Legal
Data processing addendum
How we handle personal data you put into Linkubit, where you are the controller and we are the processor.
Draft — review required before launch
This text is written against what the system actually does, and every company-specific detail is left as a {{PLACEHOLDER}} to be filled in. It has not been reviewed by a lawyer, and DPDP and GDPR exposure here is real. Do not publish it as-is.
Last updated 16 August 2026
At a glance
- For your contacts and conversations, you are the controller and we are the processor — we act only on your instructions.
- We give notice before adding a subprocessor, help with data-subject requests, and notify you of breaches without undue delay.
- Security rests on database-enforced tenant isolation, encryption, managed secrets, and audit logging.
- Customer data is stored in India (ap-south-1); transfers elsewhere use a recognised mechanism where one is required.
- On termination everything is deleted within the stated window — except opt-out hashes, which protect the data subject.
1. Roles
For the contacts and conversations in your account, you are the controller and we are the processor. You decide who is contacted and why; we hold and move that data on your instructions. For your own account and billing data we are the controller — see the privacy policy.
2. Scope
| Subject matter | Providing the Linkubit platform |
|---|---|
| Duration | For as long as your account is active, plus the deletion window in the terms |
| Categories of data subject | Your contacts and prospects, and your staff users |
| Categories of data | Contact details, message content, consent records, activity history, and any qualification information you choose to capture |
| Special categories | None expected. Linkubit is not designed for special-category data and you should not put it here |
3. Our obligations
- Process personal data only on your documented instructions
- Keep the measures described in section 5 in place
- Bind everyone with access to confidentiality
- Give notice before engaging a new subprocessor, so you can object. The current list is published
- Help you respond to data-subject requests, and to regulators
- Notify you without undue delay if we become aware of a personal data breach
- Delete or return the data when the agreement ends
4. Your obligations
- Have a lawful basis for the people whose data you upload or contact
- Give the notices your own privacy law requires — Linkubit can send a consent notice on the first agent reply, and the wording is yours
- Respond to your own data subjects; we will help
5. Security measures
- Row-level tenant isolation in the database. Every row carries its owner, policies are enabled and forced, and the application connects with a role that cannot bypass them
- Encryption in transit and at rest
- Credentials in a managed secrets store, referenced not copied
- Audit logging of access and of every erasure
- Suppression stored as a one-way hash, so an opt-out contains no readable address
6. Transfers
Customer data is stored in India (ap-south-1). Some subprocessors operate elsewhere; where a transfer requires a mechanism such as standard contractual clauses, that mechanism applies.
7. Deletion
{{DELETION_WINDOW_DAYS}} days, except suppression hashes. Those contain no readable identifier and exist solely to stop someone who opted out from being contacted again — which is a protection for the data subject, not a retention of their data.8. Audit
We will respond to reasonable information requests about our processing. On-site audits are by arrangement and at your cost.
9. Contact
{{DPO_OR_PRIVACY_CONTACT}}