Data Processing Addendum

1. Scope of the processing

• Subject matter: hosting capture pages and storing, displaying and exporting the leads you collect.
• Duration: for as long as your account is active, plus the deletion windows described below.
• Data subjects: the visitors who submit your capture forms and the visitors of your public profile.
• Data types: name, email address, any custom form fields you define, submission date, approximate country and referring source.

2. Our commitments

• We process lead data only on your documented instructions, which include your use of the product's features.
• Everyone with access is bound by confidentiality.
• We apply appropriate technical and organisational measures: TLS in transit, encryption at rest, row-level security so no other account can read your leads, signed and expiring file URLs, and least-privilege access to production.
• We assist you with data subject requests, security assessments and breach notifications, taking into account the nature of the processing.
• We notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your leads.

3. Subprocessors

You authorise the following subprocessors, each bound by equivalent data protection obligations. We will announce additions in advance so you can object.

• Supabase — database, authentication and file storage.
• Cloudflare — hosting and content delivery.
• Polar — subscription billing (account owners only, not leads).
• Our transactional email provider — delivery of the lead magnet by email when you enable that option.

4. International transfers

Where a subprocessor processes data outside the EEA, transfers are covered by the Standard Contractual Clauses together with supplementary technical measures.

5. Deletion and return

You can export your leads as CSV at any time and delete individual leads, whole campaigns or your entire account from the dashboard. On account deletion we permanently remove lead data from production within 30 days, including rotating backups.

6. Audits

On reasonable written request, and no more than once a year, we will provide the information needed to demonstrate compliance with this addendum. Requests go to privacy@zenndy.com.

7. Order of precedence

If this addendum conflicts with the Terms of Service regarding the processing of personal data, this addendum prevails.