Skip to main content

    Data Processing Addendum

    Last updated: October 29, 2026

    This Data Processing Addendum ("DPA") sets out how Leadpoet, Inc., 325 W 45th St, New York, NY 10036, United States ("Leadpoet") processes personal data on behalf of the customer that has agreed to Leadpoet's Terms of Service or an order form that references them ("Customer").

    It forms part of the agreement between Leadpoet and Customer for the Leadpoet services (the "Services"): the Terms of Service and any order form (together, the "Agreement"). It is incorporated into the Agreement by reference and applies without signature from the later of October 15, 2026 and the date Customer accepts the Agreement, for as long as Leadpoet processes Customer Personal Data.

    1. Definitions

    Data Protection Laws: the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and any other data protection law that applies to the processing of Customer Personal Data under this DPA.

    Customer Personal Data: personal data that Leadpoet processes on Customer's behalf in providing the Services, as described in Annex I.

    Personal data, processing, controller, processor, data subject and supervisory authority have the meanings given in the GDPR.

    Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Leadpoet or its Sub-processors.

    Sub-processor: a third party that Leadpoet engages to process Customer Personal Data.

    SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

    UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner.

    Leadpoet Data: business contact information and related data from Leadpoet's own database that Leadpoet supplies to Customer through the Services.

    2. Roles and scope

    Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Leadpoet is Customer's processor, or sub-processor, for that data.

    Customer Personal Data includes data Customer submits or uploads (such as contact lists, targeting criteria and notes), data from accounts Customer connects (email mailboxes, LinkedIn accounts, CRM and calendar), messages Customer writes or approves, replies received in those conversations, and data about Customer's authorised users.

    Leadpoet compiles and maintains Leadpoet Data as an independent controller, as described in its Privacy Policy, and this DPA does not cover that compilation. When Customer uses Leadpoet Data in the Services, for example to send outreach, Customer is the controller of that use and Leadpoet processes the data on Customer's behalf under this DPA.

    Customer is responsible for the lawfulness of its instructions, for having a lawful basis and giving any notices its processing requires, and for the content of its outreach, including how recipients can opt out. Leadpoet provides tools for this, such as opt-out detection, suppression lists and footer settings, and Customer decides how to use them.

    3. Processing on documented instructions

    Leadpoet processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA and Customer's configuration and use of the Services (for example, the campaigns, connected accounts and settings Customer chooses) are Customer's complete instructions. Further instructions require written agreement.

    Leadpoet does not sell Customer Personal Data and does not process it for any purpose other than providing, securing, supporting and maintaining the Services for Customer. The only exception is processing required by EU or Member State law to which Leadpoet is subject; Leadpoet will tell Customer about that requirement first unless the law prohibits it.

    Leadpoet may create aggregated statistics about use of the Services that do not identify Customer or any individual.

    Leadpoet will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

    4. Confidentiality of personnel

    Leadpoet gives access to Customer Personal Data only to personnel who need it to provide the Services. Everyone with access is bound by confidentiality obligations that continue after their engagement ends.

    5. Security

    Leadpoet implements the technical and organisational measures in Annex II to protect Customer Personal Data, as required by Article 32 GDPR. Leadpoet may update those measures, provided the update does not lower the overall level of protection.

    6. Sub-processors

    Customer gives Leadpoet general authorisation to engage Sub-processors. Customer approves the Sub-processors listed in Annex III.

    Leadpoet will email Customer's account owner at least 30 days before it adds or replaces a Sub-processor. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it is not resolved, Customer may terminate the affected Services and receive a pro-rata refund of any prepaid fees for the remaining term.

    Leadpoet will bind each Sub-processor by written contract to data protection obligations no less protective than those in this DPA, to the extent they apply to the services that Sub-processor provides. Leadpoet remains responsible to Customer for its Sub-processors' performance of those obligations.

    7. Data subject requests and assistance

    Leadpoet helps Customer respond to data subjects exercising their rights (such as access, correction, deletion, objection and portability), through the Services' features and, where those are not enough, on request.

    If a data subject contacts Leadpoet directly about Customer Personal Data, Leadpoet will refer them to Customer and will not respond otherwise, unless the law requires it.

    Taking into account the nature of the processing and the information available to it, Leadpoet will give Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities.

    8. Personal data breach notification

    Leadpoet will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach.

    The notice will describe, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for further information. Leadpoet will provide information in phases where it is not all available at once.

    Leadpoet will send the notice to the email address of Customer's account owner, take reasonable steps to contain the breach, and cooperate with Customer's own notification obligations. A notice is not an admission of fault or liability.

    9. AI processing commitments

    Some Services features use AI models, such as drafting messages, classifying replies and summarizing account history. Leadpoet sends the data those features need to model providers listed in Annex III through OpenRouter.

    All of those requests go only to providers that do not collect the data for model training. Requests that carry message content, such as drafting, reply classification and account summaries, also require zero data retention.

    Leadpoet does not use Customer Personal Data to train or improve generalised or foundation AI models.

