ClientHub AI & Data-Processing Disclosure (Sub-Processor Addendum)

Version: 1.0 | Effective date: 2026-07-10

This AI & Data-Processing Disclosure (the "Disclosure") supplements the Profit Shapers Terms of Service and Privacy Policy and is incorporated into the Terms of Service by reference. It is intended to give organizations, their advisors, and their counsel a clear, factual account of (a) the artificial-intelligence features within ClientHub and the connected applications, (b) the categories of data those features process and where that data goes, (c) the controller/processor roles of the parties, (d) the sub-processors Profit Shapers relies on to operate the Service, and (e) the data-processing commitments Profit Shapers makes when it handles personal and business data on a Customer's behalf. It is written to function as the substantive core of a Data Processing Agreement (DPA) that an enterprise Customer's counsel may incorporate or attach. In the event of a conflict, the executed agreement between Profit Shapers and the Customer controls. Capitalized terms not defined here have the meanings given in the Terms of Service and Privacy Policy.

1. Roles of the Parties (Controller / Processor)

Customer as controller; Profit Shapers as processor. For Customer Data that an organization submits into the Service — including account records, organization and engagement data, financials and general-ledger line items, assessments, reports, and AI prompts and conversations — the organization (the "Customer") is the controller and Profit Shapers acts as a processor (service provider) that processes that data only on the Customer's documented instructions, which include these documents and the Customer's use of the Service's features.

Profit Shapers as controller. For data Profit Shapers collects for its own account administration, billing, security, fraud prevention, and product-improvement purposes — and for aggregated and de-identified data derived from Customer Data as described in the Privacy Policy — Profit Shapers is the controller.

AI providers and other sub-processors as sub-processors. Third parties that process Customer Data to help deliver the Service — including the AI model provider — act as sub-processors of Profit Shapers and are engaged under written terms consistent with this Disclosure. The current sub-processor roster is in Section 8.

This Disclosure does not change which party owns Customer Data. As stated in the Terms of Service, the Customer's organization owns its Customer Data.

2. Where AI Is Used in the Service

The Service uses large language models supplied by a third-party AI provider (currently OpenAI) to power the following features. AI requests are transmitted to the model provider through Replit's AI-integration gateway.

TerraSage AI assistant. An in-app advisory assistant offering selectable personas (Executive Advisor, Analyst, Coach, Consultant). To produce context-aware responses, TerraSage assembles an organization-context summary and sends it, together with the user's prompt and the prior messages in the conversation, to the AI provider. See Section 3 for the exact data categories. TerraSage usage is metered and may be billed (Section 5).

AI financial-report generator. On request, the Service sends an organization's recorded financial figures (income-statement and balance-sheet values across the available periods) to the AI provider to produce a narrative financial analysis report.

In-app Help assistant. A support chatbot that answers questions about how to use the platform. It receives only the text of the user's help-chat messages and a fixed product-knowledge system prompt; it is not given organization financials, assessments, or other Customer Data.

Daily Focus suggestions. A feature that suggests what a user should work on next. It sends the user's name and role, the user's list of open work items, and the catalog of the organization's enrolled applications to the AI provider to rank and label suggestions.

Human oversight. All AI features are assistive. Outputs may be inaccurate, incomplete, or unsuitable, and are not professional advice. Users are responsible for reviewing AI output before relying on or sharing it, as stated in the Terms of Service.

3. Categories of Data Sent to the AI Provider

Depending on which AI feature is used, the following categories of Customer Data may be transmitted to the AI provider:

• Prompts and conversation content. The text a user types, plus the prior messages in the same TerraSage conversation, which are sent with each new turn for continuity.

• Organization profile. Organization name, subscription plan and status, enrolled applications, industry, employee/headcount, and founded year.

• Team composition. The number of members in the organization and counts by role. Individual member names are not included in the TerraSage organization-context summary.

• Financial data. Recorded financial figures — for example revenue, cost of goods sold, gross profit, labor totals, operating expenses, operating income, EBITDA, net income, balance-sheet items (cash, debt, assets, liabilities, equity, accounts receivable, accounts payable), derived metrics such as revenue per employee, and individual general-ledger line items (account name and amount). The financial data sent to TerraSage is filtered to the categories the requesting user is permitted to see; the AI financial-report generator sends the recorded financial figures for analysis.

• Assessment activity. Counts of assessments completed, in progress, and total. The substantive content of talent assessments and individual assessment responses is stored in the platform but is not included in the TerraSage organization-context summary sent to the AI provider.

• Work-item and catalog context. For Daily Focus, the user's open work items and the enrolled-application catalog.

What is not sent. Passwords and authentication secrets, full payment-card numbers, and MFA secrets are never sent to the AI provider. Users are instructed not to paste sensitive personal data, protected health information, payment-card data, government identifiers, or third-party trade secrets into AI features.

4. Purpose & Legal Basis of AI Processing

Purpose. Customer Data is sent to the AI provider for the sole purpose of generating the requested output (advisory responses, financial-analysis narratives, help answers, or work suggestions) and returning it to the user within the Service. It is not used for advertising or sold to anyone.

Legal basis (where applicable). For personal data subject to GDPR or similar regimes, the processing is carried out to perform the contract with the Customer and in furtherance of the parties' legitimate interests in providing an AI-assisted service the Customer has chosen to use. The Customer, as controller, is responsible for establishing the lawful basis for submitting personal data about its team members and third parties into the Service.

No model training on Customer content. Profit Shapers configures the AI provider, where the option is available, so that prompts and content submitted through the Service are not used to train the provider's general-purpose foundation models. Profit Shapers does not use Customer Data to train its own models without separate, explicit consent.

