export your data under §14.4 is unchanged. From January 1, 2027 the 30 day period applies in full.

20.2 Changes to the Service. We improve the Service continuously. We will not materially reduce core functionality without reasonable notice.

20.3 Assignment. You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets with notice to us. We may assign to an affiliate or successor.

20.4 Entire agreement. These Terms, the Privacy Policy, and the DPA are the entire agreement and supersede prior discussions. Terms on a purchase order or vendor portal have no effect.

20.5 Severability and waiver. If a provision is unenforceable, the rest remains in effect. A failure to enforce is not a waiver.

20.6 Force majeure. Neither party is liable for delays caused by events beyond reasonable control, excluding payment obligations.

20.7 Independent contractors. No agency, partnership, joint venture, or employment relationship is created.

20.8 Publicity. We will not use your name or logo publicly without your prior written consent.

21. Contact

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
General: hello@storm-os.com · Legal: legal@storm-os.com · Security: security@storm-os.com · Privacy: privacy@storm-os.com

Effective date: October 4, 2026
Last updated: October 4, 2026
Version: 1.2

The short version

• Your Workspace data is yours. We hold it only to run the product for you.
• We do not sell or share your data, we do not serve ads, and we do not use your data to train AI models.
• We ask for the minimum from Google: sign-in identity only. We do not read your mailbox, calendar, files, or contacts.
• The assistant and research are off until a Workspace Admin turns them on. When they are on, the content they work with goes to the providers listed in §8.
• We do not browse your Workspace. Storm OS personnel access Workspace content only when you ask us to for support, or when we must to fix a security or availability incident. Every such session is logged, time-limited, and visible to your Workspace Admins.
• You can export everything and delete everything, at any time.

The rest of this policy is the detail behind those statements.

1. Who we are and what this covers

On-Call CMO, doing business as Storm OS ("Storm OS," "we," "us"), 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA, operates the Storm OS marketing site and the Storm OS application, both at storm-os.app. The application is an installable Progressive Web App for managing customer, investor, and partner relationships.

This policy explains what personal data we handle, why, and what rights you have. It applies to visitors to our site, people who create or join a Workspace, and individuals whose information appears inside a customer's Workspace.

Two different roles. This distinction determines who you should contact about your data:

If your details appear in someone's Storm OS Workspace and you want them corrected or removed, contact that organization directly. If you contact us instead, we will forward your request to the relevant customer and, where the law requires, assist them in responding. See §12.

2. What we collect

2.1 Data you give us

2.2 Data we collect automatically

We do not use advertising cookies or cross-site tracking pixels. Google Analytics sets its cookies only on the pages and screens where it runs, listed above, and we configure it not to use Google signals or ad personalization. Everywhere else, the application sets only strictly necessary cookies: the httpOnly, Secure, SameSite=Lax cookies that sign you in and keep you signed in, a cookie that records only that you are signed in, so our site can take you straight to the application, and the fraud-prevention cookies of our payment processor, Stripe, whose payment form the application loads during onboarding and on the billing screen. Because they are strictly necessary, no consent is required for them.

Marketing email a Workspace sends to its own contacts is a different case. When a Workspace turns tracking on for a send, that message carries an open pixel and links rewritten through go.storm-os.app, or through a hostname on that Workspace's own domain, beside its sending domain, once the Workspace has published the record for one, to record opens and clicks for that Workspace's own reporting. The unsubscribe address in the message header always stays on go.storm-os.app, so unsubscribing keeps working even if the Workspace's own hostname stops. Tracking is the Workspace's choice, set per campaign and per sending domain, and it never applies to the application itself.

2.3 Data from third parties

• Identity provider (Google): see §3.
• Payment processor: subscription status and payment outcomes. Card numbers never reach our servers.
• Data you import: CSV/XLSX files you upload, and information from Integrations you connect. We do not buy or sell contact lists.
• Research, if a Workspace turns it on: when a Workspace Admin has turned the assistant on and allowed web research, a member who can edit a record can ask Storm OS to research that person or company, or a saved list of them. The run looks them up with the data providers listed in §8, which we pay for each lookup, and on the public web through Anthropic's web search, and shows what it found as suggestions, each with its source. No field on a record is changed until a member reviews and accepts a suggestion. A research run on a company also files the further company details the data providers return, such as funding, technology, headcount, industry codes, products and competitors, on that company's record. What Storm OS stores from a research run, including the providers' answers, is kept private to the Workspace that ran it, for the periods in §11. A request to erase a person from the research results a Workspace has saved for reuse is carried out for each Workspace separately, and everything else research keeps follows the periods in §11.

3. Signing in with Google

Storm OS offers "Sign in with Google" so you don't need another password. This section is the full disclosure of what that involves. Google is currently our only third-party sign-in provider. If we add another, we will update this policy before that option becomes available to you.

3.1 What we request

We request identity scopes only:

We neither request nor can access your Gmail mailbox, your Google Calendar, your Drive files, or your Google Contacts. No message content, no attachments, no meeting data.

3.2 What we do with it

We use this information solely to: authenticate you; create or match your Storm OS account; populate your display name; and send you transactional email at the address on file. We store the provider's unique identifier, your email address, and your name as your display name. We do not take your avatar from Google. We do not store tokens beyond what is needed to complete sign-in, and we do not use provider data for advertising, profiling, or model training.

3.3 Google API Services User Data Policy and Limited Use

Storm OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Storm OS interface;
• Do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit prior consent;
• Do not use Google user data for serving advertisements of any kind, including retargeting, personalized, or interest-based advertising;
• Do not sell Google user data; and
• Do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.

3.4 If we ever need more

Automatic email capture is on our roadmap. If we build it, mailbox access will be a separate, optional, clearly explained authorization that you can decline while continuing to use sign-in normally. Adding those permissions would require a new consent prompt from Google, so access cannot expand silently. We will update this policy and notify Workspace Admins before any such feature launches.

3.5 Revoking access

You can disconnect Storm OS at any time:

• Google: myaccount.google.com/permissions

Revoking stops us from authenticating you through Google. It does not delete your Workspace; to delete data, see §11.

4. Why we use your data, and our legal bases

5. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding 12 months.
• We do not serve advertising in Storm OS, and we do not let anyone pay to influence what you see.
• We do not use Customer Data to train, fine-tune, or evaluate machine-learning or generative AI models, ours or anyone else's.
• We do not disclose Customer Data to third parties except as described in §7.

6. Who can access Workspace data

This is the part most people actually want answered, so here it is plainly.

Access is limited to:

1. Authorized Users of your Workspace. What each one sees is governed by your Workspace's org-wide defaults, ownership, admin sharing rules, and individual record shares. Every record has an access explainer showing who can see it and why. Workspace Admins have full access to Workspace content by design, and their actions are audited.
2. Integrations you connect. Only the data required for that integration, only after a Workspace Admin authorizes it, and only for as long as it stays connected.
3. Our subprocessors (§8). Each receives data to provide its service to us, as §8 describes. Stripe also acts as an independent controller for purposes its own terms list, such as fraud prevention and legal compliance.
4. Storm OS personnel, narrowly and on the record. We do not browse Workspaces and we have no general-purpose window into your data. Our staff may access Workspace content only in these situations:

• You ask us to. Support may start a time-limited session acting as your user to reproduce a problem. Every session requires a stated reason, is capped at 60 minutes, displays a persistent banner in the app, is recorded in our platform audit log, and appears in your own Workspace audit log so your admins can see exactly who accessed what, when, and why.
• Security or availability incidents. Where we must investigate abuse, a breach, data corruption, or a serious outage, access is limited to what the investigation requires, is role-restricted, and is audited the same way.
• Legal compulsion. See §7.

Support sessions cannot change your password or email address, and cannot export your data, unless the operator holds an explicitly elevated support permission. Routine engineering does not use production Workspace data; development and testing run against synthetic seed data.

These limits are enforced technically as well as contractually: every row in our database carries a workspace identifier, Postgres row-level security is applied as defense in depth, access is resolved server-side by a single authorization module on every read and write, and audit writes are append-only.

7. When we disclose data

We disclose personal data only:

• To subprocessors who help us run the Service (§8).
• To Google, for site analytics: Google Analytics receives what §2.2 describes.
• At your direction: to Integrations you connect, or to recipients you share with.
• For legal reasons: to comply with a valid legal process, or to protect the rights, safety, or property of Storm OS, our customers, or the public. Where we are legally permitted, we will notify the affected customer before disclosing Customer Data so they can seek protective relief. We will push back on requests that are overbroad or defective.
• In a business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, data may transfer to the successor, which will remain bound by this policy or give notice before any material change. Google user data would transfer only with the affected user's explicit prior consent (§3.3).

8. Subprocessors

We use a small number of vendors to operate the Service. Current subprocessors:

Used for every Workspace

Used only when a Workspace turns a feature on

Nothing is sent to these subprocessors until a Workspace Admin turns the assistant on. The three data providers are used only when a Workspace Admin has also allowed web research and a member runs research on a record or a saved list.

Anthropic publishes its own subprocessors, including any provider behind its web search, at anthropic.com/subprocessors.

Google also provides the site analytics described in §2.2. That covers visits to our own site, sign-up and onboarding, never Customer Data, so Google Analytics is not on this list.

Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations the Workspace controls. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it, and none of them is our subprocessor. With a Workspace's own Anthropic key, two things still run on our accounts: the background reading of documents already filed on people, companies and deals, and a research run's calls to the data providers above.

We maintain the current list at storm-os.app/subprocessors and will give Workspace Admins at least 30 days' notice before adding a new subprocessor that processes Customer Data, with an opportunity to object.

During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), that 30 day period does not apply, because the third party services we run on are still being selected and configured. We will tell Workspace Admins by email as soon as we reasonably can and update the subprocessors page, and the opportunity to object is unchanged. From January 1, 2027 the 30 day period applies in full.

9. International transfers

Storm OS is operated from the United States. Customer Data is hosted in the United States and Germany. Where a Workspace turns on the assistant or research, what is sent to the providers in §8 is processed in the locations listed there. Wherever your Workspace is hosted, our personnel, support, and administrative systems are located in the United States, so operating the Service involves processing your data in the US and in other countries whose data protection laws may differ from your own.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), executed in our Data Processing Addendum, as our primary transfer mechanism;
• supplementary technical and organizational measures, including encryption in transit and at rest, tenant isolation, least-privilege access, and a policy of challenging overbroad government requests; and
• where a subprocessor holds a valid certification, the EU-US Data Privacy Framework and its UK Extension and Swiss-US Framework, as an additional basis.

The Standard Contractual Clauses do not extend to a research data provider that offers no separate data protection terms (§8, DPA §7.4).

A copy of the relevant transfer mechanism is available on request at privacy@storm-os.com.

Storm OS is not currently self-certified under the EU-US Data Privacy Framework. Standard Contractual Clauses are our own transfer mechanism; the Framework is relevant only where a subprocessor is separately certified.

10. Security

We design for hard tenant isolation and least privilege. Our current measures include:

• In transit: TLS 1.2+ everywhere; HSTS.
• At rest: encryption at the storage layer for the database and blob storage.
• Credentials: passwords hashed with Argon2id with a strength requirement; passwords are never stored or logged in readable form.
• Sessions: short-lived access tokens plus rotating refresh tokens in httpOnly, Secure, SameSite=Lax cookies that are never readable by JavaScript; token-reuse detection invalidates the whole session family; per-device sign-out and "sign out everywhere."
• Multi-factor authentication: optional TOTP per user; Workspace Admins can require it for everyone.
• Tenant isolation: every row is workspace-scoped, Postgres row-level security applied as defense in depth, cross-tenant access tested in CI as a failing-closed test.
• Authorization: a single server-side module resolves access on every read and write, including search, reports, and offline sync, so clients never receive rows they aren't entitled to.
• Files: attachments and exports are stored privately and served only through short-lived signed URLs; nothing is publicly addressable.
• On your device: offline data is scoped to user and Workspace and wiped on sign-out; an optional app lock re-authenticates after inactivity; revoking a session remotely takes effect on the device's next connection.
• Operations: brute-force and rate limiting, append-only audit logging, error and performance monitoring, automated dependency vulnerability scanning, an automated test suite that gates every deployment and includes denied-path authorization tests on every endpoint, and least-privilege access for personnel bound by written confidentiality obligations. We have not yet commissioned an independent third-party penetration test. When we do, we will say so here and make the summary available to customers on request.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected Workspace Admins without undue delay and in any event within 48 hours of becoming aware, matching our contractual commitment in DPA §9, and will notify regulators and individuals where required by law. Report suspected vulnerabilities to security@storm-os.com.

11. How long we keep data

12. Your rights

If you are an Authorized User or account holder, you can view and update most of your data directly in the app: profile and preferences, active sessions and devices, notification settings, and Workspace export. For anything else, contact privacy@storm-os.com.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; obtain a portable copy; restrict or object to processing (including profiling); withdraw consent; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we do not collect it for the purposes the law targets); and appeal a refused request. We will not discriminate against you for exercising these rights.

To exercise a right, email privacy@storm-os.com. We will verify your identity by confirming control of the email address on the account, or by other proportionate means. We respond within 30 days (extendable by a further 60 where the law allows, with notice). You may use an authorized agent where the law provides for one.

If your information is in a customer's Workspace, that customer is the controller. Send your request to them. If you send it to us, we will route it to them within 10 business days and support them in responding; we will not unilaterally alter or delete their records.

Complaints. You may lodge a complaint with your local supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve it first.

EU/UK representative. Storm OS markets and sells the Service in the United States. Prices are quoted only in US dollars and the Service is offered only in English, so we do not consider ourselves to be offering goods or services to individuals in the EU or UK within the meaning of GDPR Article 3(2), and we have not appointed an Article 27 representative. If we begin actively marketing to the EU or UK, we will appoint one and update this policy before doing so.

13. Children

Storm OS is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@storm-os.com and we will delete it.

14. Automated decision-making

Storm OS computes two relationship scores: a Fit Score from criteria your Workspace Admin configures, and an Activity Score based on recency and type of interactions. Both are decision support. Each is shown with a full breakdown of how it was calculated, and can be manually overridden by your users. They are not used by us to make automated decisions producing legal or similarly significant effects about any individual.

15. Changes to this policy

We will update this policy as the product changes. For material changes we will notify Workspace Admins by email and post an in-app notice at least 30 days before the change takes effect, and update the "Last updated" date above. During the Early Access Period defined in the Terms of Service, the 30 day period does not apply, as Terms of Service §1 describes. Where the change requires consent, we will ask for it. We keep prior versions of this policy, the Terms of Service and the Data Processing Addendum at storm-os.app/privacy/archive.

16. Contact us

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA

Privacy: privacy@storm-os.com · Security: security@storm-os.com · Storm OS has not appointed a Data Protection Officer, as it is not required to do so under GDPR Article 37. Privacy inquiries are handled at the address above.

Effective date: October 4, 2026
Last updated: October 4, 2026
Version: 1.2

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the Storm OS Terms of Service at https://storm-os.app/terms (the "Agreement") between:

Processor / Service Provider: On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS, of 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA ("Storm OS," "we," "us"); and

Controller / Business: the customer that has accepted the Agreement ("Customer," "you").

This DPA applies where Storm OS processes Personal Data on Customer's behalf in providing the Service, and it applies automatically, with no signature required, from the date Customer accepts the Agreement. Customer may also request a countersigned copy at legal@storm-os.com.

This DPA does not apply to Account Data, security telemetry, or diagnostic data for which Storm OS acts as a controller in its own right. That processing is governed by the Privacy Policy.

2. Definitions

3. Roles of the parties

3.1 Customer is the Controller (and Business) of Customer Personal Data. Storm OS is the Processor (and Service Provider) and processes Customer Personal Data only on Customer's documented instructions.

3.2 Customer determines what Personal Data it puts into the Service, why, and who may access it. Customer is responsible for having a lawful basis for that processing, for providing any required notices to Data Subjects, and for the accuracy and legality of Customer Personal Data. This matters more than usual for a relationship management product: Customer Personal Data will typically include information about prospects, investors, partners, and their staff who have not interacted with Storm OS directly.

3.3 Where Customer is itself a processor for another controller, Customer warrants that it has authority to appoint Storm OS as a subprocessor on the terms of this DPA, and references to Customer's instructions include instructions from that controller as passed through by Customer.

