Data processing addendum

Last updated: 26 Oct 2026

This Data processing addendum ("DPA") is part of the Terms of service between Purplead ("we", the Data Processor) and each client business that uses Purplead ("you", the Data Fiduciary). It covers the personal data of your leads and contacts that we process for you ("Client Data").

Roles

You decide why and how Client Data is collected and used. We process it only to provide Purplead to you, on your documented instructions given through the product settings, these Terms and your support requests, unless the law requires otherwise.

Your responsibilities

• Give your leads a privacy notice and have a lawful basis (usually consent) to collect and contact them, including on WhatsApp.
• Handle requests from your leads to access, correct or erase their data; Purplead lets you edit, export and delete leads.
• Only switch on integrations (such as the Meta Conversions API or WhatsApp) that you are allowed to use for your leads.

Our commitments

• Confidentiality: only people who need to, and who are bound by confidentiality, can access Client Data.
• Security: we keep reasonable security safeguards, including HTTPS encryption, encrypted secrets, hashed passwords, per-business access checks, role-based access and activity logs.
• Help: we help you answer your leads' rights requests and meet your duties under the DPDP Act, where the request concerns data we hold.
• Breaches: we tell you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Client Data, with the details we have, and help you notify the Data Protection Board and affected people.
• Logs: we keep processing logs for the period the DPDP Rules require (at least one year).

Sub-processors

We use these service providers to run Purplead:

• Hostinger: hosting, database and email servers.
• Razorpay: payments (billing data only, not lead data).
• Meta Platforms: Facebook, Instagram and WhatsApp APIs, only for the integrations you connect.
• Google: Gemini help assistant (only the questions you type) and YouTube video player on our website.

We bind them to protect data, and we will inform you by email or in-app notice before adding or replacing a sub-processor that handles Client Data, so you can object.

Transfers

Client Data may be processed outside India by sub-processors such as Meta and Google, only as allowed under Indian law.

End of service

When your account is closed, we delete Client Data within 30 days, except where the law requires us to keep it. Before closing, you can export your leads at any time.

Audits

On reasonable written request, once a year, we will answer questions about our security and data protection measures. We may ask you to keep this information confidential.

Liability

Liability under this DPA follows the limits in our Terms of service.