Smart Leads

Data Processing Agreement

The terms under which Smart Leads processes personal data for its customers.

This page is a placeholder, not legal text. It lists what the reviewed Data Processing Agreement must cover. The reviewed text replaces it before Smart Leads goes live.

Roles and subject matter

The reviewed text must cover:

  • The workspace is the controller and Smart Leads the processor (02-design “Compliance”), processing only on the workspace’s documented instructions.
  • Data subjects: contacts at businesses found or imported as leads, and people who reply. Data: business names, contact names, email addresses, phone numbers, website text, emails sent and replies.
  • Legal basis is the controller’s: business contact data processed on legitimate-interest grounds, with the lead source recorded per lead.

Sub-processors

The reviewed text must cover:

  • The hosting provider (P10-05) and Sentry when error tracking is on; how customers are told about changes.
  • Google Maps Platform, AI providers and mailboxes connected with the customer’s own keys are the customer’s own providers, not Smart Leads’ sub-processors.

Security measures

The reviewed text must cover:

  • Tenant isolation enforced by the database (row-level security on every tenant table) and tested in CI (NFR-5).
  • Keys and mailbox passwords encrypted with AES-256-GCM per workspace and never shown again (REQ-SET-5).
  • TLS for all traffic, two-factor authentication, roles, rate limits, an append-only audit log, daily backups.

Retention and deletion

The reviewed text must cover:

  • Suppression lists belong to the workspace and are deleted with it; nothing is carried over to another workspace (P7-04).
  • A deleted workspace is purged within 30 days (REQ-WS-6); backups are kept 14 days (NFR-9).
  • Scraped website text is deleted after 90 days, and email bodies and copies of reply text are cleared after 2 years, by a daily job (NFR-9, P10-10).

Data subject requests

The reviewed text must cover:

  • Deleting a lead and adding its address to the suppression list honors a deletion request; leads can be exported (02-design “Compliance”).

Breaches, transfers, audits

The reviewed text must cover:

  • To be set by legal counsel: breach notification time, international transfer mechanism (depends on the hosting location), audit rights, and liability.