3.4 For any processing outside the scope of §1, each party acts as an independent controller.

3.5 Marketing sending. Where Customer uses the Service to send marketing email to its own contacts, Customer is the Controller of the recipient list it sends to, and warrants that it holds valid consent, under applicable law, for every recipient on that list. Storm OS processes the recipient list, the message content, and the resulting engagement events as Processor, on Customer's instructions, under this DPA, once Customer's sending domain is verified.

3.6 The assistant and research. The assistant and web research are off until a Workspace Admin turns them on. Turning either on, and an Authorized User then asking for a summary, a document reading or a research run, are Customer's instructions under §4.2 to process the Customer Personal Data involved with the Subprocessors that Annex III lists for that feature, on the terms §7 describes for each of them. A research run looks a person or company up with third-party data providers and on the public web. No field on a record is changed until an Authorized User accepts what the run found, and a research run on a company also files the further company details the data providers return, such as funding, technology, headcount, industry codes, products and competitors, on that company's record. What Storm OS stores from a research run, including the data providers' answers, is kept within Customer's Workspace, and Storm OS never shows it to another customer.

4. Instructions

4.1 Storm OS will process Customer Personal Data only:
(a) as necessary to provide, secure, and maintain the Service under the Agreement;
(b) in accordance with Customer's further documented instructions, where those instructions are consistent with the Agreement and technically feasible; and
(c) as required by applicable law, in which case Storm OS will inform Customer of that requirement before processing unless the law prohibits it on important grounds of public interest.

4.2 The Agreement, this DPA, Customer's configuration of the Service, and Customer's use of Service features constitute Customer's complete documented instructions.

4.3 Storm OS will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until it is amended or confirmed. Storm OS may decline instructions that would require material changes to the Service or that it reasonably believes to be unlawful.

4.4 Prohibited uses. Storm OS will not:
(a) Sell or Share Customer Personal Data, as those terms are defined in the CCPA;
(b) retain, use, or disclose Customer Personal Data for any purpose other than performing the Service, including any commercial purpose of its own, except as permitted by Data Protection Laws;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Storm OS and Customer;
(d) combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interactions with a Consumer, except as permitted for a Service Provider under the CCPA; or
(e) use Customer Personal Data to train, fine-tune, benchmark, or evaluate machine-learning or generative artificial intelligence models, whether Storm OS's own or a third party's.

4.5 Storm OS certifies that it understands the restrictions in §4.4 and will comply with them.

4.6 Aggregated and deidentified data. Storm OS may create and use aggregated or deidentified data derived from operating the Service (for example, volumetric and performance statistics) for capacity planning, security, and product improvement, provided such data cannot reasonably be used to identify any Data Subject or Customer, Storm OS commits to maintaining it in deidentified form, does not attempt to reidentify it, and contractually obligates any recipient to the same.

5. Confidentiality and personnel

5.1 Storm OS will treat Customer Personal Data as Customer's Confidential Information under the Agreement.

5.2 Storm OS will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations that survive termination of employment, are trained on their data protection responsibilities, and are granted access only on a least-privilege, need-to-know basis.

5.3 Personnel access to Workspace content. Storm OS does not routinely access Customer Personal Data. Personnel may access it only:
(a) at Customer's request, to provide support, via a support session that requires a stated reason, is capped at 60 minutes, displays a persistent in-app banner to the acting user, is recorded in Storm OS's platform audit log, and is written to Customer's own Workspace audit log so Customer's administrators can see who accessed what, when, and why;
(b) as strictly necessary to investigate or remediate a security incident, data corruption, abuse, or a serious availability failure, limited to what the investigation requires and audited on the same terms; or
(c) where compelled by law, subject to §10.6.

Support sessions cannot change a user's password or email address, and cannot export Customer Data, unless the acting operator holds an explicitly elevated support permission. Development and testing are performed against synthetic seed data.

6. Security

6.1 Storm OS will implement and maintain the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

6.2 Storm OS may update those measures over time provided the overall level of protection is not materially reduced.

6.3 Customer is responsible for the security decisions within its control: configuring Workspace access defaults, sharing rules and roles; enabling and enforcing multi-factor authentication; managing membership and promptly deactivating departed users; and securing the devices on which the Progressive Web App is installed.

7. Subprocessors

7.1 General authorization. Customer grants Storm OS general authorization to engage Subprocessors, subject to this §7. The Subprocessors engaged as at the effective date are listed in Annex III and maintained at https://storm-os.app/subprocessors.

7.2 Notice and objection. Storm OS will give Customer at least 30 days' notice before adding or replacing a Subprocessor that processes Customer Personal Data, by email to Workspace Admins and by updating the subprocessors page. Customer may object on reasonable data protection grounds within that period by written notice to privacy@storm-os.com. The parties will discuss the objection in good faith; if Storm OS cannot offer a reasonable alternative, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid unused fees.

7.2.1 Early Access Period. During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), the 30 days' notice in §7.2 does not apply, because the third party services Storm OS runs on are still being selected and configured. Storm OS will notify Customer by email as soon as reasonably practicable and update the subprocessors page. Customer's right to object under §7.2, and to terminate without penalty if Storm OS cannot offer a reasonable alternative, is unchanged. From January 1, 2027 the 30 days' notice applies in full.

7.3 Flow-down and liability. Storm OS will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each Subprocessor's performance. A research data provider that offers no separate data protection terms processes lookups under its published terms instead, as its row in Annex III states.

7.4 Where a Subprocessor is located outside the EEA, UK, or Switzerland, Storm OS will ensure an appropriate transfer mechanism is in place under §10, except with a research data provider that offers no separate data protection terms (§7.3).

8. Data subject rights and assistance

8.1 Self-service first. The Service gives Customer the tools to respond to most Data Subject requests directly: search, record edit and delete, soft delete with a 30-day Recycle Bin, merge, and full Workspace export in CSV/JSON. Customer will use those tools where they are sufficient.

8.2 Assistance. Taking into account the nature of the processing, Storm OS will provide reasonable assistance, by appropriate technical and organizational measures and insofar as possible, to help Customer fulfill its obligations to respond to requests for access, rectification, erasure, restriction, portability, and objection.

8.3 Requests received by Storm OS. If Storm OS receives a request from a Data Subject relating to Customer Personal Data, it will not respond substantively other than to acknowledge and redirect, and will notify Customer without undue delay (and in any event within 10 business days) so Customer can respond as Controller. Storm OS will not alter or delete Customer's records in response to such a request without Customer's instruction.

8.4 Further assistance. Storm OS will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities under GDPR Articles 35 and 36, and with Customer's obligations under Articles 32 to 36 generally, taking into account the information available to Storm OS.

8.5 Assistance beyond what is reasonably required by Data Protection Laws, or that is disproportionate in scope or frequency, may be chargeable at Storm OS's then-current professional services rates, on prior notice.

9. Personal Data Breach

9.1 Storm OS will notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it, by email to Workspace Admins and the security contact on file.

9.2 The notification will include, to the extent known and as it becomes known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point for further information. Where information is not available at the time of notification, Storm OS will provide it in phases without further undue delay.

9.3 Storm OS will take reasonable steps to contain, investigate, and remediate the breach, and will preserve relevant logs and evidence.

9.4 Storm OS's notification is not an acknowledgment of fault or liability. Customer is responsible for determining whether the breach requires notification to Supervisory Authorities or Data Subjects and for making those notifications. Storm OS will not notify any Supervisory Authority or Data Subject on Customer's behalf without Customer's prior consent, except where independently required to do so by law.

9.5 Customer will keep an accurate security contact email current in the Workspace Admin console.

10. International transfers

10.1 Customer acknowledges that Storm OS is established in the United States and that provision of the Service involves transfer of Customer Personal Data to the United States and, where applicable, to Subprocessor locations identified in Annex III.

10.2 EEA transfers. Where Customer Personal Data is transferred from the EEA to a country that is not the subject of an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller;
• Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party controller;
• Clause 7 (docking clause) applies;
• Clause 9, Option 2 (general written authorization) applies, with the notice period specified in §7.2 of this DPA;
• Clause 11(a) optional language (independent dispute resolution) does not apply;
• Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• Clause 18(b): disputes will be resolved before the courts of Ireland;
• Annex I to the SCCs is populated by Annexes I(A), I(B), and I(C) of this DPA;
• Annex II to the SCCs is populated by Annex II of this DPA;
• Annex III to the SCCs (where used) is populated by Annex III of this DPA.

10.3 UK transfers. The UK Addendum is incorporated and applies to transfers from the UK, completed as set out in Annex IV.

10.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" does not limit Data Subjects in Switzerland from bringing proceedings in their place of habitual residence; and the SCCs also protect the data of legal entities until the FADP no longer extends to them.

10.5 Supplementary measures. In addition to the SCCs, Storm OS applies the measures in Annex II, including encryption in transit and at rest, tenant isolation enforced in the database layer, least-privilege and audited personnel access, and the government-request handling in §10.6, as supplementary measures supporting the transfer.

10.6 Government access requests. If Storm OS receives a legally binding request from a public authority for Customer Personal Data, it will: (a) review the request for lawfulness and challenge it where there are reasonable grounds to consider it unlawful, overbroad, or defective, seeking interim relief where appropriate; (b) disclose only the minimum data legally required; and (c) notify Customer of the request before disclosure where legally permitted, or, if prohibited, seek a waiver of the prohibition and provide such information as it is lawfully able, as promptly as possible. Storm OS will document such requests and provide the information required by Clause 15 of the SCCs.

10.7 Alternative mechanisms. If a transfer mechanism relied on here is invalidated, amended, or superseded, the parties will work in good faith to implement a valid alternative (including any successor clauses) without undue delay, and Storm OS may update this DPA accordingly on notice.

11. Audit and information rights

11.1 Storm OS will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. In the first instance this will be satisfied by: this DPA and its Annexes, the Privacy Policy, the subprocessors page, and a completed standard security questionnaire (Storm OS will use commercially reasonable efforts to complete Customer's own questionnaire once per twelve-month period).

11.2 Where the documentation in §11.1 is genuinely insufficient to demonstrate compliance, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality that does not compete with Storm OS, subject to: at least 30 days' prior written notice; no more than once per twelve-month period except following a Personal Data Breach affecting Customer or where required by a Supervisory Authority; conduct during normal business hours; a scope limited to Storm OS's processing of Customer Personal Data; and no access to other customers' data, to Storm OS's own confidential commercial information, or to production Personal Data of any kind.

11.3 Customer bears its own audit costs and will reimburse Storm OS's reasonable costs for audits beyond the first in any twelve-month period.

11.4 Where the SCCs apply, this §11 is the parties' agreed means of exercising the audit rights in Clause 8.9, without limiting those rights where they cannot be limited by law.

12. Return and deletion

12.1 On termination or expiry of the Agreement, Customer may export Customer Personal Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships, for 30 days, using the Workspace export in the Admin console.

12.2 After the export period, Storm OS will delete Customer Personal Data from active systems within 30 days, and it will age out of backups within Storm OS's rolling backup expiry cycle (currently 35 days). Storm OS will certify deletion in writing on request.

12.3 Storm OS may retain Customer Personal Data to the extent required by applicable law, and will continue to protect it under this DPA for as long as it is retained.

13. General

13.1 Order of precedence. In the event of conflict, the SCCs prevail over this DPA, and this DPA prevails over the rest of the Agreement, in each case only as to the subject matter of the conflict.

13.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws prohibit that limitation. Nothing in this §13.2 limits any Data Subject's rights under the SCCs.

13.3 Term. This DPA takes effect with the Agreement and continues until Storm OS ceases to process Customer Personal Data, at which point the obligations that by their nature should survive will do so.

13.4 Changes. Storm OS may update this DPA where required by changes in Data Protection Laws, changes to the Service, or the introduction of new transfer mechanisms, on at least 30 days' notice to Workspace Admins, provided no update materially reduces the protections afforded to Customer Personal Data. During the Early Access Period defined in the Terms of Service, that notice period does not apply, as Terms of Service §1 describes.

13.5 Governing law. Except where the SCCs, UK Addendum, or Data Protection Laws require otherwise, this DPA is governed by the law and venue specified in the Agreement.

13.6 Contact. Data protection matters: privacy@storm-os.com. Security matters and incident reports: security@storm-os.com. Contractual matters: legal@storm-os.com.

Annex I(A): Parties

Data exporter (Controller / Processor): the Customer identified in the Agreement.
Contact: the Workspace Admin email address and any privacy contact designated by Customer in the Workspace Admin console.
Activities relevant to the transfer: use of the Storm OS relationship and pipeline management service.
Role: Controller (or Processor where §3.3 applies).
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Data importer (Processor): On-Call CMO d/b/a Storm OS, 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA.
Contact: privacy@storm-os.com.
Activities relevant to the transfer: hosting and operating the Storm OS application, database, file storage, transactional and marketing email, and support, and AI-assisted features and record research where Customer enables them.
Role: Processor.
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Annex I(B): Description of processing

Categories of Data Subjects

• Customer's Authorized Users: founders, employees, contractors, advisors, and observers with Workspace access
• Customer's prospects, leads, and customers, and their employees and representatives
• Current and prospective investors, and the employees and representatives of funds and syndicates
• Partners, resellers, referrers, and their employees and representatives
• Any other individual whose details Customer chooses to record in its Workspace

Categories of Personal Data

• Identity and contact: name, job title, employer, email address, telephone number, postal or business address, social profile URLs, website and domain
• Account and authentication (Authorized Users): password hash, Google identity provider subject identifier, MFA enrollment status, session and device metadata, IP address at sign-in
• Relationship and workflow: relationship role and sub-type, engagement level, ownership, introductions and associations, pipeline and stage, opportunity value and line items, tasks, next steps, loss reasons, tags, relationship fit and activity scores
• Interaction records: notes, logged activities, meeting and call records entered by users, timeline events
• Content: attachments and documents uploaded by Authorized Users, which may contain Personal Data determined solely by Customer
• Custom fields: additional fields defined by Customer, the content of which is determined solely by Customer
• Audit: actor, timestamp, device summary, and before/after values for audited actions
• Marketing email engagement: open and click events, and the user agent and IP address at the event, for marketing email a Workspace sends to its own contacts
• Form and landing page submissions: the answers a person submits on a Workspace's public form or landing page, the page and step it was submitted on, the time, and, where the form collects them, the referring site and campaign (UTM) parameters
• Research results: where Customer enables research, the values a research run found about a person or company, the source of each, and the data providers' answers

Sensitive data. The Service is not designed for and Customer is contractually prohibited from submitting special category data under GDPR Article 9, data relating to criminal convictions and offenses under Article 10, government identifiers, payment card numbers, health records, precise biometric data, or precise geolocation. If Customer nonetheless submits such data through free-text fields, custom fields, or attachments, Customer does so as Controller and at its own risk, and the restrictions in the Agreement apply.

Frequency of transfer: continuous, for the duration of the Agreement.

Nature of the processing: collection, recording, organization, structuring, storage, retrieval, consultation, use, indexing, deduplication and merging, scoring, AI-assisted summarization, extraction and drafting, and research with third-party data providers and the public web where Customer enables them, synchronization to Authorized Users' devices for offline use, backup, disclosure to Authorized Users and authorized Integrations, marketing email composition, sending, and engagement tracking where a Workspace enables it, erasure, and destruction.

Purpose of the processing: providing the Storm OS relationship and pipeline management service to Customer under the Agreement, including hosting, synchronization, notification, reporting, support, security, marketing email sent by Customer to its own contacts where Customer enables it, and AI-assisted features and record research where Customer enables them.

Duration: for the term of the Agreement, plus the retention and deletion periods in §12 of this DPA.

Subprocessor processing: as described in Annex III, for the duration of the Agreement or until the Subprocessor is replaced.

Annex I(C): Competent Supervisory Authority

Where the data exporter is established in an EEA Member State, that Member State's Supervisory Authority.

Where the data exporter is not established in the EEA but falls within the territorial scope of the GDPR under Article 3(2) and has appointed a representative under Article 27, the Supervisory Authority of the Member State in which that representative is established.

Where the data exporter is not established in the EEA and has not appointed a representative, the Supervisory Authority of Ireland, consistent with the choice of law in §10.2. Storm OS has not appointed an Article 27 representative, on the basis that it markets the Service in the United States only, quotes prices solely in US dollars, and offers the Service solely in English. It will appoint one and update this Annex before actively marketing to the EU or UK.

Annex II: Technical and organizational measures

Storm OS maintains the following measures. Detail is current as at the effective date and may be updated under §6.2.

