# Data Processing Addendum

Last updated: August 20, 2026

How Starlight processes personal data on your behalf under GDPR, UK GDPR, Swiss FADP, and US state privacy laws.

> **Info:** This DPA applies automatically to every customer as part of the [Terms of Service](/terms); nothing needs to be signed for it to take effect. Customers whose procurement process needs a countersigned copy can request one at [legal@joinstarlight.com](mailto:legal@joinstarlight.com).

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between the customer that accepted the Agreement ("Customer") and Starlight Software LLC, a California limited liability company("Starlight") (each a "Party"). It governs Starlight's Processing of Personal Data on Customer's behalf in providing the Service.

## 1. Definitions

- **Applicable Data Protection Laws**: all privacy and data-protection laws applicable to the Processing, including, as applicable, the GDPR, the UK GDPR, the Swiss FADP, and the State Privacy Laws
- **Customer Data**: data provided or made available by or on behalf of Customer to Starlight for Processing in connection with the Service
- **Personal Data**: Customer Data that relates to an identified or identifiable natural person under Applicable Data Protection Laws. It excludes information Starlight collects independently about Customer's own personnel as Starlight's customers, which is governed by the Privacy Policy
- **GDPR**: Regulation (EU) 2016/679; **UK GDPR**: the GDPR as incorporated into UK law by the Data Protection Act 2018; **FADP**: the Swiss Federal Act on Data Protection of 25 September 2020
- **State Privacy Laws**: the comprehensive US state consumer privacy laws in force and applicable to the Processing, including the California Consumer Privacy Act as amended ("CCPA")
- **Controller**, **Processor**, **Data Subject**, **Processing**, **Supervisory Authority**: as defined in the GDPR, and read to include the equivalent terms (business, service provider, consumer) under the State Privacy Laws
- **Sub-processor**: a third party engaged by Starlight to Process Personal Data in connection with the Service
- **Security Incident**: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Starlight's possession. Unsuccessful attempts (port scans, failed log-ins, denial-of-service attacks that do not compromise data) are not Security Incidents
- **SCCs**: the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914; **UK Addendum**: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018
- **Restricted Transfer**: a transfer of Personal Data from the EEA, the UK, or Switzerland to a country that lacks an adequacy decision from the relevant authority, where the transfer would be prohibited without a legal basis under Chapter V of the GDPR or its UK and Swiss equivalents

## 2. Scope, Roles, and Duration

- Customer is the Controller (or a Processor acting for another Controller) and Starlight is the Processor of Personal Data. The details of the Processing are in Annex 1
- This DPA remains in effect for as long as Starlight Processes Personal Data, regardless of the expiry or termination of the Agreement
- Annex 4 (European terms) applies to Processing subject to the GDPR, UK GDPR, or FADP. Section 11 (State Privacy Laws) applies to Processing subject to those laws

## 3. Customer Instructions

Starlight will Process Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA, and Customer's use and configuration of the Service (including searches run, contacts added, drafts approved, Agents configured, automation settings enabled, and integrations connected). Starlight will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, and may suspend the relevant Processing until the instruction is confirmed or changed. Instructions that fall outside the Service's functionality require a written agreement.

## 4. Security

- **Measures**: Starlight implements and maintains the technical and organizational measures in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing. Starlight may update them provided the overall level of protection does not materially decrease
- **Personnel**: Starlight ensures that persons authorized to Process Personal Data are bound by confidentiality obligations
- **Security Incidents**: Starlight will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident, describe what is known, the likely consequences, and the measures taken or proposed, and provide reasonable cooperation. Notification is not an admission of fault. Customer is responsible for any notifications it must make to Supervisory Authorities or Data Subjects, and will consult Starlight before a notification that names Starlight
- **Customer responsibilities**: Customer is responsible for securing its own accounts, credentials, devices, and connected services, and for configuring the Service appropriately for the risk of the Personal Data it chooses to Process

## 5. Data Subject Rights

Taking into account the nature of the Processing, Starlight will assist Customer, by appropriate technical and organizational measures, in responding to requests from Data Subjects to exercise their rights. The Service provides self-serve tools to view, edit, export, and delete contact records, and a suppression list that blocks further contact. If Starlight receives a request directly, it will notify Customer promptly (unless prohibited by law) and, where the request concerns a person contacted through the Service, may add the requester to the suppression list and advise them to contact Customer. Assistance beyond the Service's functionality is provided at Starlight's then-current rates.

## 6. Customer Responsibilities

- Customer has provided all notices and obtained all consents and permissions required under Applicable Data Protection Laws for Starlight to Process Personal Data as contemplated by the Agreement, including for outreach to Data Subjects and for the import of third-party contact data
- Customer has, and will maintain, a valid legal basis for each Processing activity it instructs (including, where applicable, Articles 6 and 14 of the GDPR)
- **Restricted Data**: Customer will not submit to the Service any government identification numbers, health or medical information, biometric or genetic data, financial account credentials, payment card data, precise geolocation, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, criminal history, data of children under 16, or other special categories of data. The Service is not designed for it and Starlight does not accept responsibility for it
- Customer is responsible for its use of the Service in compliance with the [Acceptable Use Policy](/acceptable-use)

## 7. Sub-processors

- **Authorization**: Customer generally authorizes Starlight to engage Sub-processors. The current list, with locations and transfer safeguards, is Annex 3, maintained at [joinstarlight.com/subprocessors](/subprocessors)
- **Obligations**: Starlight imposes on each Sub-processor, by written contract, data-protection obligations no less protective than this DPA to the extent applicable to the services it provides, and remains liable for the Sub-processor's performance
- **Changes**: Starlight will update the list and notify the owner of each Customer workspace by email at least **15 days** before a new Sub-processor begins Processing Personal Data. Customer may object on reasonable, documented data-protection grounds within that period. The Parties will work in good faith to resolve the objection; if they cannot within a reasonable time, Customer may terminate the affected Service on written notice as its sole remedy, and Starlight will refund any prepaid fees for the unused portion of the term

## 8. Audits

Starlight will make available the information reasonably necessary to demonstrate compliance with this DPA, including its [security documentation](/security)and, under NDA, the third-party audit reports of its infrastructure providers. Where those do not reasonably satisfy a requirement of Applicable Data Protection Laws or a Supervisory Authority, Customer may, once per year and on at least 30 days' written notice, conduct or commission an audit of Starlight's compliance, during business hours, under a mutually agreed plan, at Customer's expense (including Starlight's reasonable time at its then-current rates), by an auditor who is not a competitor and is bound by confidentiality. Customer will share the results with Starlight.

## 9. Return and Deletion

- During the term, Customer can export contacts, messages, and activity from the Service at any time
- On termination or expiry, Starlight stops Processing Personal Data other than for storage. Customer may export its data, or request deletion, for **30 days** after termination; Starlight will comply within a commercially reasonable time
- After that period Starlight deletes or anonymizes the Personal Data, subject to retention required by law (kept confidential, Processed only for that purpose, and deleted when the requirement ends) and to the time it takes for deleted data to age out of encrypted backups
- Suppression-list entries (email addresses that have opted out) are retained indefinitely as the technical means of honoring the opt-out; Customer instructs this
- Deletion certificates are provided on written request

## 10. Artificial Intelligence

- Starlight will not use Personal Data to train, fine-tune, or improve any AI or machine-learning model, its own or a third party's, except as strictly necessary to provide the Service on Customer's instructions (for example, scoring a specific draft) or as Customer expressly authorizes in writing
- Starlight contractually prohibits its Sub-processors, including AI model providers, from using Personal Data for their own model training, and enables zero-data-retention terms where offered
- The Service does not make decisions about Data Subjects based solely on automated Processing that produce legal or similarly significant effects. AI outputs (lead-fit scores, draft-quality scores, suggested messages) are recommendations that Customer reviews or, where Customer enables an autopilot setting, authorizes in advance within caps it controls. On request, Starlight will provide meaningful information about the logic involved, excluding trade secrets

## 11. State Privacy Laws

To the extent Personal Data is subject to the State Privacy Laws, Starlight is a service provider, contractor, or processor and:

- will Process Personal Data only for the limited and specified business purpose of providing the Service under the Agreement, and will comply with the obligations applicable to it under the State Privacy Laws, providing the same level of privacy protection they require
- will not sell or share Personal Data; will not retain, use, or disclose it for any purpose, including a commercial purpose, other than providing the Service; will not retain, use, or disclose it outside the direct business relationship with Customer; and will not combine it with Personal Data received from another source, except as permitted by the State Privacy Laws
- will notify Customer if it determines it can no longer meet its obligations, and grants Customer the right to take reasonable and appropriate steps to stop and remediate unauthorized use
- acknowledges Customer's right to take reasonable steps to ensure Starlight's Processing is consistent with Customer's obligations, including the audit rights in Section 8; notice of Sub-processor changes under Section 7 satisfies any notice-and-objection requirement
- certifies that it understands and will comply with these restrictions

## 12. Liability and General

- Each Party's liability under this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Agreement, except where the SCCs give Data Subjects rights that cannot be limited
- If this DPA conflicts with the Agreement, this DPA prevails; if the SCCs conflict with this DPA or the Agreement, the SCCs prevail for the Restricted Transfer to which they apply
- Starlight may update this DPA on notice to maintain compliance with Applicable Data Protection Laws, including replacing the SCCs with a successor mechanism, provided the change does not materially reduce the protection of Personal Data. Other changes follow the Agreement's amendment terms
- Notices to Starlight under this DPA go to [legal@joinstarlight.com](mailto:legal@joinstarlight.com); notices to Customer go to the workspace owner's email address

## Annex 1: Details of Processing

| Item | Description |
| --- | --- |
| Data exporter | Customer, the entity that accepted the Agreement. Contact: the workspace owner's email. Role: Controller (or Processor for its own clients) |
| Data importer | Starlight Software LLC, a California limited liability company. Contact: legal@joinstarlight.com. Role: Processor |
| Categories of Data Subjects | Customer's personnel and teammates; prospects and leads Customer researches or contacts; authors of public posts surfaced to Customer; people in networks or CRMs Customer imports; invitees who book meetings with Customer |
| Categories of Personal Data | Business contact details (name, work email, business phone, job title, employer, LinkedIn URL, location); employment history and company firmographics; publicly available research facts and public posts; outreach messages, replies, and engagement events; meeting bookings and notes; usage and log data |
| Sensitive data | None. Customer agrees not to submit Restricted Data (Section 6) |
| Frequency | Continuous, as initiated by Customer's use of the Service and the automations Customer enables |
| Nature and purpose | Hosting, storage, enrichment, AI-assisted drafting and scoring, sending on Customer's connected accounts, reply tracking, scheduling, analytics, and related support, to provide the Service |
| Duration | The term of the Agreement plus the return-and-deletion period in Section 9 |
| Transfers to Sub-processors | As described in Annex 3, for the purposes stated there |

## Annex 2: Security Measures

The public description is maintained on the [Security](/security) page. In summary, Starlight maintains:

1. Encryption of Personal Data in transit (TLS) and at rest, with additional application-level AES-256-GCM encryption of integration credentials
2. Logical tenant isolation enforced in the application and by database row-level security on every table
3. Passwordless authentication, session revocation, and least-privilege, multi-factor-protected access to production systems
4. Minimal OAuth scopes for connected services and no custody of third-party platform credentials
5. Secrets management outside source control; dependency vulnerability monitoring; change management through version control and review
6. Encrypted daily backups and provider-managed availability and DDoS protection
7. Logging of security-relevant events and account activity
8. An incident-response process with the notification commitments in Section 4, and a public vulnerability-disclosure program
9. Contractual AI-provider restrictions (no training, zero-data-retention where available) and treatment of third-party content as untrusted input
10. Sub-processors selected for equivalent safeguards, including SOC 2 Type II reports for infrastructure providers

