Home Privacy Policy Terms of Service Data Processing Addendum Security Overview

Data Processing Addendum (DPA)

Version: 1.4 · October 2026 · Aligned to the current deal-recovery service
Processor: Lazarus Deal Recovery — Lazarus Revenue Intelligence Inc., Ontario, Canada
Contact: support@getldr.ca

Trust Pack: DPA-001 · Incorporates Security Overview SEC-001 by reference

This DPA forms part of the agreement between Customer (Controller) and Lazarus Deal Recovery (Processor) for B2B use of the Lazarus Deal Recovery revenue intelligence / deal recovery service. It supplements the Terms of Service and Privacy Policy.

1. Roles and scope

Customer	Data Controller for personal data in uploaded recordings, transcripts, and related content
Lazarus Deal Recovery	Data Processor — processes personal data only on Customer’s documented instructions
Scope	Per-deal transcription (when audio uploaded), AI-assisted extraction, deterministic scoring, optional account persistence of analysis outputs, optional CRM deal-link metadata, optional account-signal enrichment, rescue feedback metadata — not CRM-wide continuous monitoring or silent mailbox scraping
Guest use	Guest (unauthenticated) analyses are processed to return a report and are not saved to a Customer account; limited security/abuse logs may still be retained

2. Customer instructions & recording consent

Customer is solely responsible for obtaining all legally required consents and permissions to record, upload, and analyze call content — including PIPEDA, U.S. state wiretap laws, employment agreements, and end-customer contracts.

Customer’s upload of content constitutes instruction to process that data for the service. Lazarus Deal Recovery does not verify consent. See Terms §2.

3. Processor obligations

Process personal data only to provide the service and as documented in this DPA
Not sell personal data or use it for advertising
Not use Customer content to train public AI models
Use the call, email, or notes only to say whether the deal is recoverable or a flat no, what is blocking it, and what to do next, then not save the raw transcript or the evidence-quote fields. The summary, scores, and next actions may be saved
Ensure personnel with data access are bound by confidentiality
Assist Customer with reasonable data subject requests (at Customer’s expense if excessive)
Delete or return data upon termination per §8 below

4. Security measures

Lazarus Deal Recovery implements technical and organizational measures described in Security Overview (SEC-001), including:

TLS 1.3 encryption in transit
AES-256 encryption at rest (infrastructure provider) for stored account data
Row-Level Security (RLS) tenant isolation on customer tables; signed-in saves scoped by user_id
Server-side-only privileged credentials (service role never exposed to browsers)
Grounding audit and anti-hallucination controls on AI outputs
Source evidence is not saved: transcript text, evidence quotes, and CRM payloads are dropped after the report is written

5. Sub-processors

Sub-processor	Purpose	Data processed
Supabase Inc.	Database, auth, storage	Account data, saved report (scores, status, rescue tasks), CRM link metadata. Transcripts and evidence quotes are not stored
Render	API application hosting	Application logs and request metadata; Customer data in transit to the API
GitHub, Inc. (Pages)	Static site hosting	No Customer deal data; public marketing and app UI assets
Cloudflare, Inc.	Turnstile bot protection on analysis submit	Bot-check tokens; IP as processed by Cloudflare
Stripe, Inc.	Payment processing when checkout is used	Billing identifiers and payment status (not full card numbers)
Google LLC (Gemini API)	LLM text extraction for paid runs	Transcript text (ephemeral API call)
OpenRouter	Free-tier model routing under a no-training, zero-retention request	Transcript text (ephemeral API call). Paid runs use Gemini.
AssemblyAI	Speech-to-text when Customer uploads audio	Audio content (ephemeral API call; not stored by Lazarus Deal Recovery)
Google LLC (Gmail / Meet)	Optional read-only mailbox / meeting connect	Thread or meeting text authorized by Customer
Microsoft Corporation (Graph)	Optional read-only Outlook / Teams connect	Conversation or meeting text authorized by Customer
Zoom Video Communications	Optional live RTMS transcript stream	Live transcript turns during Customer-started sessions
HubSpot, Inc.	Optional read-only deals and notes; a note is written only when Customer pushes the plan	Deal metadata and note text authorized by Customer
Salesforce	Optional CRM connect; a note is written only when Customer pushes the plan	Deal metadata and note text authorized by Customer

Lazarus Deal Recovery will notify Customer of intended changes to sub-processors. Customer may object on reasonable grounds related to data protection.

6. Data location

Default: North America (United States / Canada regions as configured in Supabase).
Alternative regions: available upon written agreement for enterprise customers.

7. Personal data breach

Lazarus Deal Recovery will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data, and will provide information reasonably available to assist Customer in meeting its regulatory obligations.

8. Deletion and return

Trigger	Action	Timeline
Contract termination	Delete Customer personal data from production systems	Within 30 days
Written deletion request	Delete specified data where technically feasible	Within 30 days
Retention policy	The raw transcript is not saved. Evidence-quote fields are removed before the row is stored. The summary, scores, and next actions are kept. The report stays while the deal is open. When HubSpot or Salesforce marks the deal complete, the report is deleted then. Otherwise it is deleted 30 days after a win or a flat no. A stalled or recoverable deal is not on that clock	At save time for source evidence. 30 days after won or a flat no for the report
Guest runs	No account-persisted analysis JSON to delete	N/A (ephemeral processing)

This addendum covers the hosted app. A company key lets a server post a deal into that app. The call is sent here, then to Google Gemini for scoring. Lazarus Deal Recovery saves the report in the Lazarus database and does not save the transcript. The key is shown once. Lazarus Deal Recovery stores a hash of the key, not the key. The key does not put the portal on the customer’s server.

A standalone install is the same app on the customer’s server, writing to a database they own. The company key does not create that install. This addendum does not cover that install.

Analysis metadata and anonymized rescue vectors may be retained where they no longer contain personal data.

This DPA does not include a HIPAA business associate agreement or SSO. We do not claim a finished GDPR certification. Where GDPR applies, section 10 below is the transfer position.

9. Audits

Upon reasonable notice, Customer may request information necessary to demonstrate compliance with this DPA. Formal on-site audits may be conducted no more than once per year unless required by regulators, subject to confidentiality and scheduling constraints.

10. International transfers (GDPR)

Where GDPR applies, parties will execute Standard Contractual Clauses or another valid transfer mechanism upon request. Until then, this DPA reflects Processor obligations consistent with Article 28.

11. Term

This DPA remains in effect for the duration of the service agreement. Sections on confidentiality, deletion, and liability survive termination as applicable.

12. Signatures (enterprise)

For pilot/self-serve use, acceptance of Terms constitutes acceptance of this DPA. For annual or enterprise deals, execute below:

Customer	Name: _______________ Title: _______________ Date: _______________
Lazarus Deal Recovery	Name: _______________ Title: _______________ Date: _______________

Review with legal counsel before regulated-industry deployments, government contracts, or deals involving large volumes of recorded calls. This DPA is not a substitute for executed SCCs where required.