This Data Processing Addendum ("DPA") applies where Indicato processes personal data on behalf of a subscribing organization in connection with the Service. For account and usage data you submit, you act as the controller and Indicato as the processor; for the business-contact records contained in the product itself, Indicato acts as an independent controller of publicly-sourced and licensed data.
We process customer personal data only to provide, secure and support the Service, per your documented instructions and this DPA. Personnel with access are bound by confidentiality obligations, and access is role-restricted and audit-logged.
We use vetted sub-processors to operate the Service — including cloud hosting, Stripe (payments), Google Analytics and PostHog (product analytics), and email delivery providers. A current list is available on request; we will notify subscribers of material changes.
Technical and organizational measures include encryption in transit, hashed credentials, role-based access control, single-active-session enforcement, audit trails and environment separation between preview and production systems.
On termination or verified request, customer personal data is deleted or anonymized within 90 days except where retention is legally required. We reasonably cooperate with audits and data-protection impact assessments. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses.