Data Processing Agreement

This Data Processing Agreement ("DPA") is between Kifas Labs Ltd. ("Active Manager", "we", "us") and the customer that has accepted our Terms and Conditions ("you"). It applies whenever we process personal data on your behalf while providing Active Manager.

We have kept it as short and plain as a DPA can be. If something is unclear, write to support@activemanager.ai.

The short version

• You are the controller of the leads and prospects you import, enrich and contact through Active Manager, and of your team's workspace data. We are your processor (a "service provider" or "processor" under US state laws, and a "holder" under Israeli law).
• We use that data only to provide Active Manager to you, on your instructions. We do not sell it, share it for advertising, use it for another customer, or use it to train AI models.
• We protect it with the measures in Annex II, including AWS KMS encryption of LinkedIn and mailbox credentials and database rules that keep each customer's data separate.
• We use the sub-processors listed in our Privacy Policy, and give you 30 days' notice before adding or replacing one, with a right to object.
• We tell you about a personal data breach without undue delay, and within 72 hours of becoming aware of it.
• Data is hosted in the United States (AWS and Supabase, region us-east-1). Where transfer rules apply, the Standard Contractual Clauses and the UK Addendum are part of this DPA.
• You don't need to sign anything. Accepting the Terms means accepting this DPA.

1. About this DPA

It is part of the Terms. This DPA is incorporated into, and forms part of, our Terms and Conditions. By accepting the Terms, you also accept this DPA, including the Standard Contractual Clauses and the UK Addendum where section 15 says they apply. It takes effect on the date you accepted the Terms, and no signature is needed.

A signed copy. If you need a signed copy for your records, email support@activemanager.ai and we will send you a countersigned copy of this DPA. Signing does not change its terms.

The EEA. Active Manager is not currently offered to customers in the European Economic Area (see section 3 of the Terms). We have still written this DPA so that it meets the GDPR, because customers outside the EEA may contact people who are in it, and so that it works if we offer the service there in future.

2. Definitions

Words that the Terms define (such as "Service" and "Customer Data") have the same meaning here. In addition:

• Data Protection Laws means all laws on privacy and personal data that apply to the processing under this DPA, including, where they apply:
  • the EU General Data Protection Regulation 2016/679 ("GDPR");
  • the UK GDPR and the UK Data Protection Act 2018 ("UK Data Protection Law");
  • the Swiss Federal Act on Data Protection ("FADP");
  • the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"), and the consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other US states with similar laws (together with the CCPA, "US State Privacy Laws");
  • Israel's Protection of Privacy Law, 5741-1981, as amended (including by Amendment No. 13), the Privacy Protection (Data Security) Regulations, 5777-2017, and the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 (together, "Israeli Privacy Law").
• Customer Personal Data means personal data in Customer Data that we process on your behalf to provide the Service. Annex I describes it.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR. They include the equivalent terms in other Data Protection Laws, for example "business", "service provider", "contractor", "consumer" and "personal information" under US State Privacy Laws, and "database controller" (owner) and "holder" under Israeli Privacy Law.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data that we, or our Sub-processors, process.
• Sub-processor means a third party we engage to process Customer Personal Data on our behalf.
• SCCs means the standard contractual clauses for transferring personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, or any version that replaces it).
• Restricted Transfer means a transfer of Customer Personal Data that, under Data Protection Laws, is allowed only with appropriate safeguards, because the recipient's country is not covered by an adequacy decision or similar finding.

3. Roles and scope

You are the controller, and we are your processor. For Customer Personal Data, you decide why and how it is processed, and we process it on your behalf. Under US State Privacy Laws, we are your service provider, contractor or processor. Under Israeli Privacy Law, you are the database controller and we are a holder.

If you act for your own clients. If you use Active Manager to run outreach for someone else (for example as an agency), you may be a processor for that client. In that case you confirm that your client has authorised your instructions to us, including our use of Sub-processors, and we act as your sub-processor. You remain our only point of contact, and you pass on anything your client needs from us.