Pseudonymization and encryption

• TLS 1.2 or higher for all data in transit, with HSTS enforced on storm-os.app and its subdomains
• Encryption at rest at the storage layer for the Postgres database, blob storage, and backups
• Passwords hashed with Argon2id and a minimum strength requirement; passwords never stored or logged in recoverable form
• Attachments and export bundles stored privately and served only through short-lived signed URLs; no publicly addressable object storage

Confidentiality and access control

• Multi-tenant isolation: every tenant row carries a workspace identifier; Postgres row-level security is applied as defense in depth; cross-tenant access is covered by a fail-closed test in continuous integration
• A single server-side authorization module resolves access on every read and write, and the same module trims list, search, report, and offline-sync results, so clients never receive records they are not entitled to
• Capability roles (Admin, Manager, Member, Read-Only) combined with per-object access defaults, admin sharing rules, and per-record shares, all configurable by Customer
• Short-lived access tokens plus rotating refresh tokens stored in httpOnly, Secure, SameSite=Lax cookies, never readable by client-side script; refresh-token reuse detection invalidates the entire session family
• Optional TOTP multi-factor authentication per user; Workspace-wide MFA enforcement available to Customer administrators
• Per-device session listing with individual and global sign-out; deactivating a member immediately revokes sessions and API access
• Least-privilege personnel access; support access to Workspace content only under the reason-gated, time-capped, dual-audited process in §5.3
• Brute-force protection with per-account and per-IP throttling and progressive delays

Integrity

• Append-only audit logging of authentication, membership, role, permission and sharing changes, schema changes, merges, deletions, purges and restores, imports and undo, exports, branding changes, and support sessions, retained 400 days and exportable by Customer administrators
• Idempotency keys on unsafe endpoints and per-mutation identifiers on offline sync, preventing duplicate application of retried writes
• Field-level conflict detection with explicit user resolution for concurrent offline edits
• Soft deletion with a 30-day Recycle Bin; merges reversible for 7 days; imports undoable for 7 days, keeping any field edited since the import
• Schema-level input validation on every API payload

Availability and resilience

• Serverless architecture with automatic scaling and no single points of manual intervention
• Managed database with point-in-time recovery and automated backups
• Documented disaster recovery procedure with restore drills and recorded RTO/RPO targets
• Error monitoring, function error-rate dashboards, dead-letter queue with retry for background jobs

Testing and assurance

• Automated unit, integration, and end-to-end test suites gating every deployment, including negative authorization tests on every endpoint
• Dependency vulnerability scanning
• Automated unit, integration, and end-to-end test suites gating every deployment, including denied-path authorization tests on every endpoint, with severity-1 and severity-2 findings remediated before release. Storm OS has not yet commissioned an independent third-party penetration test; it will update this Annex and notify Customers when one is completed

Device and endpoint measures (Progressive Web App)

• Offline data scoped to the signed-in user and Workspace, and wiped on sign-out
• Authentication never stored in JavaScript-readable browser storage
• Optional app lock requiring re-authentication after inactivity
• Remote session revocation honored on the device's next connection
• Attachment binaries not stored offline

Organizational measures

• Written confidentiality obligations for all personnel with access
• Data protection and security awareness training
• Documented incident response procedure with defined notification timelines
• Subprocessor due diligence and contractual flow-down of these obligations, except as §7.3 describes
• Development and testing against synthetic seed data

Measures for transfers

• The government-request handling process in §10.6
• Storm OS does not currently publish a periodic transparency report. It will notify affected Customers of compelled disclosures directly, as set out in §10.6

Annex III: Subprocessors

Used for every Workspace

Used only when a Workspace turns a feature on

Nothing is sent to these Subprocessors until a Workspace Admin turns the assistant on. The three data providers are used only when a Workspace Admin has also allowed web research and an Authorized User runs research on a record or a saved list.

Anthropic publishes its own subprocessors, including any provider behind its web search, at https://www.anthropic.com/subprocessors.

Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations under §9 of the Terms. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it and on the Workspace's instruction, and none of them is a Storm OS Subprocessor. With a Workspace's own Anthropic key, two things still run on Storm OS's accounts: the background reading of documents already filed on people, companies and deals, which uses Storm OS's Anthropic account, and a research run's calls to the data providers above.

The current list is maintained at https://storm-os.app/subprocessors.

Annex IV: UK International Data Transfer Addendum

Completed in accordance with the UK Addendum (version B1.0).

Table 1: Parties. As set out in Annex I(A). Start date: the date Customer accepted the Agreement.

Table 2: Selected SCCs, Modules and Selected Clauses. The SCCs as incorporated by §10.2 of this DPA, including the modules and optional clauses selected there, and Annexes I to III as populated by this DPA.

Table 3: Appendix Information.

• Annex 1A (List of Parties): Annex I(A) of this DPA
• Annex 1B (Description of Transfer): Annex I(B) of this DPA
• Annex II (Technical and organisational measures): Annex II of this DPA
• Annex III (List of Sub processors): Annex III of this DPA

Table 4: Ending the Addendum when the Approved Addendum Changes. Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.

Acceptance

This DPA is accepted by Customer on acceptance of the Agreement and requires no signature. A countersigned PDF is available on request at legal@storm-os.com.

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
privacy@storm-os.com · security@storm-os.com · legal@storm-os.com

Effective date: September 11, 2026
Last updated: September 11, 2026
Version: 1.1

1. Agreement to these Terms

These Terms of Service ("Terms") are a binding agreement between On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS ("Storm OS," "we," "us"), and the person or organization that creates a Workspace or uses the Service ("you," "Customer").

The "Service" means the Storm OS marketing site at storm-os.com, the Storm OS application at storm-os.app (including its installable Progressive Web App), our APIs, and any related support and documentation.

By creating an account, accepting an invitation to a Workspace, installing the app, or otherwise using the Service, you agree to these Terms. If you do not agree, do not use the Service.

If you accept these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" means that entity.

The "Early Access Period" runs from August 1, 2026 through December 31, 2026. Storm OS is in early access during that time, and the third party services it runs on are still being selected, configured and tuned. Where these Terms, the Privacy Policy or the Data Processing Addendum promise a period of notice before a change takes effect, that period does not apply during the Early Access Period. We still tell you what changed and when, as soon as we reasonably can, and every right you have to object, to terminate or to export your data is unchanged. From January 1, 2027 those notice periods apply in full.

2. What Storm OS is (and is not)

Storm OS is relationship and pipeline management software for founders and small startup teams. It helps you track customers, investors, and partners in one place: records, pipelines, tasks, notes, and reporting.

Storm OS is a software tool. It is not a broker-dealer, investment adviser, placement agent, law firm, accounting firm, or fundraising intermediary, and nothing in the Service is legal, tax, accounting, investment, or fundraising advice. Nothing in the Service constitutes an offer or solicitation to buy or sell securities. You are solely responsible for your fundraising, sales, and partnership activities and for complying with the laws that govern them.

3. Definitions

4. Accounts, eligibility, and sign-in

4.1 Eligibility. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account. The Service is intended for business use and is not directed to children.

4.2 Account security. You are responsible for safeguarding credentials and for all activity under your account. Enable multi-factor authentication where offered. Notify us promptly at security@storm-os.com if you suspect unauthorized access.

4.3 Sign-in with Google. You may sign in using a Google Account. If you do:

• Your use of those identity providers remains governed by their own terms and privacy policies. We are not responsible for their services.
• We request only the minimum identity information needed to authenticate you and create your profile: your unique identifier, email address, basic profile name, and where available your profile picture. We do not request access to your Gmail, calendar, files, or contacts as part of sign-in.
• If we later offer features that require additional permissions, we will ask you to authorize those permissions separately, describe what they do at the point of consent, and let you decline without losing access to sign-in.
• You may disconnect Storm OS at any time from your Google Account permissions page. Disconnecting removes our ability to authenticate you via Google; it does not by itself delete your Workspace or Customer Data (see §14).
• If we add further sign-in providers, we will update these Terms and the Privacy Policy before that option becomes available to you.

4.4 Invitations and membership. Workspace Admins may invite, deactivate, and change the roles of Authorized Users. If you join a Workspace created by someone else, you understand that the Workspace's owner controls that Workspace, including its data, permissions, and continued existence, and may remove your access at any time.

5. Your data, your ownership

5.1 Ownership. As between you and Storm OS, you own all Customer Data. We claim no ownership rights in it.

5.2 Limited license to us. You grant us a worldwide, non-exclusive, royalty-free license to host, store, transmit, copy, index, display, back up, and otherwise process Customer Data solely to: (a) provide, secure, and maintain the Service for you; (b) prevent or address technical problems, abuse, or security incidents; and (c) comply with law. This license ends when the Customer Data is deleted, except for backups pending expiry.

5.3 What we will not do. We will not sell, rent, or license Customer Data. We will not use Customer Data to serve advertising. We will not use Customer Data to train machine-learning or generative AI models, whether our own or a third party's.

5.4 Who can access Customer Data. Access is limited to: (a) Authorized Users of the Workspace, as governed by that Workspace's permission and sharing settings; (b) Integrations that you or a Workspace Admin explicitly connect; (c) our infrastructure subprocessors, which process data on our instructions and have no independent right to use it; and (d) a small number of Storm OS personnel under the narrow, audited circumstances described in our Privacy Policy (support you request, and investigation of security or availability incidents). We do not browse Workspaces.

5.5 Your responsibility for the data you upload. Storm OS is a relationship tool, which means you will store information about third parties such as prospects, investors, partners, and their staff. You represent that you have a lawful basis to collect and process that information, that you will honor applicable notice and rights obligations toward those individuals, and that you will not upload information you are not permitted to hold. For personal data subject to the GDPR, UK GDPR, or similar laws, you are the controller and we act as your processor (see §6).

5.6 Sensitive data. Do not upload government identification numbers, payment card numbers, health records, precise biometric data, or information subject to sector-specific regimes such as HIPAA, PCI-DSS, GLBA, FERPA, or ITAR/EAR-controlled technical data. The Service is not designed for those categories and we disclaim liability arising from them.

6. Data protection roles

For Customer Data, you are the controller (or business) and we are the processor (or service provider). Our DATA PROCESSING ADDENDUM ("DPA") governs that processing, including subprocessors, security measures, international transfer mechanisms, breach notification, and assistance with data-subject requests. The DPA is incorporated into these Terms by reference and applies automatically where required by law. For Account Data and for our own operational and security telemetry, we act as a controller; see the Privacy Policy.

7. Acceptable use

You will not, and will not permit anyone to:

1. Use the Service in violation of any law, including data protection, anti-spam (CAN-SPAM, CASL, PECR, GDPR Art. 6/21), securities, sanctions, or export control laws.
2. Upload or transmit malware, or attempt to gain unauthorized access to the Service, other Workspaces, or any system or data you are not permitted to access.
3. Probe, scan, or load-test the Service, or conduct penetration testing, without our prior written permission (request at security@storm-os.com).
4. Reverse engineer, decompile, or attempt to derive source code, except to the extent that restriction is unenforceable by law.
5. Resell, sublicense, or provide the Service as a service bureau to third parties, or build a competing product using our confidential information.
6. Scrape or use automated means to extract data from the Service other than through our documented API and within published rate limits.
7. Circumvent usage limits, rate limits, or access controls.
8. Upload content that is unlawful, infringing, defamatory, harassing, or that you lack the right to store.
9. Use the Service to send unsolicited bulk communications, or to build or enrich contact lists in ways that violate applicable law.
10. Misrepresent your identity or affiliation, including in Workspace invitations.

We may suspend access without notice if we reasonably believe conduct threatens the security, integrity, or availability of the Service or another customer's data. We will restore access promptly once the risk is resolved.

7.1 Marketing sending. Marketing sending is available to a Workspace once it has verified a sending domain. If you use it to send marketing email to your own contacts, you warrant that you have valid consent, under CAN-SPAM, CASL, PECR, GDPR, and other applicable law, for every recipient on every list you use, and you will not use a purchased or scraped list. We may pause a send in progress or block a Workspace from sending if it crosses our deliverability thresholds for bounce or spam-complaint rates, and will restore it once the underlying list is fixed. The attribution line naming Storm OS in a message sent through the Service may be removed only by a Workspace Admin.

8. Progressive Web App and offline use

Storm OS is installable as a Progressive Web App and caches a working subset of your Workspace on your device so it works offline.

• Cached data is scoped to the signed-in user and Workspace and is cleared when you sign out.
• Your operating system or browser may evict cached data without warning. Cached data is not a backup.
• Changes made offline are queued locally and applied when connectivity returns. Where two people edited the same record, the app will surface a conflict for you to resolve. You are responsible for reviewing and resolving conflicts.
• Device-level security is your responsibility: use a device passcode, and use the in-app lock and remote sign-out features if a device is lost.

9. Integrations and third-party services

You may connect Integrations to a Workspace. When you do, you authorize us to exchange the data necessary for that Integration to function. Integrations are provided by third parties under their own terms; we do not control them, do not warrant them, and are not liable for their acts or omissions, including their handling of data you direct us to send them. Disconnecting an Integration stops future exchange but does not retrieve data already shared.

10. Beta and early-access features

We may label features "beta," "preview," or "early access." Those features are provided as-is, may change or be withdrawn without notice, may be less reliable, and are excluded from any service commitments. Do not rely on them for business-critical processes.

11. Fees, plans, and trials

Current plans and prices are published at https://storm-os.app/pricing. In summary:

• Storm Eye, the core relationship and pipeline module, is licensed per Workspace in a bundle that includes 5 users, at US$19 per month billed annually or US$24 per month billed monthly.
• Additional users beyond the included 5 are US$4 per user per month billed annually or US$5 per user per month billed monthly.
• Storm Project, Storm Marketing, and Storm Finance are optional modules licensed in blocks of 5 users at US$9 per block per month billed annually or US$12 per block per month billed monthly. Module blocks are allocated at the Workspace level and must cover every licensed Storm Eye user. A Workspace with 6 Storm Eye users therefore requires 2 blocks of any module it enables. Per-user module allocation is not offered.
• Early access accounts receive Storm Project, Storm Marketing, and Storm Finance at no charge for 12 months from the date the Workspace is created. At the end of that period those modules will be disabled unless you choose to license them. We will notify Workspace Admins by email at least 30 days before the promotional period ends, stating what will change and what it will cost. We will not begin charging you for a module you have not affirmatively chosen to license.
• AI allocations. Some plans include an allowance of AI-assisted features. These allowances are still being finalized and are subject to change.

All prices are in US dollars, which is currently the only supported billing currency.

AI-assisted features. While the Service is in early access we may introduce, adjust, meter, or withdraw AI allowances, and may change how AI usage is measured. Where a change would reduce an allowance included in a plan you are already paying for, we will give at least 30 days' notice by email to Workspace Admins, and you may terminate and export your data under §14.4 if you object. Some AI-assisted features may be offered as beta features under §10.

AI output can be inaccurate, incomplete, or unsuitable for your situation. You are responsible for reviewing it before acting on it, and §2 applies to anything it produces. Our commitment in §5.3 applies in full to these features: we will not use Customer Data to train machine-learning or generative AI models, and any third-party model provider we use to deliver them is contractually prohibited from training on, retaining, or otherwise using data we send on your behalf.

Where fees apply: fees are stated in the applicable plan or order, are payable in advance, are billed to the payment method on file through our payment processor, are non-refundable except where required by law, and exclude taxes, which you are responsible for. We may change pricing on 30 days' notice effective at your next renewal. Non-payment may result in suspension after notice and a reasonable cure period. If we offer a free tier or trial, we may change or discontinue it at any time on reasonable notice.

12. Intellectual property; feedback

We and our licensors own the Service and all software, design, documentation, trademarks, and content within it, excluding Customer Data. We grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription, for your internal business purposes, subject to these Terms.

If you send us feedback, ideas, or suggestions, you grant us a perpetual, irrevocable, royalty-free license to use them without obligation to you. We will not identify you as the source without your permission.

13. Confidentiality

Each party may receive the other's non-public information. The receiving party will protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisors who need it and are bound by confidentiality. This does not apply to information that is public through no fault of the receiver, independently developed, or lawfully received from a third party. Compelled disclosure is permitted with prompt notice where legally allowed. Customer Data is your Confidential Information.

14. Term, termination, export, and deletion

14.1 Term. These Terms apply from your first use until terminated.

14.2 Termination by you. You may stop using the Service and delete your Workspace at any time from the Workspace Admin console.

14.3 Termination by us. We may terminate or suspend for material breach that remains uncured 10 days after notice, for non-payment, for conduct posing legal or security risk, or if we discontinue the Service (with at least 60 days' notice, and a pro-rata refund of prepaid unused fees).

