Data Processing Addendum

Last updated November 5, 2026

This addendum is part of the Terms of Service between SiteTools, Inc., which runs LeadVault.com ("we"), and our customer ("you"). It covers the personal information we handle for you as part of LeadVault: your leads, your website visitors on your forms, the people you call, text or email, and your own staff ("your personal data"). For your personal data, you're the business that decides why and how it's used (the "business" or "controller"), and we're your service provider (the "service provider", "contractor" or "processor") under the California Consumer Privacy Act and similar laws.

What we handle, and why

• Purpose: to provide LeadVault to you as the Terms of Service describe: collecting, storing, organizing, showing and sending your leads and the information about them, and supporting you.
• Whose information: your leads and website visitors, the people you contact through LeadVault, and the people who use LeadVault for you.
• What information: names and contact details, addresses, the answers your forms and imports collect (for mortgage leads, for example, property, loan and income details), notes, call recordings and their transcripts, voice notes, form activity (IP address, its rough location, and browser), sign-in records, and, when you turn them on, dates of birth and Social Security numbers.
• How long: while your account is active, then until it's deleted as described under "When it ends".
• Where: on servers in the United States.

Your instructions

We handle your personal data only on your instructions: to provide LeadVault as you set it up and use it (your settings, forms, imports, API keys and the actions of your people), as these terms describe, or as the law requires. If the law requires something else, we'll tell you first unless the law forbids it. If we think an instruction breaks the law, we'll tell you. You're responsible for having the right to give us your personal data and for the instructions you give.

California and similar state laws

For your personal data, we will not:

• sell it or share it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than providing LeadVault to you as these terms describe, including for any commercial purpose of our own, or outside our direct business relationship with you;
• combine it with personal information we receive from anyone else or collect ourselves, except as those laws allow a service provider to.

We'll meet the obligations those laws place on service providers and give your personal data the same level of privacy protection they require of you. We'll tell you if we can no longer meet them. You may take reasonable and appropriate steps to make sure we use your personal data consistently with your obligations, and to stop and remedy any use that isn't authorized. Information we take identifying details out of stays that way: we don't try to identify anyone from it.

Security

Only people at SiteTools who need it to run LeadVault and support you can reach your personal data, and they're bound to keep it confidential. We keep reasonable security measures in place, appropriate to the information, including:

• Encrypted connections (HTTPS) for every page, form and API call.
• Each account's data kept apart by the database itself (row-level security), not only by our code.
• Social Security numbers and dates of birth encrypted in the database, shown in full only to the roles you allow, and every viewing logged.
• Passwords stored only as hashes, sign-ins locked after repeated wrong tries, and two-step sign-in required once an account holds leads.
• API keys and sign-in links stored only as hashes, and limits on how fast they can be used.
• A log of important actions, such as sign-ins, exports and changes to settings.
• Keys for outside services kept only on our servers, and server access limited to the people who run them.

We review and improve these measures over time and won't make them weaker overall.

Our service providers

We use these companies to run parts of LeadVault. Each is bound in writing to protect personal data at least as this addendum does, and to use it only to provide its service to us; we're responsible for them.

• The company that hosts our servers, in the United States.
• Anthropic, for LeadVault's AI features (search, the assistant, AI on forms, summaries of recorded calls, which an account can turn off, and Vaulty answering and making calls, when an account turns it on), under terms that don't let it train its models on this information.
• Deepgram, to turn voice notes and recorded calls into text, with its use of them for training turned off.
• Twilio, to place calls, when a customer turns calling on; to hear and speak for Vaulty on calls it answers, when a customer turns that on; to register a customer's company and its numbers with the phone companies, when it sets up caller ID; and to text sign-in codes to people who choose codes by text.
• Google, for address suggestions on forms and for signing in with Google.
• Microsoft and Meta, for signing in with their accounts, when someone chooses to.
• RentCast, for a home value estimate from a property address on a form.
• Amazon Web Services, to send LeadVault's own email, like invitations and password links, and the bulk email customers send to their leads.
• Stripe, to take payment for LeadVault from the accounts that pay for it.

Before we add or replace one that handles your personal data, we'll update this list and tell your account admins at least 30 days ahead, except in an emergency, when we'll tell you as soon as we can. If you object for a reasonable data protection reason, we'll try to find a solution with you; if we can't, you may cancel and we'll refund what you paid in advance for the time left.

Requests from people about their information

LeadVault lets you find, export, correct and delete a person's information yourself. If someone asks us directly about information you hold, we'll pass the request to you and won't answer it ourselves unless you ask us to or the law requires it. We'll help you answer requests, and with assessments and consultations with regulators, where reasonably needed.

Security incidents

If we learn that your personal data was accessed, used or disclosed without authorization, we'll tell your account admins without undue delay, and within 72 hours of confirming it. We'll tell you what we know, what we're doing about it, and how to reach us, keep you updated, and help you meet any duty you have to notify people or regulators.

Financial institutions

If you're a financial institution under the Gramm-Leach-Bliley Act, we'll put in place and maintain appropriate safeguards for the customer information we handle for you, as the FTC Safeguards Rule requires of service providers, and this addendum is our agreement to do so. We'll use and disclose that information only to provide LeadVault to you, as that law's privacy rules allow.

Audits

Once a year, or after a security incident, we'll answer a reasonable written security questionnaire from you and give you the information reasonably needed to show we meet this addendum. Anything we share is confidential.

When it ends

You can export your leads at any time. When your account ends, you have 90 days to export them; then we delete your personal data, except copies in backups, which are deleted as the backups roll over, and what we keep for five years for legal and compliance purposes: a record of each consent your leads gave (its wording, when and where it was given, and the phone number and email it covers), records of what we charged you, and the log of important actions in your account, with the names and emails of the people who took them. Those are deleted after the five years. They, and anything else the law requires us to keep, stay protected by this addendum for as long as we keep them.

This addendum follows the limits of liability in the Terms of Service. If it and the Terms of Service differ about personal data, this addendum comes first.

Contact

SiteTools, Inc. (LeadVault.com), 1411 Federal Ave, Los Angeles, CA 90025. Reach us through our contact form.