What this DPA does not cover. We are the controller, not your processor, for data we use to run our own business: your account and sign-in details, the LinkedIn and mailbox connection details you give us, billing, support, security, fraud and abuse prevention (including enforcing one free trial per person), and service usage data. Our Privacy Policy explains how we handle that data.

Team members. Data about your team members that you manage in your workspace (their names, email addresses, roles, and the campaigns, leads, messages and statistics that team owners and managers can see and act on) is Customer Personal Data. The same people's sign-in and account administration data is ours, as described above.

Paddle. Paddle.com, our reseller and Merchant of Record, processes payment and billing data as an independent controller under its own terms. It is not our Sub-processor and receives no lead or prospect data.

Your own services. LinkedIn, your email provider, and the integrations you turn on (such as HubSpot, webhooks, Zapier, Make or our API) are services you choose and use under your own agreements with them. When we send data to them on your instruction, they are not our Sub-processors.

4. Your responsibilities

You decide whom to contact, what data to use and what to say. In particular, you are responsible for:

• a lawful basis. Having a lawful basis under Data Protection Laws to collect, store and use each prospect's personal data and to contact them, including by LinkedIn invitation, LinkedIn message and email, and giving them any notice the law requires (for example under Article 14 GDPR);
• anti-spam and platform rules. Complying with anti-spam and electronic marketing laws, and with the terms of LinkedIn and your email provider, as section 8 of the Terms describes;
• objections and requests. Honouring objections, opt-outs and other requests from the people you contact, and stopping contact with anyone who asks;
• lawful instructions. Making sure your instructions to us, and the data you give us, comply with Data Protection Laws, and that you have the right to give them;
• no sensitive data. Not uploading or collecting through the Service any special categories of personal data (for example health, religion, sexual orientation or political opinions), data about criminal convictions, children's data, government identification numbers or financial account numbers. Active Manager is not designed for that data;
• your account security. Keeping your sign-in details safe, using two-factor authentication, giving team roles only to people who need them, and protecting your API keys.

Tools that help you. Active Manager gives you tools to meet these responsibilities, including: a reply on LinkedIn or by email stops the automated sequence for that lead; an unsubscribe footer and List-Unsubscribe header on emails, on by default, with unsubscribed and hard-bounced addresses suppressed for your account; blacklist and data-scrubber rules to exclude people and companies; and the ability to edit, export or delete any lead at any time. Using these tools is your choice and your responsibility.

5. Processing only on your instructions

Your instructions. We process Customer Personal Data only on your documented instructions. Your instructions are: the Terms and this DPA; the way you set up and use the Service (for example the leads you import, the sequences you run, the features such as the email finder or AI lead scoring you use, and the integrations you turn on); and any other written instructions we agree with you. Instructions that go beyond the Service's normal features need our agreement, and may involve extra fees.

If an instruction breaks the law. We will tell you if we believe an instruction infringes Data Protection Laws. We may then decline to follow it until you change or confirm it.

Where the law requires otherwise. If a law that applies to us requires us to process Customer Personal Data in another way, we will tell you before we do so, unless that law forbids it.

What we never do. We do not use Customer Personal Data for our own purposes or for any other customer, and we do not build a shared database of prospects. We do not sell it, or share it for cross-context behavioural advertising. We do not use it, or let our AI provider use it, to train AI models.

Aggregated data. As section 9 of the Terms allows, we may create aggregated data about how the Service is used, which does not identify you, your users or your prospects, and use it to run, secure and improve the Service. We will not try to re-identify it, and if we share de-identified data we will require the recipient not to try either.

6. Confidentiality

We give access to Customer Personal Data only to staff and contractors who need it to provide, support or secure the Service. Everyone with access is bound by a duty of confidentiality, by contract or by law. As our Privacy Policy says, our staff do not read your leads' messages or your mailbox content unless you ask us to (for example in a support request), it is needed for security, or the law requires it.

7. Security

We implement and maintain the technical and organisational measures described in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches and to ensure a level of security appropriate to the risk.

Security improves over time, so we may update these measures. Any update will not lower the overall protection of Customer Personal Data.

You are responsible for the security choices within your control, as section 4 describes, and for deciding whether our measures meet your needs.

