Data Processing Addendum

Effective 21 July 2026. We will say what changed when this is revised.

1. Why this is a separate document

Most of what LeadLatch holds is not about you. It is about the people who ring you. In law those are two different relationships, and pretending otherwise is how privacy documents end up meaning nothing.

You are the controller of your callers’ data. KeyBolt Inc., trading as LeadLatch, is the processor. You decide that calls are answered, recorded and booked; we carry that out on your instruction. This addendum forms part of the Terms of Service.

2. What we process, and why

• Subject matter — answering, qualifying and booking calls made to your business.
• Duration — for as long as you are a customer, plus the deletion window in §9.
• Data subjects — people who telephone your business.
• Categories of data — phone number, name, service address and its coordinates, call audio where recording applies, call transcript, and the details of the job discussed.

3. We act on your instructions

We process caller data only to provide the service to you and as otherwise instructed by you, except where the law requires differently, in which case we will tell you unless we are forbidden to.

Your instructions are expressed through your settings: your service area, your prices, your job types, and whether calls are recorded.

4. Confidentiality

Everyone with access to caller data is bound to keep it confidential, and access is limited to those who need it to run or support the service.

5. Security

We keep appropriate technical and organisational measures, described plainly on the security page, including what we are not claiming. That page is deliberately candid, and it is part of the picture here.

6. What we will never do with it

These restrictions are the ones that make us a service provider rather than a third party, and they matter to your own privacy obligations as much as to ours. We will not:

• Sell caller data, or share it for cross-context behavioural advertising.
• Keep, use or disclose it for any purpose other than performing this service, including any commercial purpose of our own.
• Combine it with personal information from other sources, except as permitted in order to provide the service to you.
• Use it to train models for our own benefit or for anyone else’s.

We certify that we understand these restrictions and will comply with them.

7. Other companies we use

You authorise us to engage the providers listed on the subprocessors page, each bound to obligations no weaker than these. We will announce a new one on that page before it begins processing, so you have notice rather than a discovery. If you object to one on reasonable grounds, tell us; if we cannot resolve it, you may leave and we will not make that difficult.

One provider is outside the United States: our routing provider is a Netherlands company, so working out real driving time sends it the service address.

8. Helping you with requests and incidents

If a caller asks you for a copy of their data, or asks you to delete it, we will help you answer. If a caller comes to us directly we will point them to you, because the decision is yours, and tell you it happened.

If caller data we hold is exposed, we will tell you without undue delay, with what we know, what we are doing, and what it means for you. We would rather commit to that plainly than name a number of hours we have never had to meet.

9. Deletion and return

When you stop being a customer we will give you a reasonable window to export your data and then delete it, unless the law requires us to keep something. You can ask us to delete sooner, or to delete a specific call at any time, and we will.

10. Audits

You can ask us for the information reasonably needed to satisfy yourself we are meeting this addendum, and we will provide it. We are a small company and do not currently hold third-party certifications, which is said plainly on the security pagerather than left for you to discover during a review.

11. Precedence

Where this addendum and the Terms of Serviceconflict on the handling of caller data, this addendum wins.