Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between VICTOR SAAD TORRES DE OLIVEIRA LTDA ("Tell", "we") and the Customer, and applies when we process Customer Personal Data on the Customer's behalf. It needs no signature. If you need a countersigned copy, email [email protected]. If this DPA and the Terms conflict on data protection, this DPA controls.
1. Definitions and scope
- Customer Personal Data is personal data that the Customer, or tools the Customer connects, put into the Service and that we process for the Customer: for example people the Customer tracks, target accounts and contacts, notes and decisions, and data read from or sent to the Customer's CRM, Apollo, Slack or webhooks.
- Not covered: data we process as our own controller, described in the Privacy Policy: account and billing data, and the public professional information the Service collects on its own. For that data each party is an independent controller.
- Data Protection Laws means the laws that apply to the processing, including Brazil's LGPD, the GDPR and UK GDPR, and U.S. state privacy laws such as the CCPA/CPRA.
- For Customer Personal Data, the Customer is the controller (or a processor for its own client) and Tell is the processor (a "service provider" or "processor" under U.S. state laws).
2. Instructions
We process Customer Personal Data only to provide the Service under the Terms, the settings the Customer chooses, and other documented instructions the Customer gives, unless the law requires otherwise (in which case we will tell the Customer first where allowed). We will tell the Customer if we believe an instruction breaks Data Protection Laws. We will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service, or combine it with other data except as the Service needs and the law allows.
3. Customer responsibilities
The Customer is responsible for having a lawful basis and giving any notices needed for the data it puts into the Service and for its own use of Output, and will not put in sensitive data (such as health, biometric, government ID or financial account data) or data about children.
4. Confidentiality and security
People who can access Customer Personal Data are bound to confidentiality. We maintain the measures in Annex 1 and may update them as long as protection does not decrease.
5. Security incidents
We will notify the Customer without undue delay, and in any case within 72 hours of becoming aware, of a security incident affecting Customer Personal Data, with what we know, what we are doing and what the Customer may need to do, and we will keep the Customer updated. Notifying is not an admission of fault.
6. Subprocessors
The Customer authorizes the subprocessors in Annex 2. We bind each to data protection terms at least as protective as this DPA for the service it provides, and we remain responsible for them. We will announce a new subprocessor on this page and by email at least 15 days before it starts; the Customer may object on reasonable data protection grounds, and if we cannot address the objection, the Customer may end the affected part of the Service with a pro-rated refund of prepaid fees for it.
7. Data subject requests and assistance
If a person asks us directly about Customer Personal Data, we will pass the request to the Customer and not answer it ourselves unless the law requires. Most requests can be handled in the app (editing or deleting what the Customer added, exporting lists). We will also give reasonable help with impact assessments and consultations with authorities, to the extent the Customer cannot do it from the information we publish.
8. Audits
On request, once a year or when an authority requires it, we will answer a reasonable security questionnaire and give the information needed to show compliance with this DPA. On-site audits need 30 days' notice, happen during business hours, are at the Customer's cost, and are bound by confidentiality.
9. International transfers
We are in Brazil and some subprocessors are in the United States and elsewhere. Where Data Protection Laws require a transfer mechanism, the parties agree to the applicable standard contractual clauses: the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor), with the UK Addendum for UK data, and the ANPD standard clauses for transfers from Brazil, which are incorporated by reference with the details in this DPA and its annexes. Optional clauses do not apply; the governing law and courts are those of Ireland for the EU clauses and of England and Wales for the UK Addendum.
10. Return and deletion
The Customer can export its lists and signals at any time. When the Customer deletes its account, we delete Customer Personal Data right away, except copies in backups, which are overwritten within 14 days, and what the law requires us to keep, which we protect and use only for that purpose.
11. AI
We do not use Customer Personal Data to train or improve AI models, ours or anyone else's, and we do not let AI providers we use do so, unless the Customer agrees in writing.
12. Liability and term
This DPA lasts as long as we process Customer Personal Data. Each party's liability under it is subject to the limits in the Terms, except where Data Protection Laws or the standard contractual clauses do not allow it.
Annex 1: Security measures
- Encryption in transit (HTTPS everywhere, HSTS) and encrypted third-party keys and two-step secrets at rest.
- Passwords stored only as salted hashes; optional two-step verification, required for administrators.
- Each query scoped to the Customer's account; API keys with read or write scopes; signed, expiring links.
- Rate limits on sign-in, sign-up, password reset and public forms; Content-Security-Policy and other security headers.
- Daily encrypted database backups with tested restores; error and uptime alerts.
- Access to production limited to the founders; secrets kept outside the code repository; code changes reviewed through pull requests with automated secret scanning.
Annex 2: Subprocessors
| Subprocessor | What it does | Where |
|---|---|---|
| Stripe | Payments, subscriptions and billing portal | United States and others |
| Resend | Sending service emails | United States |
| Cloudflare | Domain, network protection and email forwarding | Global |
| NFE.io | Brazilian service invoices | Brazil |
| AI model and data providers | Analyzing text and reading public sources; names given on request under confidentiality | United States and others |
| Hosting providers | Running the app and the database | Brazil |
Annex 3: Details of processing
- Data subjects: people at companies the Customer sells to or follows (prospects, contacts, people it tracks), and the Customer's own users.
- Categories of data: name, job title, employer, business email, public profile URLs, public posts, notes and decisions about them.
- Sensitive data: none.
- Nature and purpose: storing, matching, analyzing and sending the data to provide the Service as the Customer configures it.
- Frequency and duration: continuous, while the Customer uses the Service, then as in section 10.
- Contacts: Tell: [email protected]; Customer: the email on its account.