14.4 Export window. For 30 days after termination, you may export your Customer Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships. Data portability is included in every plan.

14.5 Deletion. After the export window, we will delete Customer Data from active systems within 30 days and from backups within our normal backup expiry cycle (currently 35 days), except where retention is required by law. Deletion of individual records inside the Service follows the in-product lifecycle: soft delete, Recycle Bin restore for 30 days, then purge.

14.6 Survival. Sections 5.1, 12, 13, 15, 16, 17, 18, and 20 survive termination.

15. Disclaimers

Except as expressly stated in these Terms and to the fullest extent permitted by law, the Service is provided "as is" and "as available." We disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, error-free, or that it will meet your requirements, and we do not warrant results obtained from the Service, including scores, forecasts, or reports, which are indicative only. Some jurisdictions do not allow certain disclaimers; those disclaimers apply only to the extent permitted.

16. Limitation of liability

To the fullest extent permitted by law:

• Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid or owed to us in the 12 months before the event giving rise to the claim, or (b) US$100.
• These limits do not apply to: your breach of §7 (Acceptable Use), either party's indemnity obligations, your payment obligations, or liability that cannot be limited by law (including, in some jurisdictions, gross negligence, willful misconduct, death, or personal injury).

Nothing in these Terms limits rights that consumers or others have under mandatory local law.

17. Indemnification

17.1 By you. You will defend and indemnify us against third-party claims arising from Customer Data, your use of the Service in breach of these Terms or applicable law, or your infringement of a third party's rights.

17.2 By us. We will defend and indemnify you against third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a US patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Our obligation does not apply to claims arising from Customer Data, combination with items not supplied by us, or use of beta features. We may procure the right to continue, modify the Service, or terminate and refund prepaid unused fees.

17.3 Process. The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and provide reasonable cooperation.

18. Governing law and disputes

These Terms are governed by the laws of the Commonwealth of Pennsylvania, USA, without regard to conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Before filing a claim, the parties will attempt in good faith to resolve the dispute by notice to legal@storm-os.com and 30 days of discussion. Any unresolved dispute will be brought exclusively in the state or federal courts located in Allegheny County, Pennsylvania, and both parties consent to that jurisdiction and venue. Either party may seek injunctive relief in any court to protect intellectual property or confidential information.

If you are a consumer in the EU, UK, or another jurisdiction with mandatory local protections, nothing here deprives you of the right to bring proceedings in your home courts under local law.

19. Export controls and sanctions

You represent that you are not located in, ordinarily resident in, or organized under the laws of a country or region subject to comprehensive US sanctions, and that you are not on any US, UK, or EU restricted-party list. You will not use or export the Service in violation of US export control or sanctions laws.

20. General

20.1 Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email to Workspace Admins and by an in-app notice, and the change takes effect at the end of that period. Continued use after the effective date means acceptance. If you object, you may terminate and export your data under §14.4.

During the Early Access Period defined in §1, the 30 day period above does not apply. We will still tell Workspace Admins by email what changed, as soon as we reasonably can, and the change takes effect on the date the notice gives. Your right to object, to terminate and to export your data under §14.4 is unchanged. From January 1, 2027 the 30 day period applies in full.

20.2 Changes to the Service. We improve the Service continuously. We will not materially reduce core functionality without reasonable notice.

20.3 Assignment. You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets with notice to us. We may assign to an affiliate or successor.

20.4 Entire agreement. These Terms, the Privacy Policy, and the DPA are the entire agreement and supersede prior discussions. Terms on a purchase order or vendor portal have no effect.

20.5 Severability and waiver. If a provision is unenforceable, the rest remains in effect. A failure to enforce is not a waiver.

20.6 Force majeure. Neither party is liable for delays caused by events beyond reasonable control, excluding payment obligations.

20.7 Independent contractors. No agency, partnership, joint venture, or employment relationship is created.

20.8 Publicity. We will not use your name or logo publicly without your prior written consent.

21. Contact

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
General: hello@storm-os.com · Legal: legal@storm-os.com · Security: security@storm-os.com · Privacy: privacy@storm-os.com

Effective date: September 11, 2026
Last updated: September 11, 2026
Version: 1.1

The short version

• Your Workspace data is yours. We hold it only to run the product for you.
• We do not sell or share your data, we do not serve ads, and we do not use your data to train AI models.
• We ask for the minimum from Google: sign-in identity only. We do not read your mailbox, calendar, files, or contacts.
• We do not browse your Workspace. Storm OS personnel access Workspace content only when you ask us to for support, or when we must to fix a security or availability incident. Every such session is logged, time-limited, and visible to your Workspace Admins.
• You can export everything and delete everything, at any time.

The rest of this policy is the detail behind those statements.

1. Who we are and what this covers

On-Call CMO, doing business as Storm OS ("Storm OS," "we," "us"), 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA, operates the Storm OS marketing site (storm-os.com) and the Storm OS application (storm-os.app), an installable Progressive Web App for managing customer, investor, and partner relationships.

This policy explains what personal data we handle, why, and what rights you have. It applies to visitors to our site, people who create or join a Workspace, and individuals whose information appears inside a customer's Workspace.

Two different roles. This distinction determines who you should contact about your data:

If your details appear in someone's Storm OS Workspace and you want them corrected or removed, contact that organization directly. If you contact us instead, we will forward your request to the relevant customer and, where the law requires, assist them in responding. See §12.

2. What we collect

2.1 Data you give us

2.2 Data we collect automatically

We do not use advertising cookies, third-party trackers, or cross-site tracking pixels in the application. The application sets only strictly necessary cookies: httpOnly, Secure, SameSite=Lax authentication cookies that keep you signed in. Because they are strictly necessary, no consent banner is required for them; if we ever add non-essential cookies to the marketing site, we will ask for consent first where the law requires it.

Marketing email a Workspace sends to its own contacts is a different case. When a Workspace turns tracking on for a send, that message carries an open pixel and links rewritten through go.storm-os.app, or through a hostname on that Workspace's own domain, beside its sending domain, once the Workspace has published the record for one, to record opens and clicks for that Workspace's own reporting. The unsubscribe address in the message header always stays on go.storm-os.app, so unsubscribing keeps working even if the Workspace's own hostname stops. Tracking is the Workspace's choice, set per send and per sending domain, and it never applies to the application itself.

2.3 Data from third parties

• Identity provider (Google): see §3.
• Payment processor: subscription status and payment outcomes. Card numbers never reach our servers.
• Data you import: CSV/XLSX files you upload, and information from Integrations you connect. We do not buy contact lists or enrichment data, and we do not append third-party data to your records without you asking for it.

3. Signing in with Google

Storm OS offers "Sign in with Google" so you don't need another password. This section is the full disclosure of what that involves. Google is currently our only third-party sign-in provider. If we add another, we will update this policy before that option becomes available to you.

3.1 What we request

We request identity scopes only:

We neither request nor can access your Gmail mailbox, your Google Calendar, your Drive files, or your Google Contacts. No message content, no attachments, no meeting data.

3.2 What we do with it

We use this information solely to: authenticate you; create or match your Storm OS account; populate your display name and avatar; and send you transactional email at the address on file. We store the provider's unique identifier, your email address, your display name, and your avatar URL. We do not store tokens beyond what is needed to complete sign-in, and we do not use provider data for advertising, profiling, or model training.

3.3 Google API Services User Data Policy and Limited Use

Storm OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Storm OS interface;
• Do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit prior consent;
• Do not use Google user data for serving advertisements of any kind, including retargeting, personalized, or interest-based advertising;
• Do not sell Google user data; and
• Do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.

3.4 If we ever need more

Automatic email capture is on our roadmap. If we build it, mailbox access will be a separate, optional, clearly explained authorization that you can decline while continuing to use sign-in normally. Adding those permissions would require a new consent prompt from Google, so access cannot expand silently. We will update this policy and notify Workspace Admins before any such feature launches.

3.5 Revoking access

You can disconnect Storm OS at any time:

• Google: myaccount.google.com/permissions

Revoking stops us from authenticating you through Google. It does not delete your Workspace; to delete data, see §11.

4. Why we use your data, and our legal bases

5. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding 12 months.
• We do not serve advertising in Storm OS, and we do not let anyone pay to influence what you see.
• We do not use Customer Data to train, fine-tune, or evaluate machine-learning or generative AI models, ours or anyone else's.
• We do not disclose Customer Data to third parties except as described in §7.

6. Who can access Workspace data

This is the part most people actually want answered, so here it is plainly.

Access is limited to:

1. Authorized Users of your Workspace. What each one sees is governed by your Workspace's org-wide defaults, ownership, admin sharing rules, and individual record shares. Every record has an access explainer showing who can see it and why. Workspace Admins have full access to Workspace content by design, and their actions are audited.
2. Integrations you connect. Only the data required for that integration, only after a Workspace Admin authorizes it, and only for as long as it stays connected.
3. Our subprocessors (§8). They process data on our documented instructions, under contract, with no right to use it for their own purposes.
4. Storm OS personnel, narrowly and on the record. We do not browse Workspaces and we have no general-purpose window into your data. Our staff may access Workspace content only in these situations:

• You ask us to. Support may start a time-limited session acting as your user to reproduce a problem. Every session requires a stated reason, is capped at 60 minutes, displays a persistent banner in the app, is recorded in our platform audit log, and appears in your own Workspace audit log so your admins can see exactly who accessed what, when, and why.
• Security or availability incidents. Where we must investigate abuse, a breach, data corruption, or a serious outage, access is limited to what the investigation requires, is role-restricted, and is audited the same way.
• Legal compulsion. See §7.

Support sessions cannot change your password or email address, and cannot export your data, unless the operator holds an explicitly elevated support permission. Routine engineering does not use production Workspace data; development and testing run against synthetic seed data.

These limits are enforced technically as well as contractually: every row in our database carries a workspace identifier, Postgres row-level security is applied as defense in depth, access is resolved server-side by a single authorization module on every read and write, and audit writes are append-only.

7. When we disclose data

We disclose personal data only:

• To subprocessors who help us run the Service (§8).
• At your direction: to Integrations you connect, or to recipients you share with.
• For legal reasons: to comply with a valid legal process, or to protect the rights, safety, or property of Storm OS, our customers, or the public. Where we are legally permitted, we will notify the affected customer before disclosing Customer Data so they can seek protective relief. We will push back on requests that are overbroad or defective.
• In a business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, data may transfer to the successor, which will remain bound by this policy or give notice before any material change. Google user data would transfer only with the affected user's explicit prior consent (§3.3).

8. Subprocessors

We use a small number of vendors to operate the Service. Current subprocessors:

We maintain the current list at [https://storm-os.app/subprocessors] and will give Workspace Admins at least 30 days' notice before adding a new subprocessor that processes Customer Data, with an opportunity to object.

During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), that 30 day period does not apply, because the third party services we run on are still being selected and configured. We will tell Workspace Admins by email as soon as we reasonably can and update the subprocessors page, and the opportunity to object is unchanged. From January 1, 2027 the 30 day period applies in full.

9. International transfers

Storm OS is operated from the United States. Customer Data is hosted in the United States and Germany. Wherever your Workspace is hosted, our personnel, support, and administrative systems are located in the United States, so operating the Service involves processing your data in the US and in other countries whose data protection laws may differ from your own.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), executed in our Data Processing Addendum, as our primary transfer mechanism;
• supplementary technical and organizational measures, including encryption in transit and at rest, tenant isolation, least-privilege access, and a policy of challenging overbroad government requests; and
• where a subprocessor holds a valid certification, the EU-US Data Privacy Framework and its UK Extension and Swiss-US Framework, as an additional basis.

A copy of the relevant transfer mechanism is available on request at privacy@storm-os.com.

Storm OS is not currently self-certified under the EU-US Data Privacy Framework. Standard Contractual Clauses are our own transfer mechanism; the Framework is relevant only where a subprocessor is separately certified.

10. Security

We design for hard tenant isolation and least privilege. Our current measures include:

• In transit: TLS 1.2+ everywhere; HSTS.
• At rest: encryption at the storage layer for the database and blob storage.
• Credentials: passwords hashed with Argon2id with a strength requirement; passwords are never stored or logged in readable form.
• Sessions: short-lived access tokens plus rotating refresh tokens in httpOnly, Secure, SameSite=Lax cookies that are never readable by JavaScript; token-reuse detection invalidates the whole session family; per-device sign-out and "sign out everywhere."
• Multi-factor authentication: optional TOTP per user; Workspace Admins can require it for everyone.
• Tenant isolation: every row is workspace-scoped, Postgres row-level security applied as defense in depth, cross-tenant access tested in CI as a failing-closed test.
• Authorization: a single server-side module resolves access on every read and write, including search, reports, and offline sync, so clients never receive rows they aren't entitled to.
• Files: attachments and exports are stored privately and served only through short-lived signed URLs; nothing is publicly addressable.
• On your device: offline data is scoped to user and Workspace and wiped on sign-out; an optional app lock re-authenticates after inactivity; revoking a session remotely takes effect on the device's next connection.
• Operations: brute-force and rate limiting, append-only audit logging, error and performance monitoring, automated dependency vulnerability scanning, an automated test suite that gates every deployment and includes denied-path authorization tests on every endpoint, and least-privilege access for personnel bound by written confidentiality obligations. We have not yet commissioned an independent third-party penetration test. When we do, we will say so here and make the summary available to customers on request.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected Workspace Admins without undue delay and in any event within 48 hours of becoming aware, matching our contractual commitment in DPA §9, and will notify regulators and individuals where required by law. Report suspected vulnerabilities to security@storm-os.com.

11. How long we keep data

12. Your rights

If you are an Authorized User or account holder, you can view and update most of your data directly in the app: profile and preferences, active sessions and devices, notification settings, and Workspace export. For anything else, contact privacy@storm-os.com.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; obtain a portable copy; restrict or object to processing (including profiling); withdraw consent; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we do not collect it for the purposes the law targets); and appeal a refused request. We will not discriminate against you for exercising these rights.

To exercise a right, email privacy@storm-os.com. We will verify your identity by confirming control of the email address on the account, or by other proportionate means. We respond within 30 days (extendable by a further 60 where the law allows, with notice). You may use an authorized agent where the law provides for one.

If your information is in a customer's Workspace, that customer is the controller. Send your request to them. If you send it to us, we will route it to them within 10 business days and support them in responding; we will not unilaterally alter or delete their records.

Complaints. You may lodge a complaint with your local supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve it first.

EU/UK representative. Storm OS markets and sells the Service in the United States. Prices are quoted only in US dollars and the Service is offered only in English, so we do not consider ourselves to be offering goods or services to individuals in the EU or UK within the meaning of GDPR Article 3(2), and we have not appointed an Article 27 representative. If we begin actively marketing to the EU or UK, we will appoint one and update this policy before doing so.

13. Children

Storm OS is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@storm-os.com and we will delete it.

14. Automated decision-making

Storm OS computes two relationship scores: a Fit Score from criteria your Workspace Admin configures, and an Activity Score based on recency and type of interactions. Both are decision support. Each is shown with a full breakdown of how it was calculated, and can be manually overridden by your users. They are not used by us to make automated decisions producing legal or similarly significant effects about any individual.

15. Changes to this policy

We will update this policy as the product changes. For material changes we will notify Workspace Admins by email and post an in-app notice at least 30 days before the change takes effect, and update the "Last updated" date above. Where the change requires consent, we will ask for it. We keep prior versions available at [https://storm-os.app/privacy/archive].

16. Contact us

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA

Privacy: privacy@storm-os.com · Security: security@storm-os.com · Storm OS has not appointed a Data Protection Officer, as it is not required to do so under GDPR Article 37. Privacy enquiries are handled at the address above.

Effective date: September 11, 2026
Last updated: September 11, 2026
Version: 1.1

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the Storm OS Terms of Service at https://storm-os.app/terms (the "Agreement") between:

Processor / Service Provider: On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS, of 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA ("Storm OS," "we," "us"); and

Controller / Business: the customer that has accepted the Agreement ("Customer," "you").

This DPA applies where Storm OS processes Personal Data on Customer's behalf in providing the Service, and it applies automatically, with no signature required, from the date Customer accepts the Agreement. Customer may also request a countersigned copy at legal@storm-os.com.

This DPA does not apply to Account Data, security telemetry, or diagnostic data for which Storm OS acts as a controller in its own right. That processing is governed by the Privacy Policy.

