Data processing agreement
How we handle your leads' personal data on your behalf. It is part of the terms of service and applies to every workspace automatically.
1. Roles
You, the business using Streakstone, decide why and how your leads' personal data is processed: you are the data fiduciary (the controller). Streakstone processes it only on your behalf: we are your data processor. This agreement follows India's Digital Personal Data Protection Act, 2023 and its Rules, and the equivalent duties of a processor under other data protection laws that apply to you.
2. What we process
| Whose data | People who enquire with your business (leads), and your own team members |
|---|---|
| What data | Name, mobile number, email, city or postcode, form answers, ad and click identifiers, WhatsApp messages, call transcripts, scores, appointments, check-ins and the outcomes your team records |
| What for | Checking leads, contacting them on WhatsApp and by phone in your name, scoring, booking, delivering them to your team and systems, and reporting outcomes to your ad accounts |
| How long | While your workspace is open, then as section 8 says |
3. Your instructions
We process lead data only to provide Streakstone to you. The settings you choose in your workspace (rules, questions, calling hours, connections and destinations) are your instructions. We do not use your lead data for any purpose of our own and do not sell it. It is never combined with another business's data, except to work out the middle values in the "How you compare" panel, which appear only across at least five businesses and never show one business's figures. If we believe an instruction breaks the law, we will tell you.
4. Your part
You make sure you have a lawful basis for every lead you send to Streakstone, in particular consent to be contacted on WhatsApp and by phone, and verifiable parental consent for anyone under 18. You answer the people whose data it is, and we help you (section 7).
5. People who handle it
Only our staff who need lead data to run or support Streakstone can reach it, and each of them is bound to keep it confidential.
6. Security
- Encrypted connections for every page, API call and webhook.
- Keys and access tokens encrypted at rest with AES-256-GCM; passwords stored only as salted scrypt hashes.
- Every workspace's data separated, and access by role inside it.
- Webhooks from Meta and payment providers checked against their signatures; requests without a valid signature are refused.
- A log of sign-ins, settings changes and errors, kept for at least one year.
- Database backups by our database provider.
7. Helping you
We help you answer requests from your leads to see, correct, update or delete their data, and to withdraw consent. Where Streakstone cannot do something from the workspace, write to the contact details below and we will do it within 7 days.
8. Breaches
If we become aware of a breach affecting your lead data, we will tell you without delay and in any case within 24 hours, with what happened, what data and how many people are affected, what we have done and what you may need to do, so that you can inform the Data Protection Board of India and the people affected as the law requires. We will keep you updated as we learn more.
9. Sub-processors
You allow us to use these sub-processors for the purposes shown. Each is bound to protect the data at least as well as this agreement requires.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database | Mumbai, India |
| Vercel | Application hosting | India and other regions |
| Meta (WhatsApp Business Platform) | WhatsApp messages | Global |
| Bolna and its telephone partners | AI phone calls | India |
| Anthropic | Reading transcripts into answers | United States |
We will update this list here at least 15 days before a new sub-processor starts handling lead data. If you object for a reasonable data protection reason and we cannot address it, you may end your plan without penalty. Destinations you add yourself (your CRM, Google Sheet, webhook, Meta and Google ad accounts) receive data on your instruction and are your own providers, not ours.
10. Outside India
Lead data is stored in India. Some sub-processors process it outside India, as the table shows. We do not transfer it to any country the Government of India restricts.
11. When your workspace closes
For 30 days after your workspace closes you can ask for a copy of your lead data. After that we delete it, except copies in backups, which expire on our database provider's schedule, and records the law requires us to keep.
12. Showing we comply
On request we will give you the information you reasonably need to show that this agreement is met, and answer a security questionnaire once a year, on 30 days' notice.
13. Everything else
The terms of service, including the limit on liability, apply to this agreement. Where this agreement and the terms differ on personal data, this agreement wins.
Contact
- Streakstone