Data processing addendum
Last updated 24 October 2026.
This addendum ("DPA") is part of the agreement between the customer ("you") and Surge Software Solutions Private Limited, Bengaluru, India ("we"), for the use of ReadyBuyerFinder. It applies when we process personal data for you.
1. Roles
- You are the controller. You decide which people to look for, which data to upload, and whom to contact.
- We are the processor. We process personal data only to provide ReadyBuyerFinder to you, following your documented instructions (your settings, agents and actions in the app count as instructions).
- For your own account data (your users' emails, billing), we act as controller under our privacy policy.
2. Purpose
We process personal data to:
- find and score buying signals for your agents,
- find and verify business contact details,
- write draft messages and suggested replies for you to review,
- push leads to the destinations you connect,
- identify companies visiting your website through the pixel.
We do not sell personal data, and we do not use it to train AI models.
3. Categories of data
People in leads: name, job title, company, work email, phone number (only with a People Data Labs key), public profile links, buying signals linked to them, replies they send through your sequencer.
Visitors to your website: page views, an anonymous first-party cookie id, and the company linked to their IP address. A person only after your site calls ReadyBuyerFinder.identify(email).
Your users: email address, workspace membership, actions recorded in the audit log.
We do not ask for special categories of data. Please don't upload them.
4. Subprocessors
We use the subprocessors listed on our subprocessor page. Some are used only when you or we configure them. We will update that page before adding a new subprocessor, and you may object by writing to us.
5. Security measures
- Third-party keys and tokens encrypted at rest with AES-256-GCM.
- API keys and session tokens stored as hashes.
- Sign-in by one-time email code, with an expiry and an attempt limit.
- Every record scoped to its workspace; every query filters by workspace.
- An audit log of important actions per workspace.
- Signed webhooks (HMAC-SHA256) with a replay window.
- No LinkedIn scraping, and no automation of your LinkedIn account by ReadyBuyerFinder.
- Website visitors identified at company level only, unless they identify themselves.
We are not SOC 2 certified yet.
6. Staff
Only people who need access to run the service can access customer data, and they are bound by confidentiality.
7. Requests from people
If someone asks us to access, correct or delete their data, we tell you, unless the request is clearly about our own processing. We help you answer. Anyone can ask us to stop processing their data; we add them to a suppression list.
8. Personal data breach
We will tell you without undue delay, and in any case within 72 hours of becoming aware of a breach that affects your data. We will tell you what happened, what data is affected and what we are doing about it.
9. Deletion at the end
You can export your workspace as JSON and delete it permanently at any time from Settings. When the agreement ends, delete the workspace in Settings or ask us to do it. Billing records that the law requires us to keep are kept for the required period.
Deleted data can remain in encrypted backups until those backups are overwritten in the normal cycle. We never restore deleted data into the service.
10. International transfers
ReadyBuyerFinder runs on Surge's own servers. Providers you or we switch on (see the subprocessor page) may process data in other countries under their own terms. Write to us if you need details for your records.
11. Audits
We will answer reasonable written questions about these measures. On-site audits by agreement.
Contact
[email protected], Surge Software Solutions Private Limited, Bengaluru, India.