2. Definitions

3. Roles of the parties

3.1 Customer is the Controller (and Business) of Customer Personal Data. Storm OS is the Processor (and Service Provider) and processes Customer Personal Data only on Customer's documented instructions.

3.2 Customer determines what Personal Data it puts into the Service, why, and who may access it. Customer is responsible for having a lawful basis for that processing, for providing any required notices to Data Subjects, and for the accuracy and legality of Customer Personal Data. This matters more than usual for a relationship management product: Customer Personal Data will typically include information about prospects, investors, partners, and their staff who have not interacted with Storm OS directly.

3.3 Where Customer is itself a processor for another controller, Customer warrants that it has authority to appoint Storm OS as a subprocessor on the terms of this DPA, and references to Customer's instructions include instructions from that controller as passed through by Customer.

3.4 For any processing outside the scope of §1, each party acts as an independent controller.

3.5 Marketing sending. Where Customer uses the Service to send marketing email to its own contacts, Customer is the Controller of the recipient list it sends to, and warrants that it holds valid consent, under applicable law, for every recipient on that list. Storm OS processes the recipient list, the message content, and the resulting engagement events as Processor, on Customer's instructions, under this DPA, once Customer's sending domain is verified.

4. Instructions

4.1 Storm OS will process Customer Personal Data only:
(a) as necessary to provide, secure, and maintain the Service under the Agreement;
(b) in accordance with Customer's further documented instructions, where those instructions are consistent with the Agreement and technically feasible; and
(c) as required by applicable law, in which case Storm OS will inform Customer of that requirement before processing unless the law prohibits it on important grounds of public interest.

4.2 The Agreement, this DPA, Customer's configuration of the Service, and Customer's use of Service features constitute Customer's complete documented instructions.

4.3 Storm OS will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until it is amended or confirmed. Storm OS may decline instructions that would require material changes to the Service or that it reasonably believes to be unlawful.

4.4 Prohibited uses. Storm OS will not:
(a) Sell or Share Customer Personal Data, as those terms are defined in the CCPA;
(b) retain, use, or disclose Customer Personal Data for any purpose other than performing the Service, including any commercial purpose of its own, except as permitted by Data Protection Laws;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Storm OS and Customer;
(d) combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interactions with a Consumer, except as permitted for a Service Provider under the CCPA; or
(e) use Customer Personal Data to train, fine-tune, benchmark, or evaluate machine-learning or generative artificial intelligence models, whether Storm OS's own or a third party's.

4.5 Storm OS certifies that it understands the restrictions in §4.4 and will comply with them.

4.6 Aggregated and deidentified data. Storm OS may create and use aggregated or deidentified data derived from operating the Service (for example, volumetric and performance statistics) for capacity planning, security, and product improvement, provided such data cannot reasonably be used to identify any Data Subject or Customer, Storm OS commits to maintaining it in deidentified form, does not attempt to reidentify it, and contractually obligates any recipient to the same.

5. Confidentiality and personnel

5.1 Storm OS will treat Customer Personal Data as Customer's Confidential Information under the Agreement.

5.2 Storm OS will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations that survive termination of employment, are trained on their data protection responsibilities, and are granted access only on a least-privilege, need-to-know basis.

5.3 Personnel access to Workspace content. Storm OS does not routinely access Customer Personal Data. Personnel may access it only:
(a) at Customer's request, to provide support, via a support session that requires a stated reason, is capped at 60 minutes, displays a persistent in-app banner to the acting user, is recorded in Storm OS's platform audit log, and is written to Customer's own Workspace audit log so Customer's administrators can see who accessed what, when, and why;
(b) as strictly necessary to investigate or remediate a security incident, data corruption, abuse, or a serious availability failure, limited to what the investigation requires and audited on the same terms; or
(c) where compelled by law, subject to §7.3.

Support sessions cannot change a user's password or email address, and cannot export Customer Data, unless the acting operator holds an explicitly elevated support permission. Development and testing are performed against synthetic seed data.

6. Security

6.1 Storm OS will implement and maintain the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

6.2 Storm OS may update those measures over time provided the overall level of protection is not materially reduced.

6.3 Customer is responsible for the security decisions within its control: configuring Workspace access defaults, sharing rules and roles; enabling and enforcing multi-factor authentication; managing membership and promptly deactivating departed users; and securing the devices on which the Progressive Web App is installed.

7. Subprocessors

7.1 General authorization. Customer grants Storm OS general authorization to engage Subprocessors, subject to this §7. The Subprocessors engaged as at the effective date are listed in Annex III and maintained at https://storm-os.app/subprocessors.

7.2 Notice and objection. Storm OS will give Customer at least 30 days' notice before adding or replacing a Subprocessor that processes Customer Personal Data, by email to Workspace Admins and by updating the subprocessors page. Customer may object on reasonable data protection grounds within that period by written notice to privacy@storm-os.com. The parties will discuss the objection in good faith; if Storm OS cannot offer a reasonable alternative, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid unused fees.

7.2.1 Early Access Period. During the Early Access Period defined in the Terms of Service (August 1, 2026 through December 31, 2026), the 30 days' notice in §7.2 does not apply, because the third party services Storm OS runs on are still being selected and configured. Storm OS will notify Customer by email as soon as reasonably practicable and update the subprocessors page. Customer's right to object under §7.2, and to terminate without penalty if Storm OS cannot offer a reasonable alternative, is unchanged. From January 1, 2027 the 30 days' notice applies in full.

7.3 Flow-down and liability. Storm OS will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each Subprocessor's performance.

7.4 Where a Subprocessor is located outside the EEA, UK, or Switzerland, Storm OS will ensure an appropriate transfer mechanism is in place under §10.

8. Data subject rights and assistance

8.1 Self-service first. The Service gives Customer the tools to respond to most Data Subject requests directly: search, record edit and delete, soft delete with a 30-day Recycle Bin, merge, and full Workspace export in CSV/JSON. Customer will use those tools where they are sufficient.

8.2 Assistance. Taking into account the nature of the processing, Storm OS will provide reasonable assistance, by appropriate technical and organizational measures and insofar as possible, to help Customer fulfil its obligations to respond to requests for access, rectification, erasure, restriction, portability, and objection.

8.3 Requests received by Storm OS. If Storm OS receives a request from a Data Subject relating to Customer Personal Data, it will not respond substantively other than to acknowledge and redirect, and will notify Customer without undue delay (and in any event within 10 business days) so Customer can respond as Controller. Storm OS will not alter or delete Customer's records in response to such a request without Customer's instruction.

8.4 Further assistance. Storm OS will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities under GDPR Articles 35 and 36, and with Customer's obligations under Articles 32 to 36 generally, taking into account the information available to Storm OS.

8.5 Assistance beyond what is reasonably required by Data Protection Laws, or that is disproportionate in scope or frequency, may be chargeable at Storm OS's then-current professional services rates, on prior notice.

9. Personal Data Breach

9.1 Storm OS will notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it, by email to Workspace Admins and the security contact on file.

9.2 The notification will include, to the extent known and as it becomes known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point for further information. Where information is not available at the time of notification, Storm OS will provide it in phases without further undue delay.

9.3 Storm OS will take reasonable steps to contain, investigate, and remediate the breach, and will preserve relevant logs and evidence.

9.4 Storm OS's notification is not an acknowledgment of fault or liability. Customer is responsible for determining whether the breach requires notification to Supervisory Authorities or Data Subjects and for making those notifications. Storm OS will not notify any Supervisory Authority or Data Subject on Customer's behalf without Customer's prior consent, except where independently required to do so by law.

9.5 Customer will keep an accurate security contact email current in the Workspace Admin console.

10. International transfers

10.1 Customer acknowledges that Storm OS is established in the United States and that provision of the Service involves transfer of Customer Personal Data to the United States and, where applicable, to Subprocessor locations identified in Annex III.

10.2 EEA transfers. Where Customer Personal Data is transferred from the EEA to a country that is not the subject of an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller;
• Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party controller;
• Clause 7 (docking clause) applies;
• Clause 9, Option 2 (general written authorization) applies, with the notice period specified in §7.2 of this DPA;
• Clause 11(a) optional language (independent dispute resolution) does not apply;
• Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• Clause 18(b): disputes will be resolved before the courts of Ireland;
• Annex I to the SCCs is populated by Annexes I(A), I(B), and I(C) of this DPA;
• Annex II to the SCCs is populated by Annex II of this DPA;
• Annex III to the SCCs (where used) is populated by Annex III of this DPA.

10.3 UK transfers. The UK Addendum is incorporated and applies to transfers from the UK, completed as set out in Annex IV.

10.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" does not limit Data Subjects in Switzerland from bringing proceedings in their place of habitual residence; and the SCCs also protect the data of legal entities until the FADP no longer extends to them.

10.5 Supplementary measures. In addition to the SCCs, Storm OS applies the measures in Annex II, including encryption in transit and at rest, tenant isolation enforced in the database layer, least-privilege and audited personnel access, and the government-request handling in §10.6, as supplementary measures supporting the transfer.

10.6 Government access requests. If Storm OS receives a legally binding request from a public authority for Customer Personal Data, it will: (a) review the request for lawfulness and challenge it where there are reasonable grounds to consider it unlawful, overbroad, or defective, seeking interim relief where appropriate; (b) disclose only the minimum data legally required; and (c) notify Customer of the request before disclosure where legally permitted, or, if prohibited, seek a waiver of the prohibition and provide such information as it is lawfully able, as promptly as possible. Storm OS will document such requests and provide the information required by Clause 15 of the SCCs.

10.7 Alternative mechanisms. If a transfer mechanism relied on here is invalidated, amended, or superseded, the parties will work in good faith to implement a valid alternative (including any successor clauses) without undue delay, and Storm OS may update this DPA accordingly on notice.

11. Audit and information rights

11.1 Storm OS will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. In the first instance this will be satisfied by: this DPA and its Annexes, the Privacy Policy, the subprocessors page, and a completed standard security questionnaire (Storm OS will use commercially reasonable efforts to complete Customer's own questionnaire once per twelve-month period).

11.2 Where the documentation in §11.1 is genuinely insufficient to demonstrate compliance, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality that does not compete with Storm OS, subject to: at least 30 days' prior written notice; no more than once per twelve-month period except following a Personal Data Breach affecting Customer or where required by a Supervisory Authority; conduct during normal business hours; a scope limited to Storm OS's processing of Customer Personal Data; and no access to other customers' data, to Storm OS's own confidential commercial information, or to production Personal Data of any kind.

11.3 Customer bears its own audit costs and will reimburse Storm OS's reasonable costs for audits beyond the first in any twelve-month period.

11.4 Where the SCCs apply, this §11 is the parties' agreed means of exercising the audit rights in Clause 8.9, without limiting those rights where they cannot be limited by law.

12. Return and deletion

12.1 On termination or expiry of the Agreement, Customer may export Customer Personal Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships, for 30 days, using the Workspace export in the Admin console.

12.2 After the export period, Storm OS will delete Customer Personal Data from active systems within 30 days, and it will age out of backups within Storm OS's rolling backup expiry cycle (currently 35 days). Storm OS will certify deletion in writing on request.

12.3 Storm OS may retain Customer Personal Data to the extent required by applicable law, and will continue to protect it under this DPA for as long as it is retained.

13. General

13.1 Order of precedence. In the event of conflict, the SCCs prevail over this DPA, and this DPA prevails over the rest of the Agreement, in each case only as to the subject matter of the conflict.

13.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws prohibit that limitation. Nothing in this §13.2 limits any Data Subject's rights under the SCCs.

13.3 Term. This DPA takes effect with the Agreement and continues until Storm OS ceases to process Customer Personal Data, at which point the obligations that by their nature should survive will do so.

13.4 Changes. Storm OS may update this DPA where required by changes in Data Protection Laws, changes to the Service, or the introduction of new transfer mechanisms, on at least 30 days' notice to Workspace Admins, provided no update materially reduces the protections afforded to Customer Personal Data.

13.5 Governing law. Except where the SCCs, UK Addendum, or Data Protection Laws require otherwise, this DPA is governed by the law and venue specified in the Agreement.

13.6 Contact. Data protection matters: privacy@storm-os.com. Security matters and incident reports: security@storm-os.com. Contractual matters: legal@storm-os.com.

Annex I(A): Parties

Data exporter (Controller / Processor): the Customer identified in the Agreement.
Contact: the Workspace Admin email address and any privacy contact designated by Customer in the Workspace Admin console.
Activities relevant to the transfer: use of the Storm OS relationship and pipeline management service.
Role: Controller (or Processor where §3.3 applies).
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Data importer (Processor): On-Call CMO d/b/a Storm OS, 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA.
Contact: privacy@storm-os.com.
Activities relevant to the transfer: hosting and operating the Storm OS application, database, file storage, transactional email, and support.
Role: Processor.
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Annex I(B): Description of processing

Categories of Data Subjects

• Customer's Authorized Users: founders, employees, contractors, advisors, and observers with Workspace access
• Customer's prospects, leads, and customers, and their employees and representatives
• Current and prospective investors, and the employees and representatives of funds and syndicates
• Partners, resellers, referrers, and their employees and representatives
• Any other individual whose details Customer chooses to record in its Workspace

Categories of Personal Data

• Identity and contact: name, job title, employer, email address, telephone number, postal or business address, social profile URLs, website and domain
• Account and authentication (Authorized Users): password hash, Google identity provider subject identifier, MFA enrolment status, session and device metadata, IP address at sign-in
• Relationship and workflow: relationship role and sub-type, engagement level, ownership, introductions and associations, pipeline and stage, opportunity value and line items, tasks, next steps, loss reasons, tags, relationship fit and activity scores
• Interaction records: notes, logged activities, meeting and call records entered by users, timeline events
• Content: attachments and documents uploaded by Authorized Users, which may contain Personal Data determined solely by Customer
• Custom fields: additional fields defined by Customer, the content of which is determined solely by Customer
• Audit: actor, timestamp, device summary, and before/after values for audited actions
• Marketing email engagement: open and click events, and the user agent and IP address at the event, for marketing email a Workspace sends to its own contacts

Sensitive data. The Service is not designed for and Customer is contractually prohibited from submitting special category data under GDPR Article 9, criminal offence data under Article 10, government identifiers, payment card numbers, health records, precise biometric data, or precise geolocation. If Customer nonetheless submits such data through free-text fields, custom fields, or attachments, Customer does so as Controller and at its own risk, and the restrictions in the Agreement apply.

Frequency of transfer: continuous, for the duration of the Agreement.

Nature of the processing: collection, recording, organization, structuring, storage, retrieval, consultation, use, indexing, deduplication and merging, scoring, synchronization to Authorized Users' devices for offline use, backup, disclosure to Authorized Users and authorized Integrations, marketing email composition, sending, and engagement tracking where a Workspace enables it, erasure, and destruction.

Purpose of the processing: providing the Storm OS relationship and pipeline management service to Customer under the Agreement, including hosting, synchronization, notification, reporting, support, security, and marketing email sent by Customer to its own contacts where Customer enables it.

Duration: for the term of the Agreement, plus the retention and deletion periods in §12 of this DPA.

Subprocessor processing: as described in Annex III, for the duration of the Agreement or until the Subprocessor is replaced.

Annex I(C): Competent Supervisory Authority

Where the data exporter is established in an EEA Member State, that Member State's Supervisory Authority.

Where the data exporter is not established in the EEA but falls within the territorial scope of the GDPR under Article 3(2) and has appointed a representative under Article 27, the Supervisory Authority of the Member State in which that representative is established.

Where the data exporter is not established in the EEA and has not appointed a representative, the Supervisory Authority of Ireland, consistent with the choice of law in §10.2. Storm OS has not appointed an Article 27 representative, on the basis that it markets the Service in the United States only, quotes prices solely in US dollars, and offers the Service solely in English. It will appoint one and update this Annex before actively marketing to the EU or UK.

Annex II: Technical and organizational measures

Storm OS maintains the following measures. Detail is current as at the effective date and may be updated under §6.2.

