Data processing agreement

• You determine the purposes and means of processing audience data (you are the controller). CrowdPipe processes it only to provide the service (CrowdPipe is the processor).
• Subject matter: operating live polls, scorecards, email capture, result delivery, and lead management for your events.
• Data subjects: your audience members and the contacts you enter.
• Categories: first and last name, email address, company, company size, job title, poll and scorecard answers, computed scores, link-click events, IP address and device data in logs.
• Duration: for as long as you have an account, plus the deletion period in section 8.

CrowdPipe processes personal data only on your documented instructions, which are the terms of service, this DPA, and your configuration of the product (for example, which questions to ask and which emails to send). We will tell you if we believe an instruction breaks the law.

People who can access personal data on our side are bound by confidentiality obligations and access only what they need to operate and support the service.

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Workspace isolation enforced in the database with row-level security; no query can read another customer's rows.
• Audience-facing endpoints expose aggregated results only; names and emails are never readable without an authenticated workspace session.
• Rate limiting on all public write endpoints.
• Automated monitoring with alerting to the operator when the database becomes unreachable.
• Least-privilege access to production; secrets held in the hosting provider's encrypted configuration, never in source code.
• An append-only audit log of changes made by AI features on your behalf.

You authorize the subprocessors listed in our privacy policy (Vercel, Supabase, Resend, Stripe, Upstash, Anthropic). We will notify customers by email at least 14 days before adding a subprocessor that will process personal data. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected service and receive a pro-rated refund of prepaid fees.

Taking into account the nature of the processing, we will assist you with data subject requests (the product lets you export, correct, and delete leads directly), with security and breach obligations, and with data protection impact assessments where relevant, at no charge for reasonable requests.

If we become aware of a personal data breach affecting your data we will notify you without undue delay and within 72 hours, describe what happened and what data is affected, and share the steps we are taking. We will not notify data subjects or regulators on your behalf unless you ask us to or the law requires it.

You can export all lead data as CSV at any time. When the service ends we delete personal data within 30 days, and from backups within a further 30 days, unless the law requires longer retention.

On written request, no more than once a year unless required by a regulator, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including our subprocessors’ current security certifications. Where that is insufficient, we will allow an audit by you or an independent auditor you appoint, at reasonable times and on reasonable notice, subject to confidentiality.

Processing takes place in the United States. Where personal data originates from the EEA, UK, or Switzerland, the parties rely on the Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, which are incorporated by reference, with you as data exporter and CrowdPipe as data importer.

Where the CCPA/CPRA or a similar state law applies, CrowdPipe acts as a service provider. We will not sell or share personal data, retain, use, or disclose it outside the direct business relationship, or combine it with data from other sources except as permitted by that law.

Liability under this DPA is subject to the limitations in the terms of service. If this DPA conflicts with the terms, this DPA prevails for data protection matters.