## Annex 3: Sub-processors

The authoritative list is [joinstarlight.com/subprocessors](/subprocessors). As of the date of this DPA:

| Sub-processor | Purpose | Location | Safeguard |
| --- | --- | --- | --- |
| Vercel, Inc. | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | United States | DPF |
| Supabase, Inc. | Authentication and the production Postgres database (AWS us-east-2) | United States | DPF |
| Amazon Web Services, Inc. (Amazon Bedrock) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | United States | DPF |
| Meta Platforms, Inc. | Judging, planning, and chat agent reasoning (Muse Spark) | United States | DPF |
| xAI Corp. | Research, web and X search, query parsing, signal and social scanning (Grok) | United States | SCCs |
| Anthropic, PBC | Outage fallback for the writer and judges (Claude) | United States | DPF |
| Google LLC | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | United States | DPF |
| OpenAI, L.L.C. | Draft revision pass and outreach fallback tier (GPT-5.6) | United States | DPF |
| Apollo.io (ZenLeads Inc.) | Lead search, contact and company enrichment, phone reveals, job-change detection | United States | SCCs |
| Resend, Inc. | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | United States | SCCs |
| Clearout | Email address verification before a draft is sent | India | SCCs |
| Stripe, Inc. | Subscription billing, hosted checkout, and the billing portal | United States | DPF |
| SerpApi, LLC | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | United States | None required |
| HarvestAPI (Aventra Technologies Limited) | LinkedIn public post search for Social listening | Hong Kong | None required |
| Reddit, Inc. | Reddit Data API to read the full text of public threads surfaced in Social | United States | None required |
| Logo.dev | Company logos shown in the app | United States | None required |
| MapTiler AG | Map tiles for Local search and the Metrics globe, loaded by your browser | Switzerland | None required |
| OpenStreetMap Foundation (Nominatim) | City boundary outlines for Local search, fetched server-side | United Kingdom | None required |

## Annex 4: European Terms

### Application

This Annex applies to Processing of Personal Data subject to the GDPR, the UK GDPR, or the FADP.

### Impact assessments and consultation

Starlight will provide reasonable assistance, at Customer's cost and on written request, with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36 of the GDPR, to the extent they relate to Starlight's Processing.

### Restricted Transfers

To the extent Customer's provision of Personal Data to Starlight is a Restricted Transfer, the Parties agree as follows.

- **EEA transfers**: the SCCs are incorporated into this DPA and deemed signed by the Parties, populated as set out below
- **UK transfers**: the SCCs as varied by the UK Addendum apply. Tables 1 to 3 of the UK Addendum are deemed completed with the information in Annex 1, this Annex, and the SCCs as populated below; in Table 4, the data importer may end the Addendum as set out in Section 19 of the Addendum
- **Swiss transfers**: the SCCs apply with these modifications: references to the GDPR are to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; references to EU Member States include Switzerland; and Data Subjects in Switzerland may bring claims before Swiss courts
- **New mechanisms**: Starlight may on notice replace the SCCs with a successor or alternative valid transfer mechanism that does not materially reduce protection
- **Full-form copies**: on written request, where a Supervisory Authority or Data Subject requires it, Starlight will provide an executed copy of the applicable SCCs for countersignature

### Population of the SCCs

1. **Modules**: Module Two (controller to processor) applies where Customer is a Controller; Module Three (processor to processor) applies where Customer is itself a Processor
2. **Clause 7** (docking clause): not used
3. **Clause 9**: Option 2, general written authorization, with 15 days' notice of changes as set out in Section 7 of this DPA
4. **Clause 11**: the optional language is not used
5. **Clause 13**: all text retained; the competent Supervisory Authority is determined per Clause 13(a) by reference to Customer's establishment or representative, and otherwise the authority Customer notifies to Starlight in writing
6. **Clause 17**: Option 1; the SCCs are governed by the law of Ireland
7. **Clause 18**: disputes are resolved before the courts of Ireland
8. **Annex I** of the SCCs is populated with Annex 1 of this DPA (Customer as data exporter, Starlight as data importer); **Annex II** with Annex 2 of this DPA; **Annex III** with Annex 3 of this DPA
9. The audit provisions of Clauses 8.9(c) and (d) are subject to Section 8 of this DPA; certification of deletion under Clauses 8.5 and 16(d) is provided on written request; Customer is responsible for any notifications to Data Subjects under Clause 15.1(a) and, under Module Three, for notifying its own Controllers