Pseudonymization and encryption

• TLS 1.2 or higher for all data in transit, with HSTS enforced on storm-os.app and storm-os.com
• Encryption at rest at the storage layer for the Postgres database, blob storage, and backups
• Passwords hashed with Argon2id and a minimum strength requirement; passwords never stored or logged in recoverable form
• Attachments and export bundles stored privately and served only through short-lived signed URLs; no publicly addressable object storage

Confidentiality and access control

• Multi-tenant isolation: every tenant row carries a workspace identifier; Postgres row-level security is applied as defense in depth; cross-tenant access is covered by a fail-closed test in continuous integration
• A single server-side authorization module resolves access on every read and write, and the same module trims list, search, report, and offline-sync results, so clients never receive records they are not entitled to
• Capability roles (Admin, Manager, Member, Read-Only) combined with per-object access defaults, admin sharing rules, and per-record shares, all configurable by Customer
• Short-lived access tokens plus rotating refresh tokens stored in httpOnly, Secure, SameSite=Lax cookies, never readable by client-side script; refresh-token reuse detection invalidates the entire session family
• Optional TOTP multi-factor authentication per user; Workspace-wide MFA enforcement available to Customer administrators
• Per-device session listing with individual and global sign-out; deactivating a member immediately revokes sessions and API access
• Least-privilege personnel access; support access to Workspace content only under the reason-gated, time-capped, dual-audited process in §5.3
• Brute-force protection with per-account and per-IP throttling and progressive delays

Integrity

• Append-only audit logging of authentication, membership, role, permission and sharing changes, schema changes, merges, deletions, purges and restores, imports and undo, exports, branding changes, and support sessions, retained 400 days and exportable by Customer administrators
• Idempotency keys on unsafe endpoints and per-mutation identifiers on offline sync, preventing duplicate application of retried writes
• Field-level conflict detection with explicit user resolution for concurrent offline edits
• Soft deletion with a 30-day Recycle Bin; merges reversible for 7 days; imports fully undoable for 7 days
• Schema-level input validation on every API payload

Availability and resilience

• Serverless architecture with automatic scaling and no single points of manual intervention
• Managed database with point-in-time recovery and automated backups
• Documented disaster recovery procedure with restore drills and recorded RTO/RPO targets
• Error monitoring, function error-rate dashboards, dead-letter queue with retry for background jobs

Testing and assurance

• Automated unit, integration, and end-to-end test suites gating every deployment, including negative authorization tests on every endpoint
• Dependency vulnerability scanning
• Automated unit, integration, and end-to-end test suites gating every deployment, including denied-path authorization tests on every endpoint, with severity-1 and severity-2 findings remediated before release. Storm OS has not yet commissioned an independent third-party penetration test; it will update this Annex and notify Customers when one is completed

Device and endpoint measures (Progressive Web App)

• Offline data scoped to the signed-in user and Workspace, and wiped on sign-out
• Authentication never stored in JavaScript-readable browser storage
• Optional app lock requiring re-authentication after inactivity
• Remote session revocation honored on the device's next connection
• Attachment binaries not stored offline

Organizational measures

• Written confidentiality obligations for all personnel with access
• Data protection and security awareness training
• Documented incident response procedure with defined notification timelines
• Subprocessor due diligence and contractual flow-down of these obligations
• Development and testing against synthetic seed data

Measures for transfers

• The government-request handling process in §10.6
• Storm OS does not currently publish a periodic transparency report. It will notify affected Customers of compelled disclosures directly, as set out in §10.6

Annex III: Subprocessors

The current list is maintained at https://storm-os.app/subprocessors.

Annex IV: UK International Data Transfer Addendum

Completed in accordance with the UK Addendum (version B1.0).

Table 1: Parties. As set out in Annex I(A). Start date: the date Customer accepted the Agreement.

Table 2: Selected SCCs, Modules and Selected Clauses. The SCCs as incorporated by §10.2 of this DPA, including the modules and optional clauses selected there, and Annexes I to III as populated by this DPA.

Table 3: Appendix Information.

• Annex 1A (List of Parties): Annex I(A) of this DPA
• Annex 1B (Description of Transfer): Annex I(B) of this DPA
• Annex II (Technical and organisational measures): Annex II of this DPA
• Annex III (List of Sub processors): Annex III of this DPA

Table 4: Ending the Addendum when the Approved Addendum Changes. Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.

Acceptance

This DPA is accepted by Customer on acceptance of the Agreement and requires no signature. A countersigned PDF is available on request at legal@storm-os.com.

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
privacy@storm-os.com · security@storm-os.com · legal@storm-os.com

Effective date: August 12, 2026
Last updated: August 12, 2026
Version: 1.0

1. Agreement to these Terms

These Terms of Service ("Terms") are a binding agreement between On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS ("Storm OS," "we," "us"), and the person or organization that creates a Workspace or uses the Service ("you," "Customer").

The "Service" means the Storm OS marketing site at storm-os.com, the Storm OS application at storm-os.app (including its installable Progressive Web App), our APIs, and any related support and documentation.

By creating an account, accepting an invitation to a Workspace, installing the app, or otherwise using the Service, you agree to these Terms. If you do not agree, do not use the Service.

If you accept these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" means that entity.

2. What Storm OS is (and is not)

Storm OS is relationship and pipeline management software for founders and small startup teams. It helps you track customers, investors, and partners in one place: records, pipelines, tasks, notes, and reporting.

Storm OS is a software tool. It is not a broker-dealer, investment adviser, placement agent, law firm, accounting firm, or fundraising intermediary, and nothing in the Service is legal, tax, accounting, investment, or fundraising advice. Nothing in the Service constitutes an offer or solicitation to buy or sell securities. You are solely responsible for your fundraising, sales, and partnership activities and for complying with the laws that govern them.

3. Definitions

4. Accounts, eligibility, and sign-in

4.1 Eligibility. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account. The Service is intended for business use and is not directed to children.

4.2 Account security. You are responsible for safeguarding credentials and for all activity under your account. Enable multi-factor authentication where offered. Notify us promptly at security@storm-os.com if you suspect unauthorized access.

4.3 Sign-in with Google. You may sign in using a Google Account. If you do:

• Your use of those identity providers remains governed by their own terms and privacy policies. We are not responsible for their services.
• We request only the minimum identity information needed to authenticate you and create your profile: your unique identifier, email address, basic profile name, and where available your profile picture. We do not request access to your Gmail, calendar, files, or contacts as part of sign-in.
• If we later offer features that require additional permissions, we will ask you to authorize those permissions separately, describe what they do at the point of consent, and let you decline without losing access to sign-in.
• You may disconnect Storm OS at any time from your Google Account permissions page. Disconnecting removes our ability to authenticate you via Google; it does not by itself delete your Workspace or Customer Data (see §14).
• If we add further sign-in providers, we will update these Terms and the Privacy Policy before that option becomes available to you.

4.4 Invitations and membership. Workspace Admins may invite, deactivate, and change the roles of Authorized Users. If you join a Workspace created by someone else, you understand that the Workspace's owner controls that Workspace, including its data, permissions, and continued existence, and may remove your access at any time.

5. Your data, your ownership

5.1 Ownership. As between you and Storm OS, you own all Customer Data. We claim no ownership rights in it.

5.2 Limited license to us. You grant us a worldwide, non-exclusive, royalty-free license to host, store, transmit, copy, index, display, back up, and otherwise process Customer Data solely to: (a) provide, secure, and maintain the Service for you; (b) prevent or address technical problems, abuse, or security incidents; and (c) comply with law. This license ends when the Customer Data is deleted, except for backups pending expiry.

5.3 What we will not do. We will not sell, rent, or license Customer Data. We will not use Customer Data to serve advertising. We will not use Customer Data to train machine-learning or generative AI models, whether our own or a third party's.

5.4 Who can access Customer Data. Access is limited to: (a) Authorized Users of the Workspace, as governed by that Workspace's permission and sharing settings; (b) Integrations that you or a Workspace Admin explicitly connect; (c) our infrastructure subprocessors, which process data on our instructions and have no independent right to use it; and (d) a small number of Storm OS personnel under the narrow, audited circumstances described in our Privacy Policy (support you request, and investigation of security or availability incidents). We do not browse Workspaces.

5.5 Your responsibility for the data you upload. Storm OS is a relationship tool, which means you will store information about third parties such as prospects, investors, partners, and their staff. You represent that you have a lawful basis to collect and process that information, that you will honor applicable notice and rights obligations toward those individuals, and that you will not upload information you are not permitted to hold. For personal data subject to the GDPR, UK GDPR, or similar laws, you are the controller and we act as your processor (see §6).

5.6 Sensitive data. Do not upload government identification numbers, payment card numbers, health records, precise biometric data, or information subject to sector-specific regimes such as HIPAA, PCI-DSS, GLBA, FERPA, or ITAR/EAR-controlled technical data. The Service is not designed for those categories and we disclaim liability arising from them.

6. Data protection roles

For Customer Data, you are the controller (or business) and we are the processor (or service provider). Our DATA PROCESSING ADDENDUM ("DPA") governs that processing, including subprocessors, security measures, international transfer mechanisms, breach notification, and assistance with data-subject requests. The DPA is incorporated into these Terms by reference and applies automatically where required by law. For Account Data and for our own operational and security telemetry, we act as a controller; see the Privacy Policy.

7. Acceptable use

You will not, and will not permit anyone to:

1. Use the Service in violation of any law, including data protection, anti-spam (CAN-SPAM, CASL, PECR, GDPR Art. 6/21), securities, sanctions, or export control laws.
2. Upload or transmit malware, or attempt to gain unauthorized access to the Service, other Workspaces, or any system or data you are not permitted to access.
3. Probe, scan, or load-test the Service, or conduct penetration testing, without our prior written permission (request at security@storm-os.com).
4. Reverse engineer, decompile, or attempt to derive source code, except to the extent that restriction is unenforceable by law.
5. Resell, sublicense, or provide the Service as a service bureau to third parties, or build a competing product using our confidential information.
6. Scrape or use automated means to extract data from the Service other than through our documented API and within published rate limits.
7. Circumvent usage limits, rate limits, or access controls.
8. Upload content that is unlawful, infringing, defamatory, harassing, or that you lack the right to store.
9. Use the Service to send unsolicited bulk communications, or to build or enrich contact lists in ways that violate applicable law.
10. Misrepresent your identity or affiliation, including in Workspace invitations.

We may suspend access without notice if we reasonably believe conduct threatens the security, integrity, or availability of the Service or another customer's data. We will restore access promptly once the risk is resolved.

8. Progressive Web App and offline use

Storm OS is installable as a Progressive Web App and caches a working subset of your Workspace on your device so it works offline.

• Cached data is scoped to the signed-in user and Workspace and is cleared when you sign out.
• Your operating system or browser may evict cached data without warning. Cached data is not a backup.
• Changes made offline are queued locally and applied when connectivity returns. Where two people edited the same record, the app will surface a conflict for you to resolve. You are responsible for reviewing and resolving conflicts.
• Device-level security is your responsibility: use a device passcode, and use the in-app lock and remote sign-out features if a device is lost.

9. Integrations and third-party services

You may connect Integrations to a Workspace. When you do, you authorize us to exchange the data necessary for that Integration to function. Integrations are provided by third parties under their own terms; we do not control them, do not warrant them, and are not liable for their acts or omissions, including their handling of data you direct us to send them. Disconnecting an Integration stops future exchange but does not retrieve data already shared.

10. Beta and early-access features

We may label features "beta," "preview," or "early access." Those features are provided as-is, may change or be withdrawn without notice, may be less reliable, and are excluded from any service commitments. Do not rely on them for business-critical processes.

11. Fees, plans, and trials

Current plans and prices are published at https://storm-os.app/pricing. In summary:

• Storm Eye, the core relationship and pipeline module, is licensed per Workspace in a bundle that includes 5 users, at US$19 per month billed annually or US$24 per month billed monthly.
• Additional users beyond the included 5 are US$4 per user per month billed annually or US$5 per user per month billed monthly.
• Storm Project, Storm Marketing, and Storm Finance are optional modules licensed in blocks of 5 users at US$9 per block per month billed annually or US$12 per block per month billed monthly. Module blocks are allocated at the Workspace level and must cover every licensed Storm Eye user. A Workspace with 6 Storm Eye users therefore requires 2 blocks of any module it enables. Per-user module allocation is not offered.
• Early access accounts receive Storm Project, Storm Marketing, and Storm Finance at no charge for 12 months from the date the Workspace is created. At the end of that period those modules will be disabled unless you choose to license them. We will notify Workspace Admins by email at least 30 days before the promotional period ends, stating what will change and what it will cost. We will not begin charging you for a module you have not affirmatively chosen to license.
• AI allocations. Some plans include an allowance of AI-assisted features. These allowances are still being finalized and are subject to change.

All prices are in US dollars, which is currently the only supported billing currency.

AI-assisted features. While the Service is in early access we may introduce, adjust, meter, or withdraw AI allowances, and may change how AI usage is measured. Where a change would reduce an allowance included in a plan you are already paying for, we will give at least 30 days' notice by email to Workspace Admins, and you may terminate and export your data under §14.4 if you object. Some AI-assisted features may be offered as beta features under §10.

AI output can be inaccurate, incomplete, or unsuitable for your situation. You are responsible for reviewing it before acting on it, and §2 applies to anything it produces. Our commitment in §5.3 applies in full to these features: we will not use Customer Data to train machine-learning or generative AI models, and any third-party model provider we use to deliver them is contractually prohibited from training on, retaining, or otherwise using data we send on your behalf.

Where fees apply: fees are stated in the applicable plan or order, are payable in advance, are billed to the payment method on file through our payment processor, are non-refundable except where required by law, and exclude taxes, which you are responsible for. We may change pricing on 30 days' notice effective at your next renewal. Non-payment may result in suspension after notice and a reasonable cure period. If we offer a free tier or trial, we may change or discontinue it at any time on reasonable notice.

12. Intellectual property; feedback

We and our licensors own the Service and all software, design, documentation, trademarks, and content within it, excluding Customer Data. We grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription, for your internal business purposes, subject to these Terms.

If you send us feedback, ideas, or suggestions, you grant us a perpetual, irrevocable, royalty-free license to use them without obligation to you. We will not identify you as the source without your permission.

13. Confidentiality

Each party may receive the other's non-public information. The receiving party will protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisors who need it and are bound by confidentiality. This does not apply to information that is public through no fault of the receiver, independently developed, or lawfully received from a third party. Compelled disclosure is permitted with prompt notice where legally allowed. Customer Data is your Confidential Information.

14. Term, termination, export, and deletion

14.1 Term. These Terms apply from your first use until terminated.

14.2 Termination by you. You may stop using the Service and delete your Workspace at any time from the Workspace Admin console.

14.3 Termination by us. We may terminate or suspend for material breach that remains uncured 10 days after notice, for non-payment, for conduct posing legal or security risk, or if we discontinue the Service (with at least 60 days' notice, and a pro-rata refund of prepaid unused fees).

14.4 Export window. For 30 days after termination, you may export your Customer Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships. Data portability is included in every plan.

14.5 Deletion. After the export window, we will delete Customer Data from active systems within 30 days and from backups within our normal backup expiry cycle (currently 35 days), except where retention is required by law. Deletion of individual records inside the Service follows the in-product lifecycle: soft delete, Recycle Bin restore for 30 days, then purge.

14.6 Survival. Sections 5.1, 12, 13, 15, 16, 17, 18, and 20 survive termination.

15. Disclaimers

Except as expressly stated in these Terms and to the fullest extent permitted by law, the Service is provided "as is" and "as available." We disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, error-free, or that it will meet your requirements, and we do not warrant results obtained from the Service, including scores, forecasts, or reports, which are indicative only. Some jurisdictions do not allow certain disclaimers; those disclaimers apply only to the extent permitted.

16. Limitation of liability

To the fullest extent permitted by law:

• Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid or owed to us in the 12 months before the event giving rise to the claim, or (b) US$100.
• These limits do not apply to: your breach of §7 (Acceptable Use), either party's indemnity obligations, your payment obligations, or liability that cannot be limited by law (including, in some jurisdictions, gross negligence, willful misconduct, death, or personal injury).

Nothing in these Terms limits rights that consumers or others have under mandatory local law.

17. Indemnification

17.1 By you. You will defend and indemnify us against third-party claims arising from Customer Data, your use of the Service in breach of these Terms or applicable law, or your infringement of a third party's rights.

17.2 By us. We will defend and indemnify you against third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a US patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Our obligation does not apply to claims arising from Customer Data, combination with items not supplied by us, or use of beta features. We may procure the right to continue, modify the Service, or terminate and refund prepaid unused fees.

17.3 Process. The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and provide reasonable cooperation.

18. Governing law and disputes

These Terms are governed by the laws of the Commonwealth of Pennsylvania, USA, without regard to conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Before filing a claim, the parties will attempt in good faith to resolve the dispute by notice to legal@storm-os.com and 30 days of discussion. Any unresolved dispute will be brought exclusively in the state or federal courts located in Allegheny County, Pennsylvania, and both parties consent to that jurisdiction and venue. Either party may seek injunctive relief in any court to protect intellectual property or confidential information.

