1. Roles
The contractor customer determines what homeowner request data is collected, why it is collected, and how it is used. LeadForm processes that data to provide the service, operate integrations, store audit evidence, run launch tests, and support the customer workspace.
2. Processing instructions
LeadForm processes customer data according to workspace configuration, product documentation, the Terms of Service, this DPA, and reasonable written instructions from the customer where technically feasible.
3. Categories of data
- Contractor account data, workspace roles, billing status, and configuration data.
- Homeowner request data, including name, email, phone, ZIP code, service need, urgency, job details, and preferred contact method.
- Consent evidence, including checkbox state, consent text, timestamps, form URL, user agent context, and country signal where available.
- Operational data, including scoring, routing, HubSpot delivery, launch checklist, test requests, audit events, and owner alerts.
4. Security measures
LeadForm uses technical and organizational measures designed to protect customer data, including tenant isolation, server-side validation, role-based access patterns, encrypted OAuth token storage, signed webhooks, production headers, and limited administrative access.
5. Subprocessors
LeadForm uses subprocessors to host, secure, bill, authenticate, and operate the service. Current subprocessors are listed in the Subprocessors Directory. LeadForm will update that page as material providers change.
6. Deletion and return
On reasonable request, and subject to legal, billing, security, backup, and technical retention requirements, LeadForm can help export or delete customer workspace data. Synthetic launch test data can also be cleaned through product controls.
7. Data subject requests
Homeowners should generally contact the contractor that received their request. LeadForm will provide reasonable technical assistance to customers responding to valid privacy requests where the data is controlled by the customer workspace.
8. Incidents
If LeadForm becomes aware of a confirmed security incident affecting customer data, LeadForm will notify affected customers without undue delay and provide information reasonably available to support investigation and remediation.
9. Contact
DPA and privacy inquiries can be sent to privacy@useleadform.com.