Data Processing Addendum
How LeadRilo processes customer data on your behalf as your processor, including subprocessors, security, and assistance with data-subject requests.
The short version
- You are the controller of your customer data; LeadRilo is the processor.
- We process it only on your instructions and to provide the service.
- This draft summarizes the terms; a signable DPA is available on request.
This summary is for convenience only. The full text below is what governs.
1. Roles of the Parties
For customer content you process using LeadRilo, you act as the controller (or business) and LeadRilo acts as the processor (or service provider). We process that data only to provide the service and on your documented instructions, which include these terms and your use of the product.
2. Scope of Processing
- Subject matter: providing the LeadRilo platform
- Duration: for the term of your subscription plus limited wind-down
- Nature & purpose: hosting, storing, and processing customer content to deliver features
- Types of data: leads, contacts, messages, appointments, notes, pipeline and workflow data you choose to store
- Data subjects: your leads, customers, and contacts
3. Our Obligations
- Process customer content only on your instructions and for the service
- Require personnel to keep data confidential
- Maintain appropriate technical and organizational security measures (see the Security page)
- Assist you, taking into account the nature of processing, with data-subject requests and security obligations
- Delete or return customer content at the end of the relationship, subject to legal retention
4. Subprocessors
You authorize us to engage the subprocessors listed on our Subprocessors page to help provide the service. We remain responsible for their processing and require appropriate protections.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Vercel Inc.Application hosting, content delivery, and serverless compute that run the LeadRilo platform. | Application hosting, content delivery, and serverless compute that run the LeadRilo platform. | Application traffic and request metadata (including IP addresses in transit). Vercel does not receive a separate copy of your CRM records beyond what is required to serve requests. | United States |
| Supabase Inc.Primary database, authentication, and file storage for account and customer content. | Primary database, authentication, and file storage for account and customer content. | Account information, authentication credentials (hashed/managed by Supabase Auth), and customer content you store in LeadRilo (leads, contacts, messages, notes, pipeline data, uploads). | United States |
| Stripe, Inc.Subscription billing and payment processing. | Subscription billing and payment processing. | Billing contact details and payment method information entered at checkout. Full card numbers are handled by Stripe and are not stored by LeadRilo. | United States |
| Google LLC (Google Analytics 4)Aggregate measurement of LeadRilo's own marketing website and product usage. | Aggregate measurement of LeadRilo's own marketing website and product usage. | Pseudonymous usage events and device/technical information. LeadRilo sends only categorical parameters — no names, emails, or customer records — and analytics can be declined via cookie preferences. | United States |
| OpenAI (via Vercel AI Gateway)Powers optional AI assistance features such as drafting suggested replies. | Powers optional AI assistance features such as drafting suggested replies. | The specific text you submit to an AI feature at the time you use it (for example, a message you ask LeadRilo to help draft). AI features are used at your direction. | United States |
| Twilio Inc.Only if you enable itSends and receives SMS/text messages when a workspace enables text messaging. | Sends and receives SMS/text messages when a workspace enables text messaging. | Phone numbers and message content for texts you send or receive through LeadRilo. Used only when SMS is configured for your workspace. | United States |
| Resend (Plus Five Five, Inc.)Only if you enable itDelivers transactional and notification email (for example, alerts and system messages). | Delivers transactional and notification email (for example, alerts and system messages). | Recipient email addresses and the content of transactional messages sent through LeadRilo. | United States |
5. Data-Subject Requests
If an individual contacts us directly about data you control, we will refer them to you where appropriate and support you in responding. Tools to access, export, correct, and delete records are available in the product and via the Data Rights page.
6. Requesting a Signed DPA
This page summarizes our data-processing commitments. If your organization requires a countersigned Data Processing Addendum, contact us and we will provide the current version.
In progress: The formal signable DPA and any standard contractual clauses are being finalized with counsel.
Questions about this document? Email getLeadRilo@gmail.com. LeadRilo is governed by the laws of the United States and the state in which LeadRilo is established.
Related documents