If you are a consumer in the EU, UK, or another jurisdiction with mandatory local protections, nothing here deprives you of the right to bring proceedings in your home courts under local law.

19. Export controls and sanctions

You represent that you are not located in, ordinarily resident in, or organized under the laws of a country or region subject to comprehensive US sanctions, and that you are not on any US, UK, or EU restricted-party list. You will not use or export the Service in violation of US export control or sanctions laws.

20. General

20.1 Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email to Workspace Admins and by an in-app notice, and the change takes effect at the end of that period. Continued use after the effective date means acceptance. If you object, you may terminate and export your data under §14.4.

20.2 Changes to the Service. We improve the Service continuously. We will not materially reduce core functionality without reasonable notice.

20.3 Assignment. You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets with notice to us. We may assign to an affiliate or successor.

20.4 Entire agreement. These Terms, the Privacy Policy, and the DPA are the entire agreement and supersede prior discussions. Terms on a purchase order or vendor portal have no effect.

20.5 Severability and waiver. If a provision is unenforceable, the rest remains in effect. A failure to enforce is not a waiver.

20.6 Force majeure. Neither party is liable for delays caused by events beyond reasonable control, excluding payment obligations.

20.7 Independent contractors. No agency, partnership, joint venture, or employment relationship is created.

20.8 Publicity. We will not use your name or logo publicly without your prior written consent.

21. Contact

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
General: hello@storm-os.com · Legal: legal@storm-os.com · Security: security@storm-os.com · Privacy: privacy@storm-os.com

Effective date: August 12, 2026
Last updated: August 12, 2026
Version: 1.0

The short version

• Your Workspace data is yours. We hold it only to run the product for you.
• We do not sell or share your data, we do not serve ads, and we do not use your data to train AI models.
• We ask for the minimum from Google: sign-in identity only. We do not read your mailbox, calendar, files, or contacts.
• We do not browse your Workspace. Storm OS personnel access Workspace content only when you ask us to for support, or when we must to fix a security or availability incident. Every such session is logged, time-limited, and visible to your Workspace Admins.
• You can export everything and delete everything, at any time.

The rest of this policy is the detail behind those statements.

1. Who we are and what this covers

On-Call CMO, doing business as Storm OS ("Storm OS," "we," "us"), 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA, operates the Storm OS marketing site (storm-os.com) and the Storm OS application (storm-os.app), an installable Progressive Web App for managing customer, investor, and partner relationships.

This policy explains what personal data we handle, why, and what rights you have. It applies to visitors to our site, people who create or join a Workspace, and individuals whose information appears inside a customer's Workspace.

Two different roles. This distinction determines who you should contact about your data:

If your details appear in someone's Storm OS Workspace and you want them corrected or removed, contact that organization directly. If you contact us instead, we will forward your request to the relevant customer and, where the law requires, assist them in responding. See §12.

2. What we collect

2.1 Data you give us

2.2 Data we collect automatically

We do not use advertising cookies, third-party trackers, or cross-site tracking pixels in the application. The application sets only strictly necessary cookies: httpOnly, Secure, SameSite=Lax authentication cookies that keep you signed in. Because they are strictly necessary, no consent banner is required for them; if we ever add non-essential cookies to the marketing site, we will ask for consent first where the law requires it.

2.3 Data from third parties

• Identity provider (Google): see §3.
• Payment processor: subscription status and payment outcomes. Card numbers never reach our servers.
• Data you import: CSV/XLSX files you upload, and information from Integrations you connect. We do not buy contact lists or enrichment data, and we do not append third-party data to your records without you asking for it.

3. Signing in with Google

Storm OS offers "Sign in with Google" so you don't need another password. This section is the full disclosure of what that involves. Google is currently our only third-party sign-in provider. If we add another, we will update this policy before that option becomes available to you.

3.1 What we request

We request identity scopes only:

We neither request nor can access your Gmail mailbox, your Google Calendar, your Drive files, or your Google Contacts. No message content, no attachments, no meeting data.

3.2 What we do with it

We use this information solely to: authenticate you; create or match your Storm OS account; populate your display name and avatar; and send you transactional email at the address on file. We store the provider's unique identifier, your email address, your display name, and your avatar URL. We do not store tokens beyond what is needed to complete sign-in, and we do not use provider data for advertising, profiling, or model training.

3.3 Google API Services User Data Policy and Limited Use

Storm OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Storm OS interface;
• Do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit prior consent;
• Do not use Google user data for serving advertisements of any kind, including retargeting, personalized, or interest-based advertising;
• Do not sell Google user data; and
• Do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.

3.4 If we ever need more

Automatic email capture is on our roadmap. If we build it, mailbox access will be a separate, optional, clearly explained authorization that you can decline while continuing to use sign-in normally. Adding those permissions would require a new consent prompt from Google, so access cannot expand silently. We will update this policy and notify Workspace Admins before any such feature launches.

3.5 Revoking access

You can disconnect Storm OS at any time:

• Google: myaccount.google.com/permissions

Revoking stops us from authenticating you through Google. It does not delete your Workspace; to delete data, see §11.

4. Why we use your data, and our legal bases

5. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding 12 months.
• We do not serve advertising in Storm OS, and we do not let anyone pay to influence what you see.
• We do not use Customer Data to train, fine-tune, or evaluate machine-learning or generative AI models, ours or anyone else's.
• We do not disclose Customer Data to third parties except as described in §7.

6. Who can access Workspace data

This is the part most people actually want answered, so here it is plainly.

Access is limited to:

1. Authorized Users of your Workspace. What each one sees is governed by your Workspace's org-wide defaults, ownership, admin sharing rules, and individual record shares. Every record has an access explainer showing who can see it and why. Workspace Admins have full access to Workspace content by design, and their actions are audited.
2. Integrations you connect. Only the data required for that integration, only after a Workspace Admin authorizes it, and only for as long as it stays connected.
3. Our subprocessors (§8). They process data on our documented instructions, under contract, with no right to use it for their own purposes.
4. Storm OS personnel, narrowly and on the record. We do not browse Workspaces and we have no general-purpose window into your data. Our staff may access Workspace content only in these situations:

• You ask us to. Support may start a time-limited session acting as your user to reproduce a problem. Every session requires a stated reason, is capped at 60 minutes, displays a persistent banner in the app, is recorded in our platform audit log, and appears in your own Workspace audit log so your admins can see exactly who accessed what, when, and why.
• Security or availability incidents. Where we must investigate abuse, a breach, data corruption, or a serious outage, access is limited to what the investigation requires, is role-restricted, and is audited the same way.
• Legal compulsion. See §7.

Support sessions cannot change your password or email address, and cannot export your data, unless the operator holds an explicitly elevated support permission. Routine engineering does not use production Workspace data; development and testing run against synthetic seed data.

These limits are enforced technically as well as contractually: every row in our database carries a workspace identifier, Postgres row-level security is applied as defense in depth, access is resolved server-side by a single authorization module on every read and write, and audit writes are append-only.

7. When we disclose data

We disclose personal data only:

• To subprocessors who help us run the Service (§8).
• At your direction: to Integrations you connect, or to recipients you share with.
• For legal reasons: to comply with a valid legal process, or to protect the rights, safety, or property of Storm OS, our customers, or the public. Where we are legally permitted, we will notify the affected customer before disclosing Customer Data so they can seek protective relief. We will push back on requests that are overbroad or defective.
• In a business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, data may transfer to the successor, which will remain bound by this policy or give notice before any material change. Google user data would transfer only with the affected user's explicit prior consent (§3.3).

8. Subprocessors

We use a small number of vendors to operate the Service. Current subprocessors:

We maintain the current list at [https://storm-os.app/subprocessors] and will give Workspace Admins at least 30 days' notice before adding a new subprocessor that processes Customer Data, with an opportunity to object.

9. International transfers

Storm OS is operated from the United States. Customer Data is hosted in the United States and Germany. Wherever your Workspace is hosted, our personnel, support, and administrative systems are located in the United States, so operating the Service involves processing your data in the US and in other countries whose data protection laws may differ from your own.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), executed in our Data Processing Addendum, as our primary transfer mechanism;
• supplementary technical and organizational measures, including encryption in transit and at rest, tenant isolation, least-privilege access, and a policy of challenging overbroad government requests; and
• where a subprocessor holds a valid certification, the EU-US Data Privacy Framework and its UK Extension and Swiss-US Framework, as an additional basis.

A copy of the relevant transfer mechanism is available on request at privacy@storm-os.com.

Storm OS is not currently self-certified under the EU-US Data Privacy Framework. Standard Contractual Clauses are our own transfer mechanism; the Framework is relevant only where a subprocessor is separately certified.

10. Security

We design for hard tenant isolation and least privilege. Our current measures include:

• In transit: TLS 1.2+ everywhere; HSTS.
• At rest: encryption at the storage layer for the database and blob storage.
• Credentials: passwords hashed with Argon2id with a strength requirement; passwords are never stored or logged in readable form.
• Sessions: short-lived access tokens plus rotating refresh tokens in httpOnly, Secure, SameSite=Lax cookies that are never readable by JavaScript; token-reuse detection invalidates the whole session family; per-device sign-out and "sign out everywhere."
• Multi-factor authentication: optional TOTP per user; Workspace Admins can require it for everyone.
• Tenant isolation: every row is workspace-scoped, Postgres row-level security applied as defense in depth, cross-tenant access tested in CI as a failing-closed test.
• Authorization: a single server-side module resolves access on every read and write, including search, reports, and offline sync, so clients never receive rows they aren't entitled to.
• Files: attachments and exports are stored privately and served only through short-lived signed URLs; nothing is publicly addressable.
• On your device: offline data is scoped to user and Workspace and wiped on sign-out; an optional app lock re-authenticates after inactivity; revoking a session remotely takes effect on the device's next connection.
• Operations: brute-force and rate limiting, append-only audit logging, error and performance monitoring, automated dependency vulnerability scanning, an automated test suite that gates every deployment and includes denied-path authorization tests on every endpoint, and least-privilege access for personnel bound by written confidentiality obligations. We have not yet commissioned an independent third-party penetration test. When we do, we will say so here and make the summary available to customers on request.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected Workspace Admins without undue delay and in any event within 48 hours of becoming aware, matching our contractual commitment in DPA §9, and will notify regulators and individuals where required by law. Report suspected vulnerabilities to security@storm-os.com.

11. How long we keep data

12. Your rights

If you are an Authorized User or account holder, you can view and update most of your data directly in the app: profile and preferences, active sessions and devices, notification settings, and Workspace export. For anything else, contact privacy@storm-os.com.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; obtain a portable copy; restrict or object to processing (including profiling); withdraw consent; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we do not collect it for the purposes the law targets); and appeal a refused request. We will not discriminate against you for exercising these rights.

To exercise a right, email privacy@storm-os.com. We will verify your identity by confirming control of the email address on the account, or by other proportionate means. We respond within 30 days (extendable by a further 60 where the law allows, with notice). You may use an authorized agent where the law provides for one.

If your information is in a customer's Workspace, that customer is the controller. Send your request to them. If you send it to us, we will route it to them within 10 business days and support them in responding; we will not unilaterally alter or delete their records.

Complaints. You may lodge a complaint with your local supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve it first.

EU/UK representative. Storm OS markets and sells the Service in the United States. Prices are quoted only in US dollars and the Service is offered only in English, so we do not consider ourselves to be offering goods or services to individuals in the EU or UK within the meaning of GDPR Article 3(2), and we have not appointed an Article 27 representative. If we begin actively marketing to the EU or UK, we will appoint one and update this policy before doing so.

13. Children

Storm OS is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@storm-os.com and we will delete it.

14. Automated decision-making

Storm OS computes two relationship scores: a Fit Score from criteria your Workspace Admin configures, and an Activity Score based on recency and type of interactions. Both are decision support. Each is shown with a full breakdown of how it was calculated, and can be manually overridden by your users. They are not used by us to make automated decisions producing legal or similarly significant effects about any individual.

15. Changes to this policy

We will update this policy as the product changes. For material changes we will notify Workspace Admins by email and post an in-app notice at least 30 days before the change takes effect, and update the "Last updated" date above. Where the change requires consent, we will ask for it. We keep prior versions available at [https://storm-os.app/privacy/archive].

16. Contact us

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA

Privacy: privacy@storm-os.com · Security: security@storm-os.com · Storm OS has not appointed a Data Protection Officer, as it is not required to do so under GDPR Article 37. Privacy enquiries are handled at the address above.

Effective date: August 12, 2026
Last updated: August 12, 2026
Version: 1.0

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the Storm OS Terms of Service at https://storm-os.app/terms (the "Agreement") between:

Processor / Service Provider: On-Call CMO LLC, a Pennsylvania limited liability company doing business as Storm OS, of 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA ("Storm OS," "we," "us"); and

Controller / Business: the customer that has accepted the Agreement ("Customer," "you").

This DPA applies where Storm OS processes Personal Data on Customer's behalf in providing the Service, and it applies automatically, with no signature required, from the date Customer accepts the Agreement. Customer may also request a countersigned copy at legal@storm-os.com.

This DPA does not apply to Account Data, security telemetry, or diagnostic data for which Storm OS acts as a controller in its own right. That processing is governed by the Privacy Policy.

2. Definitions

3. Roles of the parties

3.1 Customer is the Controller (and Business) of Customer Personal Data. Storm OS is the Processor (and Service Provider) and processes Customer Personal Data only on Customer's documented instructions.

3.2 Customer determines what Personal Data it puts into the Service, why, and who may access it. Customer is responsible for having a lawful basis for that processing, for providing any required notices to Data Subjects, and for the accuracy and legality of Customer Personal Data. This matters more than usual for a relationship management product: Customer Personal Data will typically include information about prospects, investors, partners, and their staff who have not interacted with Storm OS directly.

3.3 Where Customer is itself a processor for another controller, Customer warrants that it has authority to appoint Storm OS as a subprocessor on the terms of this DPA, and references to Customer's instructions include instructions from that controller as passed through by Customer.

3.4 For any processing outside the scope of §1, each party acts as an independent controller.

4. Instructions

4.1 Storm OS will process Customer Personal Data only:
(a) as necessary to provide, secure, and maintain the Service under the Agreement;
(b) in accordance with Customer's further documented instructions, where those instructions are consistent with the Agreement and technically feasible; and
(c) as required by applicable law, in which case Storm OS will inform Customer of that requirement before processing unless the law prohibits it on important grounds of public interest.

4.2 The Agreement, this DPA, Customer's configuration of the Service, and Customer's use of Service features constitute Customer's complete documented instructions.

4.3 Storm OS will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until it is amended or confirmed. Storm OS may decline instructions that would require material changes to the Service or that it reasonably believes to be unlawful.

4.4 Prohibited uses. Storm OS will not:
(a) Sell or Share Customer Personal Data, as those terms are defined in the CCPA;
(b) retain, use, or disclose Customer Personal Data for any purpose other than performing the Service, including any commercial purpose of its own, except as permitted by Data Protection Laws;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Storm OS and Customer;
(d) combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interactions with a Consumer, except as permitted for a Service Provider under the CCPA; or
(e) use Customer Personal Data to train, fine-tune, benchmark, or evaluate machine-learning or generative artificial intelligence models, whether Storm OS's own or a third party's.

4.5 Storm OS certifies that it understands the restrictions in §4.4 and will comply with them.

4.6 Aggregated and deidentified data. Storm OS may create and use aggregated or deidentified data derived from operating the Service (for example, volumetric and performance statistics) for capacity planning, security, and product improvement, provided such data cannot reasonably be used to identify any Data Subject or Customer, Storm OS commits to maintaining it in deidentified form, does not attempt to reidentify it, and contractually obligates any recipient to the same.

5. Confidentiality and personnel

5.1 Storm OS will treat Customer Personal Data as Customer's Confidential Information under the Agreement.

5.2 Storm OS will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations that survive termination of employment, are trained on their data protection responsibilities, and are granted access only on a least-privilege, need-to-know basis.

