Data Processing Addendum
Last updated: September 10, 2026 (v2026-09-01)
1. Roles
For form submissions collected through your sites, you are the controller and LeadScore is the processor. For your account data, LeadScore is the controller. This DPA applies to the processor relationship under GDPR Art. 28.
2. Processing instructions
We process personal data only to provide the service: ingest form submissions, score them with our AI scoring providers (Groq, OpenRouter), store and display them, send your configured Slack/email notifications, and enforce rate and subscription limits. We never sell personal data and never use it for our own advertising.
3. Subprocessors
Listed at /subprocessors. We impose Art. 28 terms on each subprocessor and notify you 30 days before changes; you may object by email and, if unresolved, cancel self-serve from Settings (access continues until the end of the current billing period).
4. International transfers
Where data leaves the EEA (AI scoring, PostHog, Cloudflare edge), transfers rely on adequacy decisions or the EU Standard Contractual Clauses incorporated from our vendors' DPAs, plus supplementary measures (encryption in transit, data minimisation, masked analytics).
5. Security
Google-managed sign-in (no passwords stored), SHA-256 API-key hashing, HMAC webhook verification, per-IP and per-site rate limits, HTTPS everywhere, and owner-scoped access controls. Bot-protection (Turnstile) enforcement is available on request. We notify personal-data breaches within 72 hours of awareness.
6. Data subjects & retention
We assist with data-subject requests via self-serve export/erasure and our DSAR log (Settings → Privacy & data). Deleting a site deletes its submissions immediately; deleting an account erases everything immediately. Rate-limit buckets are purged after 48 hours.
7. Acceptance
Using LeadScore after this version's effective date accepts this DPA. For a countersigned copy, email hello@leadscore.icu with your company name and account email.