5. AI Usage Metering & Billing

TerraSage AI usage is metered by counting the input (prompt) and output (response) tokens consumed by each request, as reported by the AI provider.

Metered usage accrues to a running monthly balance for the organization. Where an organization has AI billing enabled, that balance is invoiced through the Service's payment processor (Stripe) on a recurring (typically month-end) basis, and the balance resets when invoiced. A Profit Shapers super-administrator may also trigger an immediate charge or reset the running balance.

An organization may have an optional monthly AI budget cap. The AI budget cap is configured and administered by Profit Shapers at the platform level (through a Profit Shapers super-administrator) rather than by the organization. When the projected cost of a request would exceed the remaining budget, the request is declined until the next cycle or until the budget is changed by Profit Shapers.

The price per unit of usage, any platform margin applied on top of the underlying cost, and whether billing is enabled are configured per organization by Profit Shapers and are reflected in the organization's usage and billing views.

6. Storage & Retention of AI Data

Conversation storage. TerraSage conversations and their messages (both user and assistant turns) are stored in the platform's primary database so users can revisit them. A user may delete a conversation, which removes it from the active system. Token-usage records associated with a conversation are retained for billing, audit, and usage-reporting purposes.

Provider-side retention. The AI provider may retain request and response data for a limited period for abuse-monitoring and operational purposes in accordance with its own terms; Profit Shapers relies on the provider's enterprise/API data-handling commitments, including the no-training posture described in Section 4.

General retention and deletion. AI-related data follows the same retention and deletion practices described in the Privacy Policy and the Terms of Service: data is retained while the Customer's account is active or as needed to operate the Service and meet legal obligations, deleted content is removed from active systems and may persist briefly in encrypted backups before being overwritten, and Customer Data is deleted or de-identified within a commercially reasonable period after the Customer ends its relationship with Profit Shapers, except where retention is required by law.

7. Security Measures

Profit Shapers maintains technical and organizational measures designed to protect personal and business data, including: encryption of data in transit; storage of passwords only as salted hashes; mandatory multi-factor authentication (TOTP and SMS, with recovery codes and trusted-device support) with MFA secrets stored encrypted; role-based access controls and a granular runtime permission model; multi-tenant access controls separating organizations on shared infrastructure; HTTP security headers; audit logging of sensitive actions; recurring backups with an encrypted off-site mirror and point-in-time recovery; and application-level crash and error alerting.

Data-loss prevention. The Service uses soft-deletes with an administrator-accessible trash/restore interface, an audit log, scheduled backups mirrored to encrypted off-site storage, and platform-managed point-in-time recovery.

These measures are summarized for transparency; they are not a warranty that the Service is impenetrable. The detailed, current security posture and any independent attestations should be confirmed with Profit Shapers as part of a security review.

8. Sub-Processors

Profit Shapers engages the sub-processors listed below to operate the Service. Each is engaged under written terms requiring it to use the data only to provide its service to Profit Shapers and to protect it. The accompanying register enumerates each provider's purpose, the categories of data involved, and its processing location.

Changes. Profit Shapers may add or replace sub-processors as the Service evolves. Where required by an executed agreement, Profit Shapers will provide advance notice of a new sub-processor and a mechanism for the Customer to object on reasonable data-protection grounds.

Sub-processor flow-down. Profit Shapers remains responsible to the Customer for the performance of its sub-processors' obligations with respect to Customer Data.

9. International Data Transfers

Profit Shapers and its sub-processors are based in and process data in the United States. By using the Service, the Customer understands that data may be transferred to and processed in the United States and potentially other countries whose data-protection laws may differ from those of the Customer's jurisdiction.

Where personal data originating in the EEA, the UK, or Switzerland is processed, the parties will rely on an appropriate transfer mechanism (such as the Standard Contractual Clauses) as set out in the executed agreement.

10. Assisting the Customer; Data-Subject Rights

Assistance with requests. Taking into account the nature of the processing, Profit Shapers will provide reasonable assistance to enable the Customer to respond to data-subject requests (access, correction, deletion, portability, restriction, or objection) and to meet the Customer's own security, breach-notification, and data-protection-impact-assessment obligations.

Direct requests. If an individual contacts Profit Shapers directly about data held on a Customer's behalf, Profit Shapers will, where appropriate, refer the request to the relevant Customer rather than respond directly.

11. Personal-Data Breach Notification

Profit Shapers will notify the affected Customer without undue delay after becoming aware of a personal-data breach affecting that Customer's Customer Data, and will provide the information reasonably available to help the Customer meet any notification obligations it may have. The specific notification timeline and content will be governed by the executed agreement.

12. Return & Deletion on Termination

On termination or expiry of the Service, and on the Customer's request, Profit Shapers will delete or return Customer Data in accordance with the retention practices described in the Terms of Service and the Privacy Policy, except to the extent retention is required by law or for the limited backup-overwrite cycle described in Section 6. Aggregated and de-identified data derived before termination may be retained on an anonymized basis as described in the Privacy Policy.

13. Contact

Questions about this Disclosure, the AI features, or Profit Shapers' data-processing practices — or a request to execute a Data Processing Agreement — may be directed to Profit Shapers at the email address provided to your organization administrator or through the in-app help channel.

Appendix A — Sub-Processor Register

Acknowledgement

I have reviewed the ClientHub AI & Data-Processing Disclosure. I understand which AI features process organization data, the categories of data sent to the AI provider, that AI usage may be metered and billed, that AI conversations are stored and may be deleted, and the sub-processors Profit Shapers relies on to operate the Service.