Data Processing Agreement

Last updated: September 4, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Leadpocket ("we," "us," the "Processor") and you, the account holder (the "Customer," the "Controller"). It applies whenever data protection laws such as the GDPR or UK GDPR govern the personal data you collect and manage through the Service ("Lead Data"). It reflects how the Service works for every customer — no signature is required; by using the Service you and we agree to these terms.

1. Roles & Scope

You are the controller of Lead Data: you decide what to collect through your intake forms, whom to contact, and when to delete. We are your processor: we store and process Lead Data only to provide the Service to you, only on your documented instructions (given through your use of the Service), and never for our own purposes. For your own account data (your name, email, billing status), we act as an independent controller as described in the Privacy Policy.

2. Subject Matter, Duration, Nature & Purpose

• Subject matter: hosting and processing of Lead Data within your workspace.
• Duration: the lifetime of your account, until you delete data or the account.
• Nature & purpose: storage, retrieval, search, display, export, optional AI-assisted message drafting you explicitly trigger, and push notifications you enabled.
• Categories of data subjects: your leads and prospects.
• Categories of personal data: names, phone numbers, email addresses, photos (if you add them), and whatever custom form answers you choose to collect, plus your notes and outreach history about them. The Service is not intended for special categories of data (Art. 9 GDPR) — please don't collect them through it.

3. Our Obligations as Processor

• Process Lead Data only on your instructions, unless law requires otherwise (in which case we inform you unless prohibited).
• Ensure persons authorised to process Lead Data are bound by confidentiality.
• Implement appropriate technical and organisational measures (Section 5).
• Assist you, insofar as possible, in responding to data subject requests (Section 6) and in meeting your obligations regarding security, breach notification, and impact assessments.
• Delete Lead Data at the end of the relationship (Section 7).
• Make available the information necessary to demonstrate compliance, and allow and contribute to audits as described in Section 8.

4. Subprocessors

You authorise the following subprocessors, which we use to operate the Service:

• Stripe, Inc. (USA) — payment processing for your subscription. Processes your billing data, not your Lead Data. EU–US Data Privacy Framework / SCCs.
• Anthropic, PBC (USA) — optional AI text generation, only if you enable AI features and only the content described in the Privacy Policy (flow template, your instructions, the applicable lead's form answers). API inputs and outputs are not used to train Anthropic's models. Keep AI features off and no Lead Data is ever sent. Standard contractual clauses for EEA/UK transfers.
• Our hosting provider — runs the servers and storage where the Service and your workspace data live.
• Browser push services (Google FCM, Apple, Mozilla — operated by your browser vendor) — deliver the push notifications you enabled; payloads are encrypted end-to-end per the Web Push standard.

We will notify you (in the app or by email) before adding or replacing a subprocessor that processes Lead Data, giving you the opportunity to object; if you object on reasonable data-protection grounds and we cannot accommodate you, you may terminate and export your data.

5. Security Measures

• Workspace isolation: every query is scoped to your account; no other customer can access your Lead Data.
• Passwords are protected so they cannot be read; sessions run over HTTPS with HttpOnly cookies.
• Bot and abuse protection on public endpoints (rate limiting, challenge verification).
• Data minimisation by design: no analytics trackers, no advertising pixels, no third-party cookies.
• End-to-end encrypted push payloads (Web Push / VAPID standard).
• Access to production systems restricted to the operator.

6. Data Subject Requests

The Service gives you the tools to handle most requests yourself: search finds a person across all fields; you can correct any field, export data as CSV, and delete a lead permanently. If a data subject contacts us directly about data in your workspace, we will forward the request to you and not respond on your behalf except as legally required.

7. Deletion & Return

You can export all Lead Data (CSV) and delete individual records at any time. Deleting your account permanently and immediately erases your workspace — leads, forms, flows, notes, photos, and notification subscriptions. After account deletion we retain nothing of your Lead Data except what law requires us to keep (e.g. billing records, which contain no Lead Data).

8. Audits

On written request, no more than once per year, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where that is insufficient under applicable law, we will allow an audit by you or an independent auditor you mandate, at your cost, on reasonable notice, during business hours, and without access to other customers' data.

9. Breach Notification

If we become aware of a personal data breach affecting your Lead Data, we will notify you without undue delay at your account email, describing the nature of the breach, the likely consequences, and the measures taken or proposed.

10. International Transfers

Where processing by us or a subprocessor involves transferring Lead Data outside the EEA/UK, the transfer is protected by an adequacy decision, the EU–US Data Privacy Framework, or standard contractual clauses, as listed per subprocessor in Section 4.

11. Liability & Precedence

The liability terms of the Terms of Service apply to this DPA. If this DPA conflicts with the Terms regarding the processing of Lead Data, this DPA prevails.

12. Contact

Data protection questions? Email support@leadpocket.io.