publisher: People Data Labs, Inc. version: I-1.1.0 effective: 2026-10-20 schedule: I materiality: material changes: Adds the EU Data Processing Addendum for callers in the European Union.

Source Schedule I: Person and Company Data (People Data Labs)

Schedule version: I-1.0.0. Provider: People Data Labs, Inc., a Delaware corporation, of San Francisco, California. Provider Terms incorporated: none. You do not contract with People Data Labs; its requirements for this data, including its Acceptable Data Use Policy, are stated here in full, as its agreement with Firecrawl requires.

I.1 The data. Person records (names, job titles, employers and employment history, education, skills, certifications, work and personal email addresses, phone numbers, locations including street addresses, dates of birth, and social and professional profile links) and company records (identity, industry, size, funding, locations, workforce metrics, and job postings) delivered from the People Data Labs APIs (the "PDL Data"). Person records are personal data about identifiable people.

I.2 Approved Use. Receiving PDL Data through the Services, including through Automated Agents acting for you, to discover and enrich records for your own internal business purposes; keeping the records delivered to you; and creating analyses and insights of your own from them. Firecrawl delivers to you only records fetched for your own requests, within the yearly limit Firecrawl applies to this source.

I.3 Restrictions. You will not, and will not permit anyone acting through your account to:

(a) Resell, sublicense, distribute, or otherwise provide PDL Data, or information derived from it, to any third party.

(b) Build a product from PDL Data that resembles or competes with a People Data Labs product, or give anyone programmatic access to PDL Data in any way that would allow them access to a substantial set of its features or a material portion of it.

(c) Obtain more records in a year than the limit Firecrawl applies to this source, or use more than one account to do so.

(d) Use PDL Data for any purpose that I.4 prohibits.

(e) Use People Data Labs' trademarks, trade names, logos, or other brand features.

(f) Reverse engineer, decompile, or disassemble the systems that deliver PDL Data, or attempt to derive their source code or trade secrets.

I.4 Prohibited uses. This is People Data Labs' Acceptable Data Use Policy, which its agreement with Firecrawl requires to reach you in full. You will not use PDL Data, and will not encourage or allow anyone else to use it:

• in connection with, or in any way to encourage, any illegal, fraudulent, abusive, or similar activity;
• to promote or advertise guns, ammunition, or weapons, adult content or services, credit repair services, payday loan services, or tobacco or marijuana products, except with People Data Labs' prior signed authorization;
• to promote or advertise any product or service that violates intellectual property rights, such as the sale of counterfeit products;
• to promote particular company stock purchases;
• for any form of debt collection;
• for hard background check purposes;
• to determine eligibility for a government license or benefit;
• to re-identify pseudonymous information (such as a cookie identifier) by merging it with personally identifiable information (such as an email address);
• for any purpose prohibited by applicable data privacy and security laws, including the GDPR, the California Consumer Privacy Act, or any similar state or national law;
• to train generative AI systems or models that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of their training data;
• for the benefit of any one political candidate, political party, political campaign, or advocacy group affiliated exclusively with or formed to benefit any one of them;
• to benefit any government agency operating as an intelligence agency to support national security, military, or foreign policy objectives;
• for any evidentiary purpose related to law enforcement or criminal prosecution, such as to establish as an evidentiary matter that a particular person is associated with a particular data element, which may contain errors in accuracy, currency, or transcription (investigative, analytics, and validation purposes remain permitted);
• in connection with any purpose covered by the Fair Credit Reporting Act, the Federal Trade Commission's interpretations of it, or similar federal or state statutes, including for any purpose enumerated in the FCRA in lieu of obtaining a consumer report, or to prepare a consumer report or in a manner that may cause the data to be characterized as one.