8. Sub-processors

General authorisation. You authorise us to use Sub-processors to process Customer Personal Data. The current list, with each Sub-processor's purpose and location, is in the Sub-processors section of our Privacy Policy at https://www.activemanager.ai/privacy-policy/#sub-processors. Annex III gives a snapshot of it.

Our commitments. Before a Sub-processor processes Customer Personal Data, we check its security and privacy practices, and put in place a written contract that requires it to protect the data to a standard no less protective than this DPA, as appropriate to the service it provides. We remain responsible to you for our Sub-processors' performance of their data protection obligations.

Notice of changes. We will tell you at least 30 days before we add or replace a Sub-processor, by email to the address on your account and by a notice in the app, and we will update the list. If we have to replace a Sub-processor urgently (for example because it has stopped providing its service or has had a security problem), we may do so with shorter notice. We will tell you as soon as we can, and your right to object still applies.

Your right to object. You may object to a new Sub-processor, on reasonable grounds relating to data protection, by writing to support@activemanager.ai within the notice period. We will discuss your concerns in good faith, and may offer a way to avoid the change for your account (for example by not using the feature that relies on that Sub-processor). If we cannot resolve your objection within a reasonable time, you may end the affected part of the Service, or your subscription if the change affects the Service as a whole, by notice to us. We will then refund, through Paddle, the fees you prepaid for the unused part of the billing period for what you ended. This refund applies in addition to the cases in our Refund Policy.

9. Requests from individuals

Your tools. You can find, correct, export (as CSV) and delete leads and their data yourself in the app, and add people to your blacklist so they are not contacted again.

Requests sent to us. If a prospect or other data subject sends us a request about Customer Personal Data (for example to access, correct or delete it, or to object to its use), we will pass it on to you without undue delay, and we will not answer it ourselves except to tell the person that we have passed it on, or where the law requires us to. Our Privacy Policy tells people contacted through Active Manager that this is how we handle their requests.

Help with requests. Taking into account the nature of the processing, we will give you reasonable help, through the Service's tools or otherwise, to respond to requests from individuals exercising their rights under Data Protection Laws. If a request needs significant work beyond what the tools provide, we may charge a reasonable fee, which we will tell you about in advance.

10. Assessments and consultations

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your data protection impact assessments, consultations with supervisory authorities, and similar assessments required by Data Protection Laws, where they relate to your use of Active Manager. We will usually do this by providing the information in this DPA, our Privacy Policy and section 14.

11. Personal data breaches

Notice. If we become aware of a Personal Data Breach, we will notify you without undue delay, and in any case within 72 hours after becoming aware of it. We will send the notice to the email address on your account, and to any other privacy contact you have given us.

What it will contain. As far as we know at the time, the notice will:

• describe the nature of the breach, including the categories and approximate number of data subjects and of personal data records concerned;
• give the name and contact details of the person who can give you more information;
• describe the likely consequences of the breach; and
• describe the measures we have taken or propose to take to address it, including to reduce its possible harm.

Where we cannot give all of this at once, we will give it in phases, as it becomes available, without undue further delay.

What we will do. We will promptly take reasonable steps to contain, investigate and mitigate the breach, keep you informed, and give you the information and help you reasonably need to meet your own obligations, including to notify supervisory authorities and affected individuals.

Who notifies. As the controller, you decide whether to notify authorities and individuals. We will not notify them about a breach of Customer Personal Data on your behalf without your agreement, unless the law requires us to.

What is not a breach. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as blocked sign-in attempts, pings, port scans or denial-of-service attacks, are not Personal Data Breaches.

Our notice or response to a breach is not an admission of fault or liability.

12. Requests from public authorities

If a court, regulator, law enforcement or other public authority asks us for Customer Personal Data, we will:

• direct it to request the data from you, where possible;
• tell you promptly, unless the law forbids it, and in that case try to get the prohibition lifted;
• review the request's lawfulness and challenge it where we believe there are reasonable grounds to; and
• disclose only the minimum the request lawfully requires.

We have not built any "back door" or similar way for public authorities to access Customer Personal Data.

