App Privacy Policy Terms of Service Data Processing Addendum Security Overview

Data Processing Addendum (DPA)

Version: 1.3 · August 2026 · Aligned to Lazarus Deal Recovery (guest freemium + optional accounts)
Processor: Lazarus Deal Recovery — Lazarus Revenue Intelligence Inc., Ontario, Canada
Contact: support@getldr.ca

Trust Pack: DPA-001 · Incorporates Security Overview SEC-001 by reference

This DPA forms part of the agreement between Customer (Controller) and Lazarus Deal Recovery (Processor) for B2B use of the Lazarus Deal Recovery revenue intelligence / deal recovery service. It supplements the Terms of Service and Privacy Policy.

1. Roles and scope

Customer	Data Controller for personal data in uploaded recordings, transcripts, and related content
Lazarus Deal Recovery	Data Processor — processes personal data only on Customer’s documented instructions
Scope	Per-deal transcription (when audio uploaded), AI-assisted extraction, deterministic scoring, optional account persistence of analysis outputs, optional CRM deal-link metadata, optional account-signal enrichment, rescue feedback metadata — not CRM-wide continuous monitoring or silent mailbox scraping
Guest use	Guest (unauthenticated) analyses are processed to return a report and are not saved to a Customer account; limited security/abuse logs may still be retained

2. Customer instructions & recording consent

Customer is solely responsible for obtaining all legally required consents and permissions to record, upload, and analyze call content — including PIPEDA, U.S. state wiretap laws, employment agreements, and end-customer contracts.

Customer’s upload of content constitutes instruction to process that data for the service. Lazarus Deal Recovery does not verify consent. See Terms §2.

3. Processor obligations

Process personal data only to provide the service and as documented in this DPA
Not sell personal data or use it for advertising
Not use Customer content to train public AI models
Ensure personnel with data access are bound by confidentiality
Assist Customer with reasonable data subject requests (at Customer’s expense if excessive)
Delete or return data upon termination per §8 below

4. Security measures

Lazarus Deal Recovery implements technical and organizational measures described in Security Overview (SEC-001), including:

TLS 1.3 encryption in transit
AES-256 encryption at rest (infrastructure provider) for stored account data
Row-Level Security (RLS) tenant isolation on customer tables; signed-in saves scoped by user_id
Server-side-only privileged credentials (service role never exposed to browsers)
Grounding audit and anti-hallucination controls on AI outputs
Scheduled transcript retention purge (default 30 days for raw transcript text on saved records)

5. Sub-processors

Sub-processor	Purpose	Data processed
Supabase Inc.	Database, auth, storage	Account data, transcripts (when saved), analysis JSON, CRM link metadata
Google LLC (Gemini API)	LLM text extraction	Transcript text (ephemeral API call)
AssemblyAI	Speech-to-text when Customer uploads audio	Audio content (ephemeral API call; not stored by Lazarus Deal Recovery)
Google LLC (Gmail / Meet)	Optional read-only mailbox / meeting connect	Thread or meeting text authorized by Customer
Microsoft Corporation (Graph)	Optional read-only Outlook / Teams connect	Conversation or meeting text authorized by Customer
Zoom Video Communications	Optional live RTMS transcript stream	Live transcript turns during Customer-started sessions
HubSpot, Inc.	Optional read-only deals + notes import	Deal metadata and note text authorized by Customer

Lazarus Deal Recovery will notify Customer of intended changes to sub-processors. Customer may object on reasonable grounds related to data protection.

6. Data location

Default: North America (United States / Canada regions as configured in Supabase).
Alternative regions: available upon written agreement for enterprise customers.

7. Personal data breach

Lazarus Deal Recovery will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data, and will provide information reasonably available to assist Customer in meeting its regulatory obligations.

8. Deletion and return

Trigger	Action	Timeline
Contract termination	Delete Customer personal data from production systems	Within 30 days
Written deletion request	Delete specified data where technically feasible	Within 30 days
Retention policy	Automatic nulling of raw transcript text on saved records	Default 30 days from creation
Guest runs	No account-persisted analysis JSON to delete	N/A (ephemeral processing)

Analysis metadata and anonymized rescue vectors may be retained where they no longer contain personal data.

9. Audits

Upon reasonable notice, Customer may request information necessary to demonstrate compliance with this DPA. Formal on-site audits may be conducted no more than once per year unless required by regulators, subject to confidentiality and scheduling constraints.

10. International transfers (GDPR)

Where GDPR applies, parties will execute Standard Contractual Clauses or another valid transfer mechanism upon request. Until then, this DPA reflects Processor obligations consistent with Article 28.

11. Term

This DPA remains in effect for the duration of the service agreement. Sections on confidentiality, deletion, and liability survive termination as applicable.

12. Signatures (enterprise)

For pilot/self-serve use, acceptance of Terms constitutes acceptance of this DPA. For annual or enterprise deals, execute below:

Customer	Name: _______________ Title: _______________ Date: _______________
Lazarus Deal Recovery	Name: _______________ Title: _______________ Date: _______________

Review with legal counsel before regulated-industry deployments, government contracts, or deals involving large volumes of recorded calls. This DPA is not a substitute for executed SCCs where required.