WALKED · Data Processing Addendum
WALKED Data Processing Addendum (DPA)
Effective date: October 20, 2026
Version: DPA-2026-10-20-v1
This DPA is part of the WALKED Terms of Service between WALKED LLC, an Ohio limited liability company ("WALKED"), and the Customer. It applies when WALKED processes Client Data for the Customer. Client Data is personal information about the Customer's clients, homebuyers, property owners, agents and others, plus inspection findings, reports, photos and agreements.
1. Roles
The Customer is the controller (or "business") of Client Data. WALKED is the processor (or "service provider" or "contractor") and acts only on the Customer's behalf.
2. Instructions
2.1 WALKED processes Client Data only:
- to provide the Service;
- on the Customer's documented instructions, including settings the Customer chooses in the app; or
- as required by law. If the law requires processing, WALKED will tell the Customer first unless the law forbids it.
2.2 WALKED will not:
- sell Client Data;
- share it for targeted advertising;
- use it to market to anyone;
- combine it with other data except to provide the Service; or
- use it to train AI models.
2.3 WALKED will tell the Customer if it believes an instruction breaks the law.
3. Inspector-client confidentiality
3.1 Licensing rules may require the Customer to keep inspection findings and client information confidential. Ohio: findings and client information may not be disclosed without the client's prior written approval, and inspectors must take reasonable steps to safeguard them (OAC 1301:17-1-16(C)(1), (3)). There are narrow exceptions for imminent harm and court orders ((C)(2)).
3.2 To support this, the Service's default is no disclosure beyond the authorized recipients in the inspection agreement. Any other sharing needs the named client's written permission, recorded in the app. The Customer decides any safety-exception disclosure, and it is not automated.
3.3 WALKED personnel may access Client Data only as needed for support, security or legal compliance. They are bound by confidentiality obligations.
4. Security measures
WALKED keeps reasonable safeguards suited to the data, including:
- tamper-evident storage of signed agreements (document hash plus audit trail).
WALKED may update these measures as long as protection is not materially reduced.
5. Subprocessors
5.1 The Customer authorizes WALKED to use the subprocessors listed at https://trywalked.com/subprocessors/. On the effective date of this DPA, they are:
| Company | What it does for WALKED | Data |
|---|---|---|
| Cloudflare, Inc. | Hosts the website and app (Cloudflare Pages and Functions) | All traffic to the service, account data, and client data in transit |
| Cloudflare, Inc. | Database, including photo and document storage (Cloudflare D1) | Account data and client data: jobs, reports, photos, agreements, invoices, agents |
| Cloudflare, Inc. | Website traffic counts (Cloudflare Web Analytics, no cookies) and forwarding of mail sent to hello@trywalked.com | Page address, referrer, browser and device type; support email |
| Cloudflare, Inc. | Speech-to-text for voice notes recorded offline (Workers AI) | Short clips of the spoken parts of voice notes. Not stored by WALKED. Under Cloudflare's Workers AI terms at the time of writing, not used to train its models |
| Cloudflare, Inc. | Drafting report write-ups from inspector notes (Workers AI) | The words an inspector says or types for each Field item. Not stored by WALKED. Under Cloudflare's Workers AI terms at the time of writing, not used to train its models |
| Cloudflare, Inc. | Reading appliance data plates from photos (Workers AI) | Photos of an equipment data plate taken in WALKED Field. Not stored by WALKED. Under Cloudflare's Workers AI terms at the time of writing, not used to train its models |
| Google LLC | Support inbox for mail sent to hello@trywalked.com | Support emails and anything included in them |
| Stripe, Inc. | Card payment processing | Name, email, amount, invoice or job reference; card details are held by Stripe, not WALKED |
The subprocessors page is the current list. WALKED will have a written contract with each subprocessor with data-protection terms at least as protective as this DPA. WALKED remains responsible for its subprocessors.
5.2 Changes. WALKED will give at least 30 days' notice before adding or replacing a subprocessor that processes Client Data. Notice is given in the WALKED app at the Customer's next sign-in, as described on the subprocessors page, and a feature that depends on the change stays off for the Customer's account until someone on it clicks "OK, got it." The Customer may object on reasonable data-protection grounds. If it does, the parties will discuss it in good faith. If it can't be resolved, the Customer may end the affected Service and receive a pro-rated refund of prepaid fees.
6. Personal data breaches
6.1 WALKED will notify the Customer without undue delay, and no later than 72 hours after confirming a personal data breach (unauthorized access to or acquisition of Client Data).
6.2 The notice will describe, as far as known:
- what happened;
- the data and people affected;
- the steps taken; and
- a contact person.
WALKED will update the Customer as it learns more.
6.3 WALKED will reasonably help the Customer meet its own legal notice duties, such as state breach-notification laws. Unless the law requires otherwise or the parties agree, the Customer decides whether and how to notify its clients.
7. Assistance
7.1 Taking into account the nature of the processing, WALKED will provide reasonable help, through app features where possible, with:
- (a) requests from individuals to access, correct, delete or export their data;
- (b) security and data-protection assessments; and
- (c) inquiries from regulators or licensing boards about Client Data.
7.2 WALKED will provide help with a request under 7.1(a) within 10 business days of the Customer asking for it.
7.3 WALKED will forward any request it receives directly from an individual to the Customer and will not answer it except as instructed or as the law requires.
8. Deletion and return
8.1 During the subscription, the Customer can export its account data at any time in Settings › Export my data. Photos are not in the self-serve export yet; on request to hello@trywalked.com, WALKED will provide the original photos within 10 business days. The Customer can also ask hello@trywalked.com to delete Client Data.
8.2 After termination, the Customer has 90 days to export its data. Read-only access or an export file is available on request at hello@trywalked.com. WALKED will delete or return Client Data, with deletion between 90 and 120 days after termination, including from backups as they rotate. Exceptions:
- the law requires WALKED to keep it; or
- a litigation hold applies.
On request, WALKED will confirm deletion in writing.
8.3 The Customer's own record-keeping duties (for example, Ohio's 5-year record rule, ORC 4764.11(B)) are the Customer's. The Customer should export and keep its records before the 90 days end.
9. Audits and information requests
WALKED will provide information reasonably needed to show compliance with this DPA, such as security summaries, policies and subprocessor lists. It will do so in response to written requests no more than once per year, or after a personal data breach. On-site audits are not included unless the law requires them or the parties agree in writing, at the Customer's expense. Information shared is WALKED confidential information.
10. Liability, order of precedence and governing law
10.1 Liability under this DPA is subject to the limitation of liability in the Terms.
10.2 If this DPA conflicts with the Terms on Client Data, this DPA controls.
10.3 This DPA is governed by the laws of the State of Ohio, without regard to conflict-of-laws rules, and disputes go to the courts named in the Terms.
Contact: WALKED LLC, an Ohio limited liability company · hello@trywalked.com