13. Return and deletion

Return. While you have an account, you can export your leads and campaign results as CSV at any time. That is how we return Customer Personal Data to you.

Deletion during the Service. When you delete a lead, a campaign or other data in the app, we delete it from our live systems. When you disconnect your LinkedIn account, we delete its stored credentials and browser session right away. When you remove a mailbox, we delete its stored credentials and tokens.

Deletion at the end. When you delete your account, we delete Customer Personal Data from our live systems. If your access ends in another way under the Terms, you can export your data for 30 days afterwards (as section 17 of the Terms describes), and we then delete it from our live systems. In either case, encrypted backups roll over, and the data in them is gone within 30 days.

Exceptions. We may keep Customer Personal Data longer only:

• in server logs and error reports, which can contain fragments of it and are deleted on their normal cycle, within 90 days;
• where a law that applies to us requires it; or
• while it is needed to resolve a dispute or comply with a legal hold.

We will keep protecting any data we retain under this DPA, and use it only for the reason we kept it. Data for which we are the controller, such as billing records, is kept as our Privacy Policy describes.

Confirmation. On request, we will confirm deletion to you in writing.

14. Audits and information

Information first. We will make available to you the information reasonably necessary to show that we comply with this DPA and with the processor obligations of Data Protection Laws. This includes this DPA and its Annexes, answers to a reasonable security and privacy questionnaire (once a year, or after a Personal Data Breach), any independent audit reports or certifications we hold, and the audit reports our main Sub-processors publish (for example AWS's and Supabase's).

Annual report. On request, at most once a year, we will give you a written summary of how we meet our security obligations under this DPA and, where it applies, Israeli Privacy Law.

On-site audits. If the information above is not enough to show our compliance, or a supervisory authority requires it, you may audit our compliance yourself or through an independent auditor, on these terms:

• you give us at least 30 days' written notice and a proposed scope, which we agree in good faith;
• no more than once in any 12 months, unless a supervisory authority requires it or after a Personal Data Breach;
• during normal business hours, without unreasonably disrupting our operations;
• the auditor is bound by confidentiality and is not our competitor;
• the audit does not give access to other customers' data, or to our Sub-processors' facilities or systems (which are covered by their own audit reports); and
• you pay for the audit, including our reasonable costs of supporting it, which we will estimate in advance. If the audit finds that we materially breached this DPA, we bear our own costs.

You will share the audit's findings with us, and we will promptly fix any non-compliance it identifies. This section is how we meet the audit requirements of the SCCs (Clause 8.9) and of US State Privacy Laws.

15. International transfers

Where data is processed. Customer Personal Data is hosted in the United States (AWS and Supabase, region us-east-1). We are established in Israel, and our team may access it from there. Our Sub-processors process it in the locations listed in Annex III. You authorise these transfers, as long as they comply with this section.

Israel. The European Commission and the United Kingdom recognise Israel as providing an adequate level of data protection.

Transfers from the EEA and Switzerland. Where a Restricted Transfer of Customer Personal Data takes place from you to us (including to the infrastructure we use in the United States), the SCCs are incorporated into this DPA by reference and apply as follows:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor;
• you are the data exporter, and we are the data importer;
• Clause 7 (docking clause) applies;
• Clause 9: Option 2 (general written authorisation) applies, with the notice period in section 8;
• Clause 11: the optional wording does not apply;
• Clause 13: the competent supervisory authority is the one determined under Clause 13(a);
• Clauses 17 and 18: Option 1 applies; the SCCs are governed by the law of Ireland, and disputes go to the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annex I, Annex II and Annex III of this DPA.

For transfers subject to the FADP, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; references to the GDPR include the FADP; and "Member State" in Clause 18(c) includes Switzerland, so that data subjects in Switzerland can bring claims where they habitually reside.

Transfers from the UK. Where a Restricted Transfer is subject to UK Data Protection Law, the UK Addendum is incorporated into this DPA by reference and applies to the SCCs as set out above. Table 1 is completed with the parties' details in Annex I; Table 2 with the modules and options above; Table 3 with the Annexes of this DPA; and in Table 4, the importer may end the UK Addendum as its Section 19 allows.