In particular, you will not use or provide PDL Data: in connection with establishing a consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes, or in assessing risks associated with a consumer's existing credit obligations; to evaluate a consumer for employment, promotion, reassignment, or retention as an employee; for any tenancy verification or in connection with any application to rent real property; in connection with a determination of a consumer's eligibility for a license or other benefit that depends on the applicant's financial responsibility or status; as a potential investor or servicer, or current insurer, in connection with a valuation of, or assessment of credit or prepayment risks associated with, an existing credit obligation; in connection with any information, service, or product sold or delivered to a consumer that constitutes or is derived in substantial part from a consumer report; in connection with eligibility for any government benefit or service, or for any eligibility decision made by a government about assistance to natural persons for housing, food, energy, health care, licensure, education, medical costs, or any other form of government assistance or benefit; or for any other purpose under the FCRA. You will not take any adverse action, as the FCRA defines it, against any consumer based in whole or in part on PDL Data. PDL Data is not a consumer report, and People Data Labs is not a consumer reporting agency.

I.5 Your outputs. Analyses, insights, and other outputs you create from PDL Data that are new and different from the records, and not a functional equivalent of them, are yours. A copy, reformatting, summary, or repackaging of PDL Data is still PDL Data and remains subject to this Schedule.

I.6 Your own compliance and the people described. You are an independent controller of the personal data in PDL Data. You will comply with the privacy, data protection, and security laws that apply to you, including any obligations you have as a data broker, and you will keep industry-standard safeguards wherever you store PDL Data. When Firecrawl passes you an opt-out or deletion request from a person described in PDL Data, you will apply it promptly to any PDL Data you hold, and if you receive such a request yourself you will pass it to Firecrawl. You will not process or transfer PDL Data in violation of United States sanctions, export control, or restricted data-transfer laws.

I.7 What you are accepting about the data. PDL Data is provided as-is; neither People Data Labs nor Firecrawl warrants its accuracy, completeness, or fitness for any purpose. People Data Labs has committed to Firecrawl to comply with privacy law in supplying PDL Data; that commitment runs to Firecrawl, not to you. Claims arising from your use of PDL Data are your responsibility under Section 10.

I.8 End of access. When your access to this source ends, you will receive no further PDL Data. Section 7.1 applies to the PDL Data you hold; your outputs under I.5 are yours to keep.

I.9 Suspension. Firecrawl may suspend or terminate your access to PDL Data or to the Services on breach of this Schedule, including I.4, or where People Data Labs requires it, and will act on becoming aware of a material violation. This Schedule survives for as long as you hold or use PDL Data.

DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) forms part of the agreement governing Customer’s use of the Firecrawl services, including the Alexandria marketplace Firecrawl’s then-current terms of use, (the “Agreement”), and applies where Firecrawl processes Personal Data on Customer’s behalf.

1. Roles and Instructions

With respect to Personal Data submitted, provided, or otherwise made available by or on behalf of Customer to Firecrawl (“Customer Personal Data”), Customer acts as the Controller, Firecrawl acts as Customer’s Processor, and Firecrawl’s authorized subprocessors act as Subprocessors, except to the extent the parties expressly agree otherwise.

Firecrawl will process Customer Personal Data only on Customer’s documented instructions, including as necessary to provide the Services, unless otherwise required by applicable law.

For clarity, the roles described above do not apply to personal data licensed or otherwise provided by People Data Labs to Firecrawl (“PDL Data”), which is addressed in Section 3 below.

2. People Data Labs

Customer specifically authorizes Firecrawl to engage People Data Labs, Inc. (“PDL”) as a Subprocessor with respect to Customer Personal Data. Firecrawl may provide Customer Personal Data to PDL for purposes of matching, enrichment, search, structuring, or related processing necessary to provide the Services.

Customer further generally authorizes PDL to engage the subprocessors identified in PDL’s applicable subprocessor list or data processing terms.

Accordingly, with respect to Customer Personal Data, the contemplated processing chain may include:

Customer (Controller) → Firecrawl (Processor) → PDL (Subprocessor) → PDL-authorized Subprocessors.