5.3 Personnel access to Workspace content. Storm OS does not routinely access Customer Personal Data. Personnel may access it only:
(a) at Customer's request, to provide support, via a support session that requires a stated reason, is capped at 60 minutes, displays a persistent in-app banner to the acting user, is recorded in Storm OS's platform audit log, and is written to Customer's own Workspace audit log so Customer's administrators can see who accessed what, when, and why;
(b) as strictly necessary to investigate or remediate a security incident, data corruption, abuse, or a serious availability failure, limited to what the investigation requires and audited on the same terms; or
(c) where compelled by law, subject to §7.3.

Support sessions cannot change a user's password or email address, and cannot export Customer Data, unless the acting operator holds an explicitly elevated support permission. Development and testing are performed against synthetic seed data.

6. Security

6.1 Storm OS will implement and maintain the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

6.2 Storm OS may update those measures over time provided the overall level of protection is not materially reduced.

6.3 Customer is responsible for the security decisions within its control: configuring Workspace access defaults, sharing rules and roles; enabling and enforcing multi-factor authentication; managing membership and promptly deactivating departed users; and securing the devices on which the Progressive Web App is installed.

7. Subprocessors

7.1 General authorization. Customer grants Storm OS general authorization to engage Subprocessors, subject to this §7. The Subprocessors engaged as at the effective date are listed in Annex III and maintained at https://storm-os.app/subprocessors.

7.2 Notice and objection. Storm OS will give Customer at least 30 days' notice before adding or replacing a Subprocessor that processes Customer Personal Data, by email to Workspace Admins and by updating the subprocessors page. Customer may object on reasonable data protection grounds within that period by written notice to privacy@storm-os.com. The parties will discuss the objection in good faith; if Storm OS cannot offer a reasonable alternative, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid unused fees.

7.3 Flow-down and liability. Storm OS will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each Subprocessor's performance.

7.4 Where a Subprocessor is located outside the EEA, UK, or Switzerland, Storm OS will ensure an appropriate transfer mechanism is in place under §10.

8. Data subject rights and assistance

8.1 Self-service first. The Service gives Customer the tools to respond to most Data Subject requests directly: search, record edit and delete, soft delete with a 30-day Recycle Bin, merge, and full Workspace export in CSV/JSON. Customer will use those tools where they are sufficient.

8.2 Assistance. Taking into account the nature of the processing, Storm OS will provide reasonable assistance, by appropriate technical and organizational measures and insofar as possible, to help Customer fulfil its obligations to respond to requests for access, rectification, erasure, restriction, portability, and objection.

8.3 Requests received by Storm OS. If Storm OS receives a request from a Data Subject relating to Customer Personal Data, it will not respond substantively other than to acknowledge and redirect, and will notify Customer without undue delay (and in any event within 10 business days) so Customer can respond as Controller. Storm OS will not alter or delete Customer's records in response to such a request without Customer's instruction.

8.4 Further assistance. Storm OS will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities under GDPR Articles 35 and 36, and with Customer's obligations under Articles 32 to 36 generally, taking into account the information available to Storm OS.

8.5 Assistance beyond what is reasonably required by Data Protection Laws, or that is disproportionate in scope or frequency, may be chargeable at Storm OS's then-current professional services rates, on prior notice.

9. Personal Data Breach

9.1 Storm OS will notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it, by email to Workspace Admins and the security contact on file.

9.2 The notification will include, to the extent known and as it becomes known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point for further information. Where information is not available at the time of notification, Storm OS will provide it in phases without further undue delay.

9.3 Storm OS will take reasonable steps to contain, investigate, and remediate the breach, and will preserve relevant logs and evidence.

9.4 Storm OS's notification is not an acknowledgment of fault or liability. Customer is responsible for determining whether the breach requires notification to Supervisory Authorities or Data Subjects and for making those notifications. Storm OS will not notify any Supervisory Authority or Data Subject on Customer's behalf without Customer's prior consent, except where independently required to do so by law.

9.5 Customer will keep an accurate security contact email current in the Workspace Admin console.

10. International transfers

10.1 Customer acknowledges that Storm OS is established in the United States and that provision of the Service involves transfer of Customer Personal Data to the United States and, where applicable, to Subprocessor locations identified in Annex III.

10.2 EEA transfers. Where Customer Personal Data is transferred from the EEA to a country that is not the subject of an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller;
• Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party controller;
• Clause 7 (docking clause) applies;
• Clause 9, Option 2 (general written authorization) applies, with the notice period specified in §7.2 of this DPA;
• Clause 11(a) optional language (independent dispute resolution) does not apply;
• Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• Clause 18(b): disputes will be resolved before the courts of Ireland;
• Annex I to the SCCs is populated by Annexes I(A), I(B), and I(C) of this DPA;
• Annex II to the SCCs is populated by Annex II of this DPA;
• Annex III to the SCCs (where used) is populated by Annex III of this DPA.

10.3 UK transfers. The UK Addendum is incorporated and applies to transfers from the UK, completed as set out in Annex IV.

10.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" does not limit Data Subjects in Switzerland from bringing proceedings in their place of habitual residence; and the SCCs also protect the data of legal entities until the FADP no longer extends to them.

10.5 Supplementary measures. In addition to the SCCs, Storm OS applies the measures in Annex II, including encryption in transit and at rest, tenant isolation enforced in the database layer, least-privilege and audited personnel access, and the government-request handling in §10.6, as supplementary measures supporting the transfer.

10.6 Government access requests. If Storm OS receives a legally binding request from a public authority for Customer Personal Data, it will: (a) review the request for lawfulness and challenge it where there are reasonable grounds to consider it unlawful, overbroad, or defective, seeking interim relief where appropriate; (b) disclose only the minimum data legally required; and (c) notify Customer of the request before disclosure where legally permitted, or, if prohibited, seek a waiver of the prohibition and provide such information as it is lawfully able, as promptly as possible. Storm OS will document such requests and provide the information required by Clause 15 of the SCCs.

10.7 Alternative mechanisms. If a transfer mechanism relied on here is invalidated, amended, or superseded, the parties will work in good faith to implement a valid alternative (including any successor clauses) without undue delay, and Storm OS may update this DPA accordingly on notice.

11. Audit and information rights

11.1 Storm OS will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. In the first instance this will be satisfied by: this DPA and its Annexes, the Privacy Policy, the subprocessors page, and a completed standard security questionnaire (Storm OS will use commercially reasonable efforts to complete Customer's own questionnaire once per twelve-month period).

11.2 Where the documentation in §11.1 is genuinely insufficient to demonstrate compliance, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality that does not compete with Storm OS, subject to: at least 30 days' prior written notice; no more than once per twelve-month period except following a Personal Data Breach affecting Customer or where required by a Supervisory Authority; conduct during normal business hours; a scope limited to Storm OS's processing of Customer Personal Data; and no access to other customers' data, to Storm OS's own confidential commercial information, or to production Personal Data of any kind.

11.3 Customer bears its own audit costs and will reimburse Storm OS's reasonable costs for audits beyond the first in any twelve-month period.

11.4 Where the SCCs apply, this §11 is the parties' agreed means of exercising the audit rights in Clause 8.9, without limiting those rights where they cannot be limited by law.

12. Return and deletion

12.1 On termination or expiry of the Agreement, Customer may export Customer Personal Data in full, as a documented CSV/JSON bundle covering all objects, custom fields, and relationships, for 30 days, using the Workspace export in the Admin console.

12.2 After the export period, Storm OS will delete Customer Personal Data from active systems within 30 days, and it will age out of backups within Storm OS's rolling backup expiry cycle (currently 35 days). Storm OS will certify deletion in writing on request.

12.3 Storm OS may retain Customer Personal Data to the extent required by applicable law, and will continue to protect it under this DPA for as long as it is retained.

13. General

13.1 Order of precedence. In the event of conflict, the SCCs prevail over this DPA, and this DPA prevails over the rest of the Agreement, in each case only as to the subject matter of the conflict.

13.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws prohibit that limitation. Nothing in this §13.2 limits any Data Subject's rights under the SCCs.

13.3 Term. This DPA takes effect with the Agreement and continues until Storm OS ceases to process Customer Personal Data, at which point the obligations that by their nature should survive will do so.

13.4 Changes. Storm OS may update this DPA where required by changes in Data Protection Laws, changes to the Service, or the introduction of new transfer mechanisms, on at least 30 days' notice to Workspace Admins, provided no update materially reduces the protections afforded to Customer Personal Data.

13.5 Governing law. Except where the SCCs, UK Addendum, or Data Protection Laws require otherwise, this DPA is governed by the law and venue specified in the Agreement.

13.6 Contact. Data protection matters: privacy@storm-os.com. Security matters and incident reports: security@storm-os.com. Contractual matters: legal@storm-os.com.

Annex I(A): Parties

Data exporter (Controller / Processor): the Customer identified in the Agreement.
Contact: the Workspace Admin email address and any privacy contact designated by Customer in the Workspace Admin console.
Activities relevant to the transfer: use of the Storm OS relationship and pipeline management service.
Role: Controller (or Processor where §3.3 applies).
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Data importer (Processor): On-Call CMO d/b/a Storm OS, 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA.
Contact: privacy@storm-os.com.
Activities relevant to the transfer: hosting and operating the Storm OS application, database, file storage, transactional email, and support.
Role: Processor.
Signature and date: deemed executed on Customer's acceptance of the Agreement.

Annex I(B): Description of processing

Categories of Data Subjects

• Customer's Authorized Users: founders, employees, contractors, advisors, and observers with Workspace access
• Customer's prospects, leads, and customers, and their employees and representatives
• Current and prospective investors, and the employees and representatives of funds and syndicates
• Partners, resellers, referrers, and their employees and representatives
• Any other individual whose details Customer chooses to record in its Workspace

Categories of Personal Data

• Identity and contact: name, job title, employer, email address, telephone number, postal or business address, social profile URLs, website and domain
• Account and authentication (Authorized Users): password hash, Google identity provider subject identifier, MFA enrolment status, session and device metadata, IP address at sign-in
• Relationship and workflow: relationship role and sub-type, engagement level, ownership, introductions and associations, pipeline and stage, opportunity value and line items, tasks, next steps, loss reasons, tags, relationship fit and activity scores
• Interaction records: notes, logged activities, meeting and call records entered by users, timeline events
• Content: attachments and documents uploaded by Authorized Users, which may contain Personal Data determined solely by Customer
• Custom fields: additional fields defined by Customer, the content of which is determined solely by Customer
• Audit: actor, timestamp, device summary, and before/after values for audited actions

Sensitive data. The Service is not designed for and Customer is contractually prohibited from submitting special category data under GDPR Article 9, criminal offence data under Article 10, government identifiers, payment card numbers, health records, precise biometric data, or precise geolocation. If Customer nonetheless submits such data through free-text fields, custom fields, or attachments, Customer does so as Controller and at its own risk, and the restrictions in the Agreement apply.

Frequency of transfer: continuous, for the duration of the Agreement.

Nature of the processing: collection, recording, organization, structuring, storage, retrieval, consultation, use, indexing, deduplication and merging, scoring, synchronization to Authorized Users' devices for offline use, backup, disclosure to Authorized Users and authorized Integrations, erasure, and destruction.

Purpose of the processing: providing the Storm OS relationship and pipeline management service to Customer under the Agreement, including hosting, synchronization, notification, reporting, support, and security.

Duration: for the term of the Agreement, plus the retention and deletion periods in §12 of this DPA.

Subprocessor processing: as described in Annex III, for the duration of the Agreement or until the Subprocessor is replaced.

Annex I(C): Competent Supervisory Authority

Where the data exporter is established in an EEA Member State, that Member State's Supervisory Authority.

Where the data exporter is not established in the EEA but falls within the territorial scope of the GDPR under Article 3(2) and has appointed a representative under Article 27, the Supervisory Authority of the Member State in which that representative is established.

Where the data exporter is not established in the EEA and has not appointed a representative, the Supervisory Authority of Ireland, consistent with the choice of law in §10.2. Storm OS has not appointed an Article 27 representative, on the basis that it markets the Service in the United States only, quotes prices solely in US dollars, and offers the Service solely in English. It will appoint one and update this Annex before actively marketing to the EU or UK.

Annex II: Technical and organizational measures

Storm OS maintains the following measures. Detail is current as at the effective date and may be updated under §6.2.

Pseudonymization and encryption

• TLS 1.2 or higher for all data in transit, with HSTS enforced on storm-os.app and storm-os.com
• Encryption at rest at the storage layer for the Postgres database, blob storage, and backups
• Passwords hashed with Argon2id and a minimum strength requirement; passwords never stored or logged in recoverable form
• Attachments and export bundles stored privately and served only through short-lived signed URLs; no publicly addressable object storage

Confidentiality and access control

• Multi-tenant isolation: every tenant row carries a workspace identifier; Postgres row-level security is applied as defense in depth; cross-tenant access is covered by a fail-closed test in continuous integration
• A single server-side authorization module resolves access on every read and write, and the same module trims list, search, report, and offline-sync results, so clients never receive records they are not entitled to
• Capability roles (Admin, Manager, Member, Read-Only) combined with per-object access defaults, admin sharing rules, and per-record shares, all configurable by Customer
• Short-lived access tokens plus rotating refresh tokens stored in httpOnly, Secure, SameSite=Lax cookies, never readable by client-side script; refresh-token reuse detection invalidates the entire session family
• Optional TOTP multi-factor authentication per user; Workspace-wide MFA enforcement available to Customer administrators
• Per-device session listing with individual and global sign-out; deactivating a member immediately revokes sessions and API access
• Least-privilege personnel access; support access to Workspace content only under the reason-gated, time-capped, dual-audited process in §5.3
• Brute-force protection with per-account and per-IP throttling and progressive delays

Integrity

• Append-only audit logging of authentication, membership, role, permission and sharing changes, schema changes, merges, deletions, purges and restores, imports and undo, exports, branding changes, and support sessions, retained 400 days and exportable by Customer administrators
• Idempotency keys on unsafe endpoints and per-mutation identifiers on offline sync, preventing duplicate application of retried writes
• Field-level conflict detection with explicit user resolution for concurrent offline edits
• Soft deletion with a 30-day Recycle Bin; merges reversible for 7 days; imports fully undoable for 7 days
• Schema-level input validation on every API payload

Availability and resilience

• Serverless architecture with automatic scaling and no single points of manual intervention
• Managed database with point-in-time recovery and automated backups
• Documented disaster recovery procedure with restore drills and recorded RTO/RPO targets
• Error monitoring, function error-rate dashboards, dead-letter queue with retry for background jobs

Testing and assurance

• Automated unit, integration, and end-to-end test suites gating every deployment, including negative authorization tests on every endpoint
• Dependency vulnerability scanning
• Automated unit, integration, and end-to-end test suites gating every deployment, including denied-path authorization tests on every endpoint, with severity-1 and severity-2 findings remediated before release. Storm OS has not yet commissioned an independent third-party penetration test; it will update this Annex and notify Customers when one is completed

Device and endpoint measures (Progressive Web App)

• Offline data scoped to the signed-in user and Workspace, and wiped on sign-out
• Authentication never stored in JavaScript-readable browser storage
• Optional app lock requiring re-authentication after inactivity
• Remote session revocation honored on the device's next connection
• Attachment binaries not stored offline

Organizational measures

• Written confidentiality obligations for all personnel with access
• Data protection and security awareness training
• Documented incident response procedure with defined notification timelines
• Subprocessor due diligence and contractual flow-down of these obligations
• Development and testing against synthetic seed data

Measures for transfers

• The government-request handling process in §10.6
• Storm OS does not currently publish a periodic transparency report. It will notify affected Customers of compelled disclosures directly, as set out in §10.6

Annex III: Subprocessors

The current list is maintained at https://storm-os.app/subprocessors.

Annex IV: UK International Data Transfer Addendum

Completed in accordance with the UK Addendum (version B1.0).

Table 1: Parties. As set out in Annex I(A). Start date: the date Customer accepted the Agreement.

Table 2: Selected SCCs, Modules and Selected Clauses. The SCCs as incorporated by §10.2 of this DPA, including the modules and optional clauses selected there, and Annexes I to III as populated by this DPA.

Table 3: Appendix Information.

• Annex 1A (List of Parties): Annex I(A) of this DPA
• Annex 1B (Description of Transfer): Annex I(B) of this DPA
• Annex II (Technical and organisational measures): Annex II of this DPA
• Annex III (List of Sub processors): Annex III of this DPA

Table 4: Ending the Addendum when the Approved Addendum Changes. Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.

Acceptance

This DPA is accepted by Customer on acceptance of the Agreement and requires no signature. A countersigned PDF is available on request at legal@storm-os.com.

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA
privacy@storm-os.com · security@storm-os.com · legal@storm-os.com