Data Processing Addendum
1. What this covers, and what it does not
This addendum forms part of the Terms of Service and governs personal data that LeadSurface LLC processes on your behalf. Where it and the Terms disagree about personal data, this document wins.
It covers two things:
- Your workspace data — your users' email addresses, your configuration, and their activity in the app.
- The public posts we ingest for you — including the author information described in the Privacy Policy.
For your workspace data you are the controller and we are the processor: you decide why it is held, we hold it.
The public posts are less tidy, and pretending otherwise would not help you. For the posts we ingest, we are a controller in our own right, not only your processor: we decide which communities to read, what to extract, and how to classify, and we answer the authors' requests ourselves rather than passing them to you. You are also a controller of what you do with a lead once you act on it. Neither of us is the other's processor for that part, and each of us answers for our own end. Section 7 says what that means when an author gets in touch.
2. What we do with it
We process personal data only to provide LeadSurface: running the account, ingesting and classifying posts, sending digests you turned on, taking payment, keeping the service secure, and supporting you when you ask.
We act on your documented instructions. These terms, your configuration in the app, and your support requests are those instructions. If we ever think an instruction breaks a data protection law, we will tell you rather than quietly comply.
We will not: sell personal data; use it to train a model, ours or anyone else's; use your workspace data to build a product for anyone else; or process it for our own purposes beyond what is described here and in the Privacy Policy.
3. Confidentiality and who can see it
Access is limited to the people who need it to run the service, under confidentiality obligations. LeadSurface is a small company; in practice that is a very short list, and the operator console that reaches customer data is not reachable from the public internet at all.
4. Subprocessors
You give us general authorisation to use subprocessors. The current list is the table in the Privacy Policy — Stripe, Resend, DigitalOcean, Cloudflare, and Google — kept there rather than on a separate page so it is impossible to update one and forget the other.
Every subprocessor is bound to protections no weaker than these, and we stay responsible to you for what they do with your data.
Before we add or replace one, we email the address on your account. If the new one is a problem for you, tell us within 30 days and you can cancel the affected part of the service, or all of it, with a refund of anything you have paid for time you will not get. We do not treat your objection as a breach.
5. Security
What we actually do, rather than a list of what a bigger company would do:
- Traffic to the site is encrypted in transit.
- Passwords are hashed with bcrypt. We never hold the password itself.
- Sign-in tokens are signed and expire after 7 days.
- Every query for leads, users, and configuration is scoped to a single workspace, and that scoping is enforced in code and covered by automated tests.
- The operator console and its API are reachable only over a private network.
- Payment card details are entered into Stripe's own hosted fields and never reach our servers.
We hold no SOC 2 report and no ISO 27001 certificate, and we are not going to imply otherwise by describing our controls in the language of an audit we have not had. LeadSurface runs on a single small server. If a certification is a hard requirement in your vendor review, we will fail it, and we would rather you knew that on this page than three weeks into a questionnaire.
6. Breach notification
If we become aware of a breach affecting your personal data, we will tell you without undue delay and within 72 hours, at the address on your account. We will tell you what we know at the time — what happened, who is affected, what we are doing — and keep you updated rather than waiting until the picture is complete.
7. Helping you meet your obligations
Data subject requests. If someone contacts you about data we hold for you, we will help you answer, and the tools to export, correct, and delete are in the product or a support email away.
If someone contacts us about a post we ingested, we handle it ourselves and do not route it to you — that follows from us being a controller for the posts, and it means an author's request never becomes your problem or your delay. We delete our copy and record the URL so the scanner cannot re-fetch it. If it also sat in your workspace, it is gone from there too.
Assessments and audits. We will give you the information you reasonably need for a data protection impact assessment or an inquiry from your regulator. On audit: rather than promise an on-site audit we are not staffed to host, we will answer a security questionnaire in writing and answer follow-up questions from your team on a call. If your regulator directs an inspection, we will cooperate with it.
8. International transfers
LeadSurface LLC is in the United States, and data is stored and processed there.
For personal data from the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), which are incorporated into this addendum. Where we are acting as a controller in our own right, Module One applies instead. Clause 7 (docking) applies; the supervisory authority is that of the member state of your establishment; clause 9 uses option 2 (general written authorisation) with the 30-day notice period in section 4; clause 17 selects the law of Ireland and clause 18 the courts of Ireland. Annexes I, II and III are supplied by, in order: section 1 (parties and categories of data), section 5 (security measures), and the subprocessor table in the Privacy Policy.
For personal data from the United Kingdom, the SCCs apply as amended by the ICO's International Data Transfer Addendum (version B1.0).
For personal data from Switzerland, the SCCs apply with references read to include the Swiss FADP and the Federal Data Protection and Information Commissioner as supervisory authority.
Two gaps, named rather than buried. We are not certified under the EU-US Data Privacy Framework, and we have not appointed an Article 27 representative in the EU or the UK. Vendors several times our size have both. If either is a requirement in your review, raise it before you buy.
9. Deletion and return
You can export or delete your data at any time by asking us. When your account closes we disable it rather than erase it, so that reopening restores everything — nothing is deleted by closure alone. Ask us to delete it and we will.
What survives deletion, and why: payment and invoice records held by Stripe for accounting and tax, log entries until they rotate, and the removal list in section 7 — which holds a URL and a date, and exists precisely so a deletion stays deleted.
10. Liability
The limits in section 13 of the Terms of Service apply to this addendum too, taken together with the Terms rather than separately. Nothing here limits a data subject's rights against either of us under the Standard Contractual Clauses.
11. Contact
[email protected], or the contact form. There is no separate privacy inbox; mail sent there reaches a human either way.