Data Processing Addendum

1. Who does what

Your organization decides what participant information to collect and why. It is the controller of participant records, and Lift Right processes them for it as its processor.

For the account, billing and site information we use to run our own business, Lift Right is the controller, and the Privacy Policy applies.

2. What is processed, and for how long

We store, organize, show, export and delete participant records so your organization can use Lift Right for case management and grant reporting.

The records are about the people your organization serves, who may include minors. They hold the kinds of information listed under “What we collect” in the Privacy Policy.

Text an AI feature sends is processed by Anthropic, listed on the Subprocessors page, and may be processed outside the United States. A full administrator can switch each AI feature off in Settings, “AI features”.

Processing lasts as long as the agreement, and then for the export and deletion period in section 9.

3. Your instructions

We process participant records only to provide the service, on your instructions. Your instructions are the Terms, this addendum and what your users do in Lift Right. We do not alter or remove your data except as you ask or the law requires.

The one other use is de-identified and aggregated data, only as section 8 of the Terms of Service describes.

If a court or agency compels disclosure, we give you notice where the law allows, disclose only what is required and ask for confidential treatment.

4. People with access

Lift Right has no employees. The founder is the only person with administrative access to the system.

Lift Right support sees participant records only when your organization turns on “Support access”. Only your full administrator can turn it on, with a reason, for 1 hour to 7 days. Every change support makes in that window is logged. The application, not the database, records what support views. The founder also holds the database administrator credentials that running the service requires, and those sit outside these rules.

Before anyone else gets access to participant records, we bind them in writing to keep the records confidential.

5. Security

We keep the security measures stated on the Security page. Each sentence there is written from the same register of facts as this addendum.

Lift Right holds no SOC 2 report or other third-party security attestation yet.

6. Subprocessors

The companies that process customer data for Lift Right, and what each one receives, are listed on the Subprocessors page.

We email each organization’s administrators 30 days before a new subprocessor starts. An organization that objects can end its contract.

7. Requests from participants

A participant’s request about their own record goes to your organization. If one reaches us, we pass it to you within 5 business days and do not act on it ourselves.

We help you find, correct, export or delete a record to answer a request. Section 10 says what we provide for your own obligations to a funder or regulator.

8. Security incidents

If there is a security incident affecting your data, we tell you without undue delay and no later than 72 hours after confirming it, and we say what happened, what data was involved, what we have done, and what you need to do.

9. Deletion and return

You can export your data at any time, in a machine-readable format.

When the agreement ends, you have 30 days to export everything. After that we delete it, except where your own funder or a legal obligation requires a longer retention period, in which case we keep it for that period and then delete it. Backups expire on their own schedule rather than being edited.

On written request we will confirm deletion in writing, signed, stating what was deleted and when.

10. Information and audits

We give you the information you reasonably need for your funder or regulator, including a description of our controls, the subprocessor list and our incident history, and we complete your security questionnaire.

Lift Right has no premises, so there is no on-site audit.

11. Liability

Claims under this addendum are part of the agreement and subject to the limits in section 15 of the Terms of Service.

Questions about this addendum: privacy@getliftright.com

Effective November 13, 2026. Content version 2026-11-13-a.