Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service and any order or services agreement between NudgeLink (“Processor”) and the customer (“Controller”). It applies to the processing of Personal Data under applicable data protection laws, including the EU GDPR, the UK GDPR and the UK Data Protection Act 2018. NudgeLink is run from Poland as a sole proprietorship; the legal entity is named in our Terms of Service and in your order or agreement. A signed version with the parties' details is available on request.

1. Subject matter and duration

The subject matter is the processing of Personal Data necessary to provide the Services, including any managed outreach service. This DPA remains in effect for as long as the Processor processes Personal Data for the Controller.

2. Nature and purpose

Processor processes Personal Data to operate the NudgeLink outreach platform on behalf of the Controller. This includes: finding and reading public LinkedIn profile data and, when the Controller runs Scout, facts from publicly available web pages, rating lead relevance, drafting outreach messages for the Controller to approve (or to send automatically where the Controller turns on auto-send), sending and receiving messages through the Controller's connected LinkedIn account and, where the Controller connects one, its own mailbox, and managing campaign state and reports. Where the Controller connects them, it also includes sending lead and activity data to the Controller's HubSpot portal and making data available to an AI assistant the Controller authorizes.

3. Categories of data subjects and personal data

• Controller's end users — people who use the Services on the Controller's behalf. Data includes: name, email address and sign-in data.
• Leads — individuals the Controller targets through the Services. Data includes: public LinkedIn profile data (name, role, company, location, public posts and activity), facts about them from public web pages found by Scout, with the source URL, email address where available, the messages, emails and replies exchanged with them, and their email opt-out and bounce status.

4. Obligations of the Processor

• Process Personal Data only on documented instructions from the Controller;
• Ensure that people who process Personal Data are bound by confidentiality obligations;
• Apply appropriate technical and organizational measures (see section 6);
• Help the Controller respond to requests from individuals and meet its obligations on security, breach notification, impact assessments and prior consultation (GDPR Articles 32–36);
• Tell the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller's data, with the information available, and keep the Controller updated.

5. Sub-processors

The Controller gives general authorization for the following sub-processors. Where a provider keeps data in more than one place, the main location is shown.

• Railway — hosting of the application, workers, database and cache (United States, US West region)
• Cloudflare — DNS, network proxy and email forwarding (global)
• Vercel — hosting of the website and web app (United States, global edge)
• Anthropic — AI that drafts and rates messages (United States)
• OpenAI — text embeddings that rank candidate leads by relevance; receives public profile text (headline, role, company, industry, location, profile summary) with the lead's name left out, and never messages (United States)
• Unipile — connection to the Controller's LinkedIn account and connected mailboxes (France)
• Backblaze — storage of encrypted nightly database backups (European Union, EU Central region)
• Twilio SendGrid — email delivery (United States)
• Stripe — payments and billing (United States)
• Sentry — error monitoring (Germany, EU region)
• Google — optional sign-in, only for users who choose it (global)

We give at least 30 days' notice (by email or in the Services) before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If an objection cannot be resolved, the Controller may end the affected Services and receive a refund of prepaid fees for the unused period. We have written data processing terms with each sub-processor and remain responsible for them.

Services the Controller connects. When the Controller connects its own HubSpot portal or an AI assistant (such as Claude or ChatGPT), Processor sends data to that service on the Controller's instruction. These services are the Controller's own providers, not sub-processors of Processor, and their own terms apply to the data they receive. The Controller can disconnect them at any time.

6. Security measures

• Access tokens and secrets of connected tools (such as HubSpot) are encrypted in the application with AES-256-GCM; the key is held separately from the code and the database. For LinkedIn accounts and mailboxes we store only Unipile's account ID, which cannot be used without our Unipile API key. We do not see or store the Controller's LinkedIn password.
• User passwords are stored hashed (bcrypt), never in plain text.
• The website and API accept TLS 1.2 and TLS 1.3 only, with HTTP Strict Transport Security.
• Databases and their storage are run by our hosting provider; we rely on the provider's controls for storage security. Nightly database backups are encrypted before they leave the hosting provider and are stored with Backblaze.
• Lead records are deleted automatically 90 days after their last use: the last message sent to the lead or reply received from them, or, for a lead never contacted, the day it was added. The Controller can delete them earlier. Search suggestions are deleted 90 days after they were made, or, once the Controller has accepted or declined them, reduced to the LinkedIn profile link, the decision and the match scores. People and companies found by Scout, with their facts and source URLs, are kept while the Controller's account exists.
• When a lead unsubscribes or opts out, an email to them bounces, or they say no, Processor keeps a SHA-256 hash of their email address or LinkedIn identifier (never the value itself) so that the objection is honoured after the lead record is deleted. These hashes are kept for as long as the Controller's account exists and are deleted with it.

7. International transfers

NudgeLink's servers are in the United States, so Personal Data is transferred there; some sub-processors operate in other countries as listed above. We do not currently offer UK or EU hosting of Controller data. Transfers rely on each sub-processor's data processing terms: Standard Contractual Clauses approved by the European Commission (2021/914) with the UK Addendum or UK IDTA for UK data, and in several cases certification under the EU-US Data Privacy Framework.

8. Audit and information

Processor will give the Controller the information needed to show compliance with this DPA. The Controller may request an audit once per year on 30 days' written notice, during business hours; Processor may satisfy a request by answering a written questionnaire and sharing relevant provider documentation. NudgeLink itself holds no security certification; our hosting provider reports its own.

9. Return and deletion of data

When the Services end, Processor will, at the Controller's choice, return or delete the Controller's Personal Data from its live systems within 30 days, unless the law requires it to be kept. Encrypted backup copies are not edited when data is deleted; they are kept for 30 days and deleted within 31.

10. Liability

Liability under this DPA is subject to the limitation of liability provisions in the Terms of Service or the order or services agreement.

11. Contact

For a signed copy of this DPA or any questions, email hello@nudgelink.co.