Data Processing Addendum

Version 1.0 · Effective date: October 31, 2026

This Data Processing Addendum ("DPA") forms part of the agreement under which a business ("you", the "Customer") uses the Leads 2 Build platform (the "Service") provided by Leads 2 Build, a product of CYA ("we", "us"). It applies whenever the Service processes personal information on your behalf — for example about your customers and leads, your crews and staff, your subcontractors and suppliers. If this DPA conflicts with our Terms of Service on a data-protection matter, this DPA controls.

1. Roles

1.1 For personal information you put into the Service, or that the Service collects for you (your "Customer Personal Data"), you are the controller (a "business" under California law and the organization accountable for it under Canadian law) and we are your processor (a "service provider" or "contractor").

1.2 For information about your own account users that we need to run and bill the Service, and about our marketing and sales contacts, we are an independent controller and our Privacy Policy applies.

2. Our obligations as processor

2.1 Instructions. We process Customer Personal Data only to provide, secure and support the Service, on your documented instructions. Your instructions are this DPA, the Terms of Service, and the way you configure and use the Service. If we believe an instruction breaks the law we will tell you.

2.2 No selling or sharing. We do not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for our own marketing, or combine it with personal information we receive from other sources except as needed to provide the Service. We do not use it to train artificial-intelligence models.

2.3 Confidentiality. Everyone at Leads 2 Build who can access Customer Personal Data is bound by a written confidentiality obligation and accesses it only when needed to provide or support the Service.

2.4 Security. We maintain the technical and organizational measures in Annex 2 and will not materially reduce the overall protection they give during the term.

2.5 Help with requests. The Service lets you find, correct, export and delete the records you hold. If a person contacts us directly about Customer Personal Data, we will pass the request to you within 5 business days and will not answer it ourselves unless you ask us to or the law requires it. We will reasonably help you respond to requests and complete any privacy impact assessment the law requires of you.

3. Subprocessors

3.1 You authorize us to use the subprocessors on our subprocessor list. We share Customer Personal Data with each only to the extent needed for the purpose shown there, under their data-processing or service terms, and we remain responsible for their performance of our obligations.

3.2 We will update the list and email your account owner at least 30 days before a new subprocessor starts processing Customer Personal Data. In an emergency, such as replacing a vendor that has failed, we will give notice as soon as we can.

3.3 You may object in writing to legal@leads2build.com during the notice period. We will work with you in good faith to resolve the objection; if we cannot, you may stop using the affected part of the Service or end your subscription.

4. Security incidents

4.1 If we confirm a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to your Customer Personal Data, we will notify your account owner without undue delay and no later than 72 hours after confirming it.

4.2 The notice will describe what happened, the categories and approximate number of people and records involved, the likely consequences, what we have done and will do, and a contact for more information. Where we do not have all the facts at first, we will send them as we learn them.

4.3 We will reasonably help you meet any obligation you have to notify regulators or individuals. Notifying people whose information is in your account is your decision as controller unless you ask us to do it or the law places the duty on us.

5. Return and deletion

5.1 During the term. You can export your account data from inside the Service, and delete individual records, at any time.

5.2 When your subscription ends. We send reminder emails, and we delete your account and its Customer Personal Data — database records, stored files and call recordings — 60 days after cancellation. You may ask us to delete it sooner by writing to privacy@leads2build.com.

5.3 Account deletion by the owner. If your account owner deletes the account from inside the Service, deletion starts after a 24-hour window in which it can be called off.

5.4 Backups and legal holds. Deleted data remains in encrypted backups until those backups expire on their normal cycle (7 days for our database provider's backups, up to 12 months for monthly archive copies). Backups are not used for any other purpose and are restored only to recover from a disaster; if that ever happens we re-apply deletions made since. We keep records only where the law requires it (for example payment and tax records), and only for that purpose.

6. Information and audits

6.1 We will make available the information reasonably needed to show that we meet this DPA: our Information Security overview, answers to one reasonable written security questionnaire a year, and summaries of independent assessments when we have them. We are preparing for a SOC 2 examination covering all five Trust Services categories; we do not yet hold a report.

