Data Processing Addendum

How personal data is processed when you use this deployment to handle investor information.

Roles

You are the data controller for the investor and contact data you enter. This deployment acts as the processor, handling that data only to provide the service.

Scope of processing

Names, email addresses, phone numbers, company details, notes, agreement dates and brochure enquiries, processed for the duration of your use of the service.

Sub-processors

The database host you configure, and — for property lookups only — the public data sources listed in the Privacy Policy. No contact data is shared with them.

Security

Account authentication is handled by Clerk. Sessions are cookie-based. Every server function checks that the signed-in account owns the record before reading or writing it. MCP ingest keys are hashed at rest and can be revoked from Profile.

Data subject requests

Contacts can be exported or deleted from the CRM at any time. Deleting a contact removes their activity timeline and document-send history with them.

This is a self-hosted deployment. Replace this page with your own reviewed wording before you take it live.