Data Processing Addendum

Version 1.0, September 18, 2026. Part of the Terms of Service.

This Addendum applies when ProspectDaily processes personal data on your behalf, which happens when you use LeadDaily: we send email from your own mailbox to your leads, read your mailbox to detect their replies, and keep your pipeline. For that processing you are the controller and ProspectDaily (operated by Brand State U, "we") is your processor. It is written to meet Article 28 of the GDPR and the UK GDPR and applies to every customer, wherever located.

It does not cover the prospect records we supply to you. For those we are a controller in our own right; our privacy policy sets out that processing, and once a record is delivered to you, you are a separate controller of your copy.

1. Details of the processing

Subject matter	Running LeadDaily for you: sending, scheduling and tracking your outreach; detecting replies, bounces and opt-outs in your connected mailbox; storing your leads, notes, tasks, files and sequences.
Duration	While your account is active, plus the retention period in section 8.
Nature and purpose	Storage, transmission on your instruction, automated classification of inbound mail (reply, bounce, out of office, opt-out), and display back to you. No decisions are taken about any individual.
Types of personal data	Business contact details of your leads (name, title, employer, work email, work phone, address, LinkedIn URL); the content of email you send them and they send you; open and click events; notes and files you add; the names and addresses of anyone who emails your connected mailbox, to the extent needed to match a message to a lead (unmatched messages are not stored).
Data subjects	Your leads and prospects; people who email your connected mailbox.
Your instructions	These Terms, your settings in the product, and the actions you take in it (sending, enrolling, connecting a mailbox). We process only on those instructions unless law requires otherwise, in which case we tell you first if we may.

2. Our obligations

Instructions only. We process your data only as described in section 1 and as you direct in the product. We do not use it for our own purposes, do not sell it, and do not use it to train models.
Confidentiality. Everyone with access to your data is bound by confidentiality. Operator access is limited to one named account and is used for support and to keep the service running.
Security. We apply the measures in section 6 and keep them current.
Sub-processors. We use only the sub-processors in section 5, under written terms at least as protective as this Addendum, and we remain responsible for them. We give at least 14 days' notice of a new sub-processor by email to your account address; you may object on reasonable data-protection grounds within that period, and if we cannot resolve it you may cancel without penalty.
Assistance with rights requests. If a person exercises a right (access, erasure, objection, portability) in respect of data we hold for you, we tell you within two business days and help you respond. A person can also use our own request page, which stops every ProspectDaily customer, including you, from emailing them and, if they choose, erases what we hold; we tell you when that happens to one of your leads.
Assistance with your obligations. We help you with security, breach notification and impact assessments to the extent the information is ours to give.
Breach notification. We tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know, what we have done and a contact.
Deletion at the end. When your account is cancelled, your leads, mail, notes, files, sequences, targeting and mailbox credentials are deleted 30 days after cancellation; billing records are kept for one year as tax law requires and then anonymised. You may export your leads before cancelling. Our suppression list keeps the addresses of people who have opted out, because that is how their opt-out is honoured.
Information and audit. We give you the information reasonably needed to show compliance with this Addendum. Where that is not enough for a specific legal obligation, we allow an audit by you or an auditor you mandate, once a year, on 30 days' notice, during business hours, at your cost, under confidentiality.

3. Your obligations

You are responsible for the lawfulness of your outreach, including the e-privacy rules that apply where your leads are (for example UK PECR, and the national laws implementing the EU ePrivacy Directive), and for having a lawful basis for the personal data you add to LeadDaily.
You honour opt-outs. The product stops a sequence on any reply and on a STOP; you must not re-add or re-contact someone who has objected.
You give us only lawful instructions and keep your account credentials safe.

4. Mailbox access

Connecting a mailbox authorises us to send from it on your instruction and to read it for replies, bounces and opt-outs. For Microsoft mailboxes we use the permissions you grant at sign-in (read mail, send mail); for Google mailboxes we use an app password over IMAP and SMTP and never send cold email through Google's API; for other providers we use the SMTP and IMAP details you give. We also read your Sent Items to notice when you have written to a lead yourself, so automation stops. You can disconnect at any time from Settings, which revokes our access. We do not store messages that do not concern a lead.

5. Sub-processors

Render	Hosting and database (United States).
Google	Google Workspace Drive for the report documents delivered to you; Google mail services where you connect a Google mailbox.
Microsoft	Microsoft Graph where you connect a Microsoft mailbox (your own tenant).
Resend	Transactional and service email from us to you (United States).
Anthropic	AI drafting and grading of emails you ask it to write or grade, and the in-app support assistant (United States). Inputs are not used to train models.
Stripe	Billing (independent controller for payment data).

Data-source providers (from whom we license prospect records) are not sub-processors of your data; they are listed in the privacy policy.

6. Security measures

Encryption in transit (TLS) for every connection; database and file storage on managed, access-controlled infrastructure.
Mailbox credentials and OAuth tokens stored encrypted; passwords hashed; secrets held outside the codebase.
Application security headers and content security policy; login rate limiting; signed session cookies; a private code repository; automated tests run on every deployment.
Access limited to one operator account; per-account data isolation in every query.
Daily monitoring of delivery, sending health and bounce and complaint rates; automatic stand-down of a mailbox that hits a provider limit.

7. International transfers

We are established in the United States and process data there. For personal data of people in the United Kingdom, the European Economic Area or Switzerland, the parties enter into the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two, controller to processor) and, for UK data, the UK International Data Transfer Addendum to them, which are incorporated by reference with you as data exporter and us as data importer, Annex I completed by section 1 and Annex II by section 6 of this Addendum. If we certify to the EU-US Data Privacy Framework and its UK Extension, we may rely on that certification instead and will say so in the privacy policy.

8. Retention

Working data is deleted 30 days after cancellation and billing records anonymised after one year (section 2.8). While your account is active, the bodies of lead email older than 18 months are removed (the subject and date stay so your timeline reads correctly), and per-prospect detail in reports older than 18 months is removed. A record that the person was supplied to you is kept so we never supply them to you twice; on a request from that person it is reduced to a one-way hash.

9. General

This Addendum forms part of the Terms and prevails over them on the subject of personal data. It is governed by the same law as the Terms. We may update it to reflect changes in law or in the service; material changes are notified to your account address and by the version date above. Liability under this Addendum is subject to the limitation in the Terms.

10. Contact

hello@prospectdaily.com. Representatives in the EU and UK, once appointed, are named in the privacy policy.