6.2 Where the law requires an audit beyond that information, it will be at your cost, on 30 days' written notice, during business hours, limited to records relevant to your data, and under a confidentiality agreement.

7. International transfers

We are based in Canada and the Service, with our subprocessors, processes data in the United States. Where the law that applies to you requires a transfer mechanism, we will rely on the one that law provides, and our subprocessors' commitments.

8. Your responsibilities

You are responsible for having a lawful basis for the Customer Personal Data you put into the Service; for the notices and consents your customers and crews are owed (including consent to receive text messages and notice that calls are recorded); for managing who in your company has access and at what role; for turning on two-step sign-in for owners and admins; for keeping the accounts you connect to the Service secure; and for telling us promptly if you suspect misuse of your account.

9. General

This DPA lasts as long as we process Customer Personal Data for you. The limits of liability in the Terms of Service apply to it. We may update it to reflect changes in law or in the Service; we will post the new version here and tell account owners by email at least 30 days before a material change takes effect. Questions about this DPA go to legal@leads2build.com.

Annex 1 — Details of the processing

Subject matter and duration: providing the Service for the length of your subscription and the deletion period in section 5.
Nature and purpose: storing, organizing, displaying, sending and synchronizing records so you can sell, estimate, schedule, build, bill and communicate with customers and crews.
People concerned: your customers and leads, their household members and lenders where you record them, your employees, crews and subcontractors, your suppliers, and your account users.
Categories of data: names and contact details; project and site addresses; estimates, contracts, invoices and payment status (card and bank details stay with Stripe); messages, emails and call records, recordings and transcripts; photos and the location tags on them; crew time entries and clock-in locations; payroll details you enter; signatures; notes and documents you upload.
Sensitive data: the Service is not designed for government identification numbers, health information or full payment-card numbers. Do not upload them.

Annex 2 — Security measures

Hosting on providers that hold independent SOC 2 reports (Vercel, Supabase, Cloudflare), which also provide physical security for the data centres.
Encryption in transit with TLS for all browser traffic, with HTTP Strict Transport Security.
Encryption at rest by our database and storage providers, plus application-level AES-256-GCM encryption, with a managed master key, for stored integration credentials such as accounting and calendar tokens.
Tenant isolation: every record carries an account identifier and every read and write is scoped to your account on our servers. The database is not reachable directly from browsers.
Access control: role-based permissions in the Service; our staff are granted only the access their job needs; removing a person ends their active sessions; access is reviewed every quarter and each review is recorded with a tamper-evident snapshot.
Two-step sign-in required for all Leads 2 Build staff, an account switch that requires it for your owners and admins, and a fresh verification before refunds, payouts and credits.
Logging: changes to your records are written to an append-only audit log kept for at least 13 months; staff access to customer accounts is logged in an append-only activity log.
Private file storage: photos, documents and recordings are stored privately and served through short-lived signed links; images your customers add through their portal are stored under unguessable addresses. Links you share with customers use unguessable codes, and customer portal links stop working when they expire.
Secure development: every change is tied to a ticket and must pass automated checks, including type checking, before it can deploy; tenant-scoping checks run before changes are pushed; every change is scanned for vulnerable dependencies and committed secrets.
Vulnerability management: automated dependency alerts and updates, with fixes due within 7 days for critical and 30 days for high-severity issues.
Monitoring: server errors, failed scheduled jobs and service health are monitored, with alerts sent to our security lead.
Backups: daily database backups by our database provider, kept for 7 days.
People: staff must acknowledge our security, confidentiality and acceptable-use policies, and must use two-step sign-in.
Incident response: a written incident response and breach-notification procedure, with notice to you as described in section 4.
Vendor management: subprocessors are reviewed before use and every year after.

Annex 3 — Subprocessors

The current list is published at /legal/subprocessors.

Need a countersigned copy for your records? Write to legal@leads2build.com.