Where Customer itself acts as a Processor on behalf of another Controller, Customer represents that, to the extent required by applicable Data Protection Laws, it has obtained any authorization required from such Controller for Firecrawl to act as Customer’s Subprocessor and for Firecrawl to engage PDL and PDL’s applicable subprocessors.

3. PDL Data

PDL Data is Personal Data licensed or otherwise provided by PDL in connection with the Services. To the extent Firecrawl receives PDL Data from PDL, Firecrawl acts as an independent Controller of such PDL Data while it is in Firecrawl’s possession.

Where Firecrawl makes PDL Data available to Customer through the Services, Customer acts as an independent Controller of such PDL Data while it is in Customer’s possession. Customer will process PDL Data only for lawful purposes permitted under the Agreement and applicable Data Protection Laws and will be responsible for any notices, lawful bases, consents, security measures, and responses to Data Subject requests required with respect to Customer’s processing of such PDL Data.

For clarity, the contemplated PDL Data flow may include:

PDL (Controller) → Firecrawl (Controller) → Customer (Controller).

The Processor obligations in this DPA that apply to Firecrawl’s processing of Customer Personal Data do not apply to processing for which Firecrawl acts as an independent Controller.

4. Additional Subprocessors

Customer generally authorizes Firecrawl to engage additional Subprocessors to support the services. Firecrawl will make available a current list of its material Subprocessors and will provide notice of additions or replacements to the extent required by applicable Data Protection Laws or the Agreement. These currently include:

Firecrawl remains responsible for the performance of its Subprocessors to the extent required by applicable Data Protection Laws.

5. Processor Obligations

Firecrawl will:

(a) ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations;

(b) implement appropriate technical and organizational measures designed to protect Personal Data;

(c) reasonably assist Customer, taking into account the nature of the processing, with requests from data subjects and Customer’s obligations concerning security, breach notification, data protection impact assessments, and regulatory consultations;

(d) notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data;

(e) at Customer’s choice, delete or return Customer Personal Data following termination of the applicable services, except to the extent retention is required by law; and

(f) make available information reasonably necessary to demonstrate compliance with applicable processor obligations.

6. International Transfers

Where processing involves a transfer of Personal Data subject to transfer restrictions under applicable Data Protection Laws, the parties will use an applicable lawful transfer mechanism, including the European Commission Standard Contractual Clauses where required.

Where Firecrawl transfers Personal Data to a Subprocessor, Firecrawl will ensure that an appropriate transfer mechanism is implemented where required.

7. Customer Responsibilities

Customer represents and warrants that:

(a) with respect to Customer Personal Data, it has all rights, lawful bases, notices, consents, and other authority necessary to provide such Personal Data to Firecrawl and instruct the processing contemplated by the Agreement;

(b) its instructions concerning Customer Personal Data comply with applicable Data Protection Laws;

(c) where Customer itself acts as a Processor on behalf of another Controller, Customer has obtained any authorization required for Firecrawl to act as its Subprocessor and for Firecrawl to engage PDL and PDL’s applicable subprocessors;

(d) with respect to PDL Data made available to Customer, Customer will process such PDL Data only in accordance with the Agreement and applicable Data Protection Laws; and

(e) Customer will reasonably cooperate with Firecrawl in implementing applicable Data Subject requests, suppression requests, or other legally required restrictions communicated by Firecrawl with respect to PDL Data.

8. Processing Details

With respect to Customer Personal Data for which Firecrawl acts as Processor, the subject matter, duration, nature and purpose of the processing, categories of Personal Data, and categories of Data Subjects are those reasonably necessary to provide the Services selected by Customer under the Agreement, including matching, enrichment, search, structuring, and related processing performed through PDL.

Processing of Customer Personal Data will continue for the duration of the Agreement unless otherwise instructed by Customer or required by law.

For avoidance of doubt, this Section does not characterize Firecrawl’s processing of PDL Data as Processor processing where Firecrawl acts as an independent Controller under Section 3.

9. Conflict

If there is a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.