Transfers to Sub-processors. Where we make a Restricted Transfer to a Sub-processor, we rely on an adequacy decision, the Sub-processor's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), or the SCCs (Module 3, with the UK Addendum where needed), or another lawful transfer mechanism.

Transfers from Israel. For transfers subject to the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, this DPA is our written commitment to protect Customer Personal Data as Israeli Privacy Law requires, and not to transfer it onward except to Sub-processors bound by equivalent commitments under section 8.

Other countries. Where another country's law restricts transfers, we will cooperate with you to put a lawful transfer mechanism in place. If a transfer mechanism we rely on stops being valid, we will work with you to move to another one.

If documents conflict. For a Restricted Transfer, the SCCs (and the UK Addendum) prevail over anything else in this DPA or the Terms.

16. US state privacy laws

Where US State Privacy Laws apply, we process Customer Personal Data as your service provider, contractor or processor, for the business purpose of providing the Service described in Annex I. We will not:

• sell or share it, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose other than the business purpose, including any commercial purpose other than providing the Service, or as US State Privacy Laws otherwise allow a service provider to;
• retain, use or disclose it outside our direct business relationship with you; or
• combine it with personal information we receive from or on behalf of anyone else, or collect from our own dealings with the individual, except as US State Privacy Laws allow.

We will also:

• comply with the obligations of US State Privacy Laws that apply to us, and give Customer Personal Data the level of privacy protection those laws require;
• tell you promptly if we decide that we can no longer meet those obligations, after which you may take reasonable and appropriate steps to stop and remediate any unauthorised use;
• let you take reasonable and appropriate steps to make sure we use Customer Personal Data in a way consistent with your obligations, through section 14;
• bind each person who processes it to a duty of confidentiality (section 6), and each Sub-processor to a written contract with obligations that meet those laws (section 8);
• delete or return it at the end of the Service (section 13), and help you respond to consumer requests (section 9) and with assessments (section 10).

We certify that we understand these restrictions and will comply with them.

17. Israel

Where Israeli Privacy Law applies, this DPA is the agreement between the database controller (you) and the holder (us) that the Privacy Protection (Data Security) Regulations, 5777-2017, require. It sets out the data we may process and why (Annex I), the systems and processing involved, how long the processing lasts, how data is returned and deleted at the end (section 13), the security measures we apply (Annex II), the confidentiality commitments of our staff (section 6), the use of Sub-processors (section 8), the reporting of security incidents (section 11), and an annual report on how we meet our obligations (section 14).

18. Liability

Each party's liability arising from or related to this DPA (including the SCCs and the UK Addendum, to the extent the law allows) is subject to the exclusions and limits in section 15 of the Terms, and counts toward the same overall limit. Nothing in this DPA limits either party's liability to data subjects under the SCCs, or any liability that cannot be limited by law.

19. Order of precedence

If there is a conflict between documents, this order applies: first the SCCs and the UK Addendum (for Restricted Transfers only), then this DPA, then the Terms. This DPA prevails over the Terms only on matters of data protection.

20. Term and changes

Term. This DPA lasts for as long as we process Customer Personal Data for you, including after the Terms end, until the data is deleted as section 13 describes.

Changes. We may update this DPA, for example to reflect a change in the law, a new transfer mechanism or a change to the Service. We will post the new version on this page with a new date. If a change is material, we will tell you by email or in the app at least 30 days before it takes effect, unless a shorter period is needed to comply with the law. We will not make a change that materially lowers the protection of Customer Personal Data unless the law requires it. If you do not agree to a change, you can cancel your subscription before it takes effect.

21. Governing law

This DPA is governed by the laws of the State of Israel, and the courts of the competent courts of Tel Aviv-Yafo, Israel have exclusive jurisdiction over any dispute arising from it, as section 19 of the Terms provides. The SCCs and the UK Addendum are governed by the law, and subject to the courts, that section 15 sets out.

