How we process data for customers.

This Data Processing Addendum ("DPA") is between the customer identified in the Petrichor account ("Customer") and BluBubl Limited ("Petrichor"). It forms part of the Terms of Service and applies automatically; no signature is needed. Customers who need a countersigned copy for their records can request one at alex@trypetrichor.com.

The parties act in the following roles:

Where the CCPA/CPRA applies, Petrichor is a service provider for Customer Data, will not sell or share it, will not retain, use or disclose it outside the direct business relationship except as permitted, and will notify the Customer if it can no longer meet its obligations.

• Instructions. Process Customer Data only on the Customer's documented instructions, which are the Terms, this DPA, and the settings and actions the Customer takes in the product. Petrichor will inform the Customer if an instruction appears to infringe data-protection law.
• Confidentiality. Ensure that staff with access to Customer Data are bound by confidentiality and receive appropriate training. Staff access inside a Customer workspace occurs only with the Customer's permission and is logged.
• Security. Implement the technical and organisational measures in Security measures and keep them under review.
• Subprocessors. Engage subprocessors only under the conditions in Subprocessors.
• Assistance. Help the Customer respond to data-subject requests, and provide reasonable assistance with security, breach notification, data-protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Petrichor.
• Data-subject requests. Forward to the Customer without undue delay any request Petrichor receives that relates to Customer Data, and not respond to it except on the Customer's instruction or where the law requires. Petrichor honours opt-outs and objections directly across the platform, since suppression protects the data subject regardless of which controller receives the request.
• Deletion and return. At the end of the service, delete or return Customer Data at the Customer's choice within the period stated in the Terms, unless the law requires retention. The Customer can export leads and workspace data from the product at any time.
• Audit. Make available the information necessary to demonstrate compliance with this DPA, in the first instance through documentation and written answers. Where a Customer reasonably requires more, Petrichor will allow an audit once per year, on 30 days' notice, at the Customer's cost, conducted so as not to disrupt the service or expose other customers' data.

• Have a lawful basis for every category of personal data the Customer uploads, connects or instructs Petrichor to contact, and provide any notices the law requires.
• Give instructions that comply with data-protection law and the terms of connected platforms.
• Honour opt-outs and data-subject rights for its campaigns and not re-import suppressed contacts.
• Not upload special-category data, data about children, or financial account data.
• Configure autonomy, budgets and team permissions appropriately and keep credentials secure.

Petrichor maintains the following measures, appropriate to the risk of processing business-contact data:

• Encryption in transit (TLS) for all connections to and between services.
• Authenticated encryption at rest for connected-account credentials and secrets, with keys held separately from the database and versioned for rotation.
• Passwords stored only as salted bcrypt hashes; single sign-on via Google available.
• Role-based access inside workspaces (admin, team lead, member) with per-member spend allowances.
• Production access limited to named staff over authenticated connections; staff sessions inside a Customer account are explicit, permissioned and logged.
• Provider-level rate limits and pacing for outreach to protect connected accounts.
• Spend governors, budgets and pause controls that bound what the agent may do.
• Health monitoring, incident tracking and daily automated evaluations of agent behaviour.
• Segregated tenancy at the data layer keyed by team, with regular backups.

Petrichor will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases as it becomes available. Petrichor will cooperate with the Customer's own notifications to authorities and data subjects.

The Customer authorises Petrichor to engage the subprocessors below. Petrichor imposes data-protection obligations on each that are no less protective than this DPA, and remains liable for their performance. Entries marked customer-directed are engaged only when the Customer connects that service to its own workspace.

Petrichor will publish changes to this list on this page and notify account admins by email at least 30 days before a new subprocessor processes Customer Data. A Customer that objects on reasonable data-protection grounds may raise the objection at alex@trypetrichor.com; if the parties cannot resolve it, the Customer may terminate the affected service with a pro-rata refund of prepaid fees.

Infrastructure, models and data providers

Customer-directed integrations

Public data sources that are read but do not act on our behalf (company websites, public job boards such as Greenhouse and Ashby, regulatory filings, public professional profiles) are not subprocessors and are not listed.

BluBubl Limited is established in the United States and hosts the service there. Where Customer Data protected by EU, UK or Swiss law is transferred to Petrichor or onward to a subprocessor in a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) and, for onward transfers, Module Three, which are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. Petrichor selects the options as follows: Clause 7 docking clause included; Clause 9 option 2 (general authorisation) with the notice period above; Clause 11 optional language not included; Clause 13 supervisory authority of the Customer's establishment; Clause 17 law of Ireland; Clause 18 courts of Ireland. Annex I is completed by Details of processing, Annex II by Security measures, and Annex III by Subprocessors.

Where a subprocessor is certified under the EU-US Data Privacy Framework, Petrichor may rely on that certification instead. Petrichor will assess the laws of destination countries and apply supplementary measures where needed, and will inform the Customer if it can no longer comply with the transfer terms.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except that nothing limits liability to data subjects under the Standard Contractual Clauses. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms with respect to the processing of personal data. This DPA lasts as long as Petrichor processes Customer Data.