Data processing agreement
Last updated October 15, 2026
This data processing agreement ("DPA") is between the customer that accepts it ("you", the controller) and Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA ("we", the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing Programmable. To accept it, email support@programmable.you from your account's address with your company name; we'll countersign and return a copy. It applies from that date, and to processing that has already taken place under your account.
1. What we process for you
- Subject matter and purpose: building the sheets, monitors and lookups you ask for, and delivering the results where you tell us to (the app, a download, your webhook, a CRM or spreadsheet you connect).
- Personal data: business contact details in the lists you provide (names, work emails, job titles, profile URLs, company) and the equivalent details found for the people you look up. No sensitive categories (health, religion, politics, sexual orientation and the like); the service must not be used to look up such data. No data about people located in the EU, the EEA or the UK, or at companies based there: the service skips them and you must not upload them.
- Data subjects: your prospects, customers, contacts and their colleagues; your own team members.
- Duration: the moment of each request. Rows are streamed to you and not stored. Account records are kept for the life of your account and deleted within 30 days of its closure, except billing records kept for tax and accounting purposes.
2. Our obligations as processor
- We process personal data only on your documented instructions, which are the Terms, this DPA, and what you ask the service to do. We'll tell you if we think an instruction breaks the law.
- We keep the personal data we process for you confidential, and everyone who works on the service is bound by confidentiality.
- We keep the security measures in section 5, and won't reduce them during the term.
- We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the service allows and given what we hold (which for rows is nothing).
- We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we're doing.
- On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it. Rows were never kept.
- We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.
3. Your obligations as controller
You are responsible for having a lawful basis for the personal data you provide and look up, for honouring the rights of the people concerned, and for using results in line with the law (including direct marketing rules). You warrant that your instructions to us are lawful.
4. Subprocessors
You authorise the subprocessors below. We'll email account owners at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can't resolve it, end the affected service.
| Subprocessor | Purpose | Location |
|---|---|---|
| OVHcloud | Servers: the app, its database and sign-in (self-hosted) | US (Virginia) |
| Backblaze | Encrypted database backups | US |
| Supabase, Hetzner | Previous database and servers, being retired (copies deleted by October 31, 2026) | EU (Sweden, Finland) |
| Cloudflare | Network, TLS, bot protection | Global edge; EU/US |
| Stripe | Payments and subscriptions | US / EU |
| Resend | Transactional email (invites, notices) | US |
| Zoho | Account and support email | US / EU |
| Serper, Brave or Jina | Web search and reading public web pages for Find people, discovery and AI research (search terms and page addresses only) | US |
| Sentry | Error reports with keys and personal data removed | US / EU |
| logo.dev | Company logos (domain names only) | US |
Providers you connect with your own keys (Apollo, Hunter, People Data Labs, BuiltWith, eBay, Amazon, Anthropic, OpenAI, Google and others) and the CRMs and spreadsheets you send rows to are engaged by you directly and are not our subprocessors.
5. Security measures
- Rows are processed in memory and streamed; they are not written to a database or to disk.
- Encryption in transit everywhere (TLS 1.2+); provider keys and secrets encrypted at rest in a secrets vault; API keys stored as hashes.
- Servers reachable only through Cloudflare; firewalling on ingress and egress; SSH by key only; no shared accounts.
- Access to production is limited to the people who operate the service, with logging.
- Error reports have keys and personal data stripped before they leave the server.
- Opt-out list applied to every result; a person can opt out at /opt-out.
6. Where data is processed
Our servers, database and authentication are in the United States (Virginia), and our subprocessors are listed in section 4. The service is offered for personal data about people outside the EU, the EEA and the UK; it is not designed for, and must not be used to process, personal data of people located in those regions, and we make no representation about compliance with their data protection laws.
7. General
If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 6 says otherwise. Questions: support@programmable.you.