22. Contact

Kifas Labs Ltd. Shikma 2, Dvira, Israel Privacy questions, objections and requests: support@activemanager.ai Legal notices and signed copies of this DPA: support@activemanager.ai Product support: support@activemanager.ai

Annex I: Description of the processing

A. The parties

Data exporter (controller, or processor where you act for your own clients): the customer that accepted the Terms, with the name, address and contact details on its Active Manager account. Activities: using Active Manager to run LinkedIn and email outreach. Signature and date: by accepting the Terms, which incorporate this DPA, on the date of acceptance.

Data importer (processor, or sub-processor where you act for your own clients): Kifas Labs Ltd., Shikma 2, Dvira, Israel. Contact: support@activemanager.ai. Activities: providing Active Manager, the cloud service at https://app.activemanager.ai. Signature and date: by publishing this DPA and providing the Service, on the date you accepted the Terms.

B. Description of the transfer and processing

Categories of data subjects

• Prospects and leads: people you import into Active Manager (for example from a LinkedIn search, a post or event, a CSV file or our API), enrich with the email finder, or contact through the Service.
• People who reply: people who answer an email or LinkedIn message sent through Active Manager, including someone replying on a lead's behalf.
• Your team members: the people you invite to your team, as their data appears in your workspace.
• Other people whose details you choose to include in notes, custom fields, messages or attachments.

Categories of personal data

• Identity and professional details: name, headline, job title, company, company domain, location, LinkedIn profile URL, member ID and photo, connection status, whether the profile is open or Premium.
• Contact details: email addresses (including work emails found and verified by the email finder) and phone numbers you provide.
• Message content: LinkedIn invitations and messages, emails and their attachments exchanged between you and the lead through Active Manager, and replies (for email, the reply text without the quoted history, plus message headers such as sender, recipient, subject and date).
• Engagement and campaign data: events such as "invitation sent", "invitation accepted", "message sent", "replied", "email delivered", "email bounced" or "unsubscribed"; email opens if you turn on open tracking, where available; campaign and sequence status; tags, notes and custom fields; and blacklist and suppression entries.
• AI outputs: reply classifications (for example "interested" or "out of office") and lead scores against the ideal customer profiles you describe.
• Team member data: name, email address, team role, and the campaigns, leads, messages and statistics in their workspace.

Sensitive data. None is intended. You must not upload or collect special categories of personal data, criminal conviction data, children's data, government identification numbers or financial account numbers (section 4).

Frequency of the transfer. Continuous, for as long as you use the Service.

Nature of the processing. Hosting and storage; importing and organising leads; finding and verifying email addresses; sending LinkedIn invitations, messages and other actions through your LinkedIn account, and emails through your mailbox, on your schedule; reading new incoming messages to match replies, bounces and unsubscribe requests to emails sent through Active Manager; classifying replies and scoring leads with AI; reporting statistics; sending data to the integrations you turn on; support; security; and deletion.

Purpose of the processing. To provide Active Manager to you under the Terms, as you instruct (section 5), and to keep it secure.

Duration and retention. For as long as you use the Service, and then until deletion under section 13. Records of actions and events are kept in full detail for 13 months, and after that only as aggregated counts for your statistics. Encrypted backups roll over within 30 days, and server logs and error reports within 90 days.

Transfers to Sub-processors. For the purposes, and in the locations, listed in Annex III, for as long as the processing lasts.

C. Competent supervisory authority

For the SCCs, the supervisory authority determined under Clause 13 of the SCCs. For the UK Addendum, the UK Information Commissioner. For Switzerland, the Federal Data Protection and Information Commissioner. For Israeli Privacy Law, the Privacy Protection Authority.

Annex II: Technical and organisational security measures

These are the measures we have in place as of the date at the top of this page. We may change them, but not in a way that lowers the overall protection of Customer Personal Data (section 7).

Hosting and environments

• The Service runs on Amazon Web Services and Supabase in the AWS us-east-1 region (United States), on managed infrastructure whose providers maintain their own physical and environmental security and publish independent audit reports.
• Production is separate from staging, which runs in a separate AWS account and database project. Development uses local emulators and a LinkedIn simulator, not production Customer Personal Data.
• Infrastructure is defined as code, and changes reach production through an automated pipeline with a manual approval step.

