Data processing terms

Version 0.1, draft for legal review.

Roles

For the contacts you search and message, [you are controller and we are processor / joint roles — lawyer to decide].

Instructions

We process contact data only to run the searches and the outreach you approve.

Sub-processors

Stripe, Anthropic, Cloudflare, Render, Vercel, Resend, Sentry, Better Stack. We notify you before adding one.

Security

Encryption in transit and at rest, account isolation enforced in the database, two-factor for staff, audit log of staff access.

Breaches

We notify you without undue delay and within [n] hours of becoming aware.

Deletion and return

On account deletion, data is removed after 30 days; an export is available before then.

Transfers

[Standard contractual clauses or equivalent — lawyer to complete.]