Data Processing Agreement
What your agency and Blade each need to do when we process personal data for your workflow.
Your data. Clear responsibilities.
Your agency is the controller: you decide how the data is used. Blade is the processor: we follow your documented instructions.
This agreement explains what we process, the security responsibilities, provider notices, and how retained data is returned or deleted.
Swipe the table sideways on smaller screens to see all columns.
Start with this summary, then read the full document below for the terms and conditions that apply.
Between: Blade Agent AI ("Processor") and the Customer identified in the applicable Order Form/Signup ("Controller")
Effective as of: the date Customer accepts the Terms of Service
1. Purpose
This DPA governs the processing of personal data that Controller submits to, or that Processor collects on Controller's behalf via, the Blade Agent AI Service (defined in the Terms of Service), including website inquiries, related SMS replies, and derived workflow records ("End Lead Data").
2. Roles
- Controller (Customer) determines the purposes and means of collecting End Lead Data, meaning operating their own website and deciding what data to collect from prospective clients.
- Processor (Blade Agent AI) processes End Lead Data solely on Controller's documented instructions, as described in the Terms of Service and this DPA, to provide the Service.
3. Scope and Nature of Processing
| Subject matter | Website lead analysis, enabled SMS response/qualification, alerts, and CRM handoff |
| Duration | For the subscription and the retention/deletion schedule agreed before account activation |
| Nature/purpose | Intent, urgency, timeline and budget analysis; enabled SMS and draft approval; CRM sync; Response Guard and weekly reporting |
| Categories of data subjects | Individuals submitting inquiries via Controller's website (prospective buyers/sellers) |
| Categories of personal data | Contact details, inquiry text, AI context, SMS content, drafts/revisions, consent/opt-out records, delivery state, and team activity; optional enrichment only as agreed |
4. Processor Obligations
Processor shall:
- Process End Lead Data only on Controller's documented instructions (as set out in the Terms of Service), unless required otherwise by law.
- Ensure personnel authorized to process End Lead Data are bound by confidentiality obligations.
- Implement appropriate technical and organizational security measures, including encryption in transit (TLS), encrypted storage for integration credentials, account-specific retention settings and access controls for V6 operational records, and restricted administrative access limited to personnel who need it to configure or support the Service.
- Not engage a new sub-processor without giving Controller reasonable prior notice and an opportunity to object (see Section 5).
- Assist Controller, within 10 business days of a request, in responding to data subject requests (access, deletion, correction) that End Leads may direct to Controller.
- Notify Controller without undue delay, and in any event within 72 hours of becoming aware, after a personal data breach affecting End Lead Data, providing available details to help Controller meet its own notification obligations.
- At Controller's request, delete or return any End Lead Data still retained by Processor upon termination of the Service, except as required by law. Data already delivered to Controller's Slack, email, or CRM environment remains under Controller's control.
- Make available to Controller information reasonably necessary to demonstrate compliance with this DPA.
5. Sub-Processors
Controller provides general authorization for Processor to engage the sub-processors listed in the Privacy Policy, currently including:
- Anthropic (AI classification/drafting)
- n8n (workflow automation)
- Supabase (V6 operational records)
- Twilio (enabled SMS delivery and reply events)
- Slack and our email delivery provider (e.g., Resend)
- Any enrichment provider identified in the agreed account scope before activation
- Controller's own Follow Up Boss, HubSpot, or Salesforce account (Growth plan)
Processor will notify Controller of any new sub-processor with a minimum of 15 days' notice, during which Controller may object on reasonable data protection grounds.
6. International Transfers
The current account scope targets US and Canadian real estate teams. Processor must disclose applicable hosting regions and providers and address required transfer safeguards with Controller before enabling a new region or data flow. EU/UK processing requires an appropriate amendment and transfer mechanism before activation.
7. Controller Obligations
Controller warrants that:
- It has a lawful basis to collect End Lead Data via its own website and to instruct Processor to process it as described.
- Its privacy notice discloses the enabled processing, including SMS and operational records. It supplies lawful messaging instructions, appropriate consent evidence, and accurate sender/time-zone settings, and honors opt-outs.
- It will not instruct Processor to process special categories of data (health, precise financial account data, government IDs, and similar) without prior written agreement.
8. Liability
Liability under this DPA is subject to the limitation of liability set out in the Terms of Service, except where applicable law prohibits limiting liability for data protection violations.
9. Term and Termination
This DPA remains in effect while Processor retains or processes End Lead Data on Controller's behalf, including return/deletion obligations following termination.
10. Audit Rights
Controller may request reasonable evidence of Processor's compliance with this DPA (for example, a summary of security practices) no more than once per year, or following a security incident, with reasonable advance notice.