    10. International transfers

    Leadpoet stores Customer Personal Data in the United States. Sub-processors process it in the countries listed in Annex III.

    EU transfers. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference, with Customer as data exporter and Leadpoet as data importer. By agreeing to the Agreement, each party is treated as having signed the SCCs, including their Annexes, from the date this DPA applies.

    • Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor.
    • Clause 7 (docking clause) applies.
    • Clause 9: Option 2 (general written authorisation) applies, with the notice period in Section 6.
    • Clause 11: the optional wording does not apply.
    • Clause 13: the supervisory authority competent for Customer as data exporter.
    • Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
    • Clause 18: disputes are resolved by the courts of Ireland.
    • Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

    UK transfers. For Customer Personal Data subject to the UK GDPR, the UK Addendum is incorporated by reference. Its Table 1 is completed by the parties' details in this DPA, Tables 2 and 3 by the SCCs and Annexes above, and in Table 4 either party may end the UK Addendum as allowed by its Section 19.

    Swiss transfers. For Customer Personal Data subject to the FADP, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR include the FADP, and data subjects in Switzerland may bring claims in their place of habitual residence.

    If a transfer mechanism used under this Section is invalidated, the parties will cooperate in good faith to put a lawful alternative in place.

    If the SCCs conflict with this DPA, the SCCs prevail.

    11. Audits and information

    Leadpoet will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires.

    If that information is not sufficient, or a supervisory authority requires it, Customer may audit Leadpoet's compliance with this DPA, itself or through an independent auditor bound by confidentiality. Audits are limited to once every 12 months, need 30 days' written notice, take place during business hours, must minimise disruption and must not give access to other customers' data. Customer bears its own costs.

    Audits under the SCCs are carried out in the same way.

    12. Return and deletion

    During the term, Customer can export its data through the Services and can ask Leadpoet in writing to delete Customer Personal Data.

    Within 90 days after the Agreement ends, Leadpoet will delete or irreversibly de-identify Customer Personal Data. Before then, Customer may export its data or ask Leadpoet in writing to delete it sooner.

    Leadpoet may keep:

    1. data it must retain by law;
    2. backups, until they are overwritten in the normal backup cycle; and
    3. a minimal suppression record of an opted-out address, used only to keep honouring that opt-out.

    Anything kept under point 3 stays protected by this DPA for as long as Leadpoet holds it. Leadpoet will confirm deletion in writing on request.

    13. Liability, precedence, term and governing law

    Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. This does not limit either party's liability to data subjects under the SCCs, or any liability that cannot lawfully be limited.

    If documents conflict on data protection matters, the order of precedence is: the SCCs, then this DPA, then the Agreement.

    This DPA lasts for as long as Leadpoet processes Customer Personal Data.

    This DPA is governed by the law that governs the Agreement, except where the SCCs or Data Protection Laws require otherwise.

    Leadpoet may update this DPA by emailing Customer's account owner the new version at least 30 days before it takes effect and posting it on this page. Customer may object within that period; if the parties cannot resolve the objection, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees, and the previous version applies until termination. An update never reduces the protection this DPA gives Customer Personal Data without Customer's written agreement. Changes to Annex III follow Section 6.

    14. Acceptance

    Customer accepts this DPA electronically by accepting the Agreement, as Article 28(9) GDPR allows. It is not signed separately. Customer can save or print this page as its record of the version in effect; earlier versions are available from hello@leadpoet.com.

    Annex I: Description of processing

    This Annex also completes Annex I of the SCCs.

    Data exporter
    Customer, the entity that agreed to the Agreement. Contact: the email address of Customer's account owner. Role: controller (or processor). Activities: use of the Services.
    Data importer
    Leadpoet, Inc., 325 W 45th St, New York, NY 10036, United States; hello@leadpoet.com. Role: processor. Activities: providing the Services.
    Data subjects
    Customer's prospects, customers and other business contacts; people who correspond with Customer's connected email and LinkedIn accounts; Customer's authorised users; visitors to Customer's website, only if Customer enables website visitor identification.
    Personal data
    Name, business email, phone number, job title, company, LinkedIn profile URL and country. Content and metadata of messages in Customer's campaigns and in connected conversations (subject, body, sender, recipients, times). Reply status and classification, such as interested, not now or opt-out. Outreach history and suppression status. CRM records and calendar event details, if Customer connects them. Authorised users' account details and usage logs. Company and professional details inferred for website visitors, if enabled.
    Special categories
    None intended. Customer will not submit special categories of personal data.
    Frequency
    Continuous, for the term of the Agreement.
    Nature of processing
    Collection through Customer's uploads and connected accounts, storage, organisation, retrieval, analysis (including AI drafting, reply classification and account summaries), sending the messages Customer approves or configures, and deletion.
    Purpose
    To provide the Services to Customer: finding and managing prospects; drafting, sending and tracking outreach; detecting and classifying replies; summarizing account history; syncing with Customer's CRM; and supporting, securing and maintaining the Services.
    Retention
    For the term of the Agreement, then as set out in Section 12.
    Transfers to Sub-processors
    As listed in Annex III, for the same nature and purpose and the duration of the Agreement.
    Competent supervisory authority
    The supervisory authority competent for Customer as data exporter, under Clause 13 of the SCCs.