Encryption

• All data is encrypted in transit with TLS, and at rest in the database and in storage.
• LinkedIn passwords, authenticator keys, verification codes, browser sessions, mailbox passwords and Google tokens are encrypted with AWS Key Management Service (KMS) envelope encryption, with a separate data key for each account.
• Each encrypted secret is bound to its account and purpose, so it can only be decrypted for that account and that purpose.
• Only the service that uses a secret can decrypt it: the LinkedIn worker for LinkedIn credentials and sessions, and the email worker for mailbox credentials. The web API can encrypt these secrets but never decrypt them.
• Storage buckets block all public access and use server-side KMS encryption.

Access control and separation of customers

• Every table that holds customer data is protected by row-level security in the database, which allows access only to the account owner and to team members whose role permits it.
• Our API checks a signed sign-in token on every request and scopes every database query to the account it acts for. The browser never holds a service key.
• Each service has its own least-privilege cloud permissions and database role, limited to the named resources it needs. Service secrets are kept in AWS Secrets Manager.
• API keys are stored only as one-way hashes. Webhooks we send are signed (HMAC-SHA256) so you can verify that they came from us.

Authentication

• Sign-in is handled by Supabase Auth. Passwords are stored as one-way hashes, and we never see them.
• Two-factor authentication (TOTP) is available for every account, and required for our administrators.
• Sign-up, sign-in and password reset are protected by bot checks (Cloudflare Turnstile), rate limits and a check against known leaked passwords. A web application firewall and per-user and per-IP rate limits protect the Service.

Staff access

• Access to production systems and Customer Personal Data is limited to staff who need it, and is removed when they no longer do.
• Administrators use a separate admin console. Every time an administrator views an account as its user, it is recorded in an audit log, as are other sensitive actions.
• Staff and contractors are bound by confidentiality (section 6).

Data minimisation

• For a connected mailbox, we read only messages received from the time you connect it (at most two days earlier). Messages that do not answer an email sent through Active Manager are checked and discarded, not stored. For replies, we store the reply text without the quoted history.
• The LinkedIn inbox in Active Manager keeps only conversations with your leads.
• AI features send only the data the feature needs, and our AI provider may not use it to train its models. Email open tracking is off by default.
• LinkedIn traffic goes through a dedicated static IP address for each LinkedIn account, encrypted with HTTPS. Email traffic does not go through that proxy, and the email worker connects only to public mail servers, with TLS certificates checked.

Deletion and retention

• You can delete leads and other data at any time in the app, and delete your account from Account settings.
• Disconnecting LinkedIn deletes its stored credentials and every saved version of its browser session. Deleting an account deletes its credentials, sessions and leads, and releases its dedicated IP address.
• Records of actions and events are kept in full detail for 13 months, then reduced to aggregated counts.
• Backups roll over within 30 days, and logs and error reports within 90 days (section 13).

Availability and resilience

• The database has point-in-time recovery backups. Stored LinkedIn sessions are versioned so a bad save can be rolled back.
• Work is processed through queues with automatic retries. Safety limits and kill switches can pause an action across the Service if it starts to fail.

Monitoring and incident response

• Services write structured logs to AWS CloudWatch, and errors are tracked in Sentry. Alerts notify our team of failures and unusual activity.
• We have a process to detect, contain, investigate and recover from security incidents, and to notify you as section 11 describes. After an incident, we review what happened and fix the causes.

Secure development

• Every change passes automated checks before it is deployed, including type checks, unit tests, end-to-end tests and database tests of every row-level security rule.
• We scan our software dependencies for known vulnerabilities and update them.
• The Service is security-reviewed before public launch.

Sub-processors

• We check the security and privacy practices of each Sub-processor before we use it, and bind it by a written contract (section 8).

Annex III: Sub-processors

The current list of our Sub-processors is in the Sub-processors section of our Privacy Policy. That list is the one that applies. We will update it, and tell you, before adding or replacing a Sub-processor, as section 8 describes.

For your records, this is the list as of the date at the top of this page:

Not Sub-processors. Paddle processes billing data as an independent controller (section 3). LinkedIn, your email provider, and the integrations you turn on are services you choose and use under your own agreements with them.