    Annex II: Technical and organisational measures

    This Annex also completes Annex II of the SCCs.

    Encryption in transit
    All connections to the Services and between Leadpoet and its Sub-processors use TLS.
    Encryption at rest
    Databases and file storage are encrypted at rest by the hosting providers. OAuth tokens for connected integrations are also encrypted at the application layer with AES-256-GCM and decrypted only when an authorised request needs them.
    Customer separation
    Each customer workspace is isolated by database row-level security and by authorisation checks in the application.
    Access control
    Production access is limited to personnel who need it. Users sign in through managed authentication, and workspace roles limit what each user can see and change.
    Minimal mailbox access
    Leadpoet uses connected mailboxes only to read messages (to show conversations and detect replies) and to send messages Customer approves or configures. It does not change or delete messages in Customer's mailbox.
    Secrets
    Credentials are kept out of source code, in the hosting providers' secret storage.
    Monitoring
    Errors are monitored with personal data excluded by default and scrubbed before sending. Key actions such as sends, approvals and settings changes are kept in audit records.
    Resilience
    The database provider runs managed automated backups. Deployments are designed to avoid downtime and can be rolled back.
    Change management
    Code changes go through version control, with automated tests run before release.
    Outreach safeguards
    Replies stop further follow-ups to that contact. Opt-out requests are detected and suppressed so the contact is not emailed again.
    AI safeguards
    AI requests go only to providers that do not collect the data for training, and requests with message content require zero data retention (Section 9).
    Vendors
    Each Sub-processor must be bound by a written contract with data protection obligations (Section 6).
    Incident response
    Personal Data Breaches are notified to Customer within 48 hours (Section 8).

    Annex III: Authorised sub-processors

    This Annex also completes Annex III of the SCCs. Leadpoet will email Customer before changing it (Section 6).

    • SupabaseDatabase, authentication and file storageUnited States (AWS us-east-1)
    • Amazon Web Services (AWS)Application hosting, background processing and logsUnited States (us-east-1)
    • RailwayHosting for a background worker that reads and writes the production databaseNetherlands (europe-west4)
    • CloudflareNetwork proxy, content delivery, security filtering for traffic to the Services, and bot checks on public formsCloudflare's global network; requests are handled at the data center nearest the user
    • UnipileConnection to Customer's email and LinkedIn accounts; sending and syncing messagesFrance (hosting); encrypted network proxies in the EU, United States, Israel and Singapore
    • OpenRouterRouting AI requests to model providers that do not train on the dataUnited States
    • OpenAI (through OpenRouter)AI models for drafting messages, classifying replies and summarizing account historyUnited States
    • Microsoft Azure (through OpenRouter)Hosting for some of the OpenAI models above, with zero data retentionUnited States and EU
    • Anthropic (through OpenRouter)AI models for drafting messages, classifying replies and summarizing account historyUnited States
    • Google (through OpenRouter)Gemini AI models, used as a backup for some features when the main model is unavailableGoogle's global data centers
    • Typesafe (through OpenRouter)Jev AI model that screens the LinkedIn headlines in Customer's network against target roles, with zero data retentionUnited States
    • DeeplineContact data enrichment and email address verification; where website visitor identification is enabled, a second company lookup from the visitor's IP addressUnited States
    • ZeroBounce (through Deepline)Email address verification before sendingUnited States
    • Prospeo, CrustData, Apify and HarvestAPI (through Deepline)Finding and checking business contact details, current roles and public professional profilesUnited States and EU
    • SnitcherIdentifying the company behind a website visit from the visitor's IP address, where website visitor identification is enabledNetherlands
    • IPinfoConfirming the company behind a website visit from the visitor's IP address, where website visitor identification is enabledUnited States
    • LeadpipeIdentifying website visitors' name, work email and job title, where website visitor identification is enabledUnited States
    • ScrapingdogFetching public web pages and public company profiles for website scans and targeting examplesUnited States
    • DeepLTranslating lead details that Leadpoet uploads, such as role, industry, location and company descriptionEuropean Union
    • ResendService emails to Customer's users, such as notifications and digestsUnited States
    • Google WorkspaceStaff email, such as support messages from Customer's users and request notifications with the requester's name or email and the request's targeting criteriaGoogle's global data centers
    • StripeBilling and payments for Customer's subscriptionUnited States
    • SentryError monitoring, with personal data excluded by defaultUnited States
    • OnePatchIncident monitoring from server traces, logs and metrics, with personal data redactedUnited States
    • PostHogProduct analytics on how Customer's users use the ServicesUnited States
    • Todoist (Doist)Staff task list for Customer's requests: the requester's name or email and the request's targeting criteriaUnited States