Data Processing Agreement

This agreement is part of our Terms of Service and applies whenever you use Hound. It covers the personal data of the people Hound finds, checks and contacts for you. For that data you are the controller and 360 LABS LTD is your processor, under UK GDPR Article 28 and, where it applies to you, the EU GDPR. Data about you as our customer is covered by our Privacy Policy, where we are the controller.

• Purpose: finding people who have publicly asked for what you sell, checking they fit, finding their work email, writing messages, sending them from your own accounts, and reading the replies.
• People: business contacts and people who post publicly about their work, and your own past clients if you list them.
• Data: name, role, company, LinkedIn profile, work email, public posts and comments, a few public facts about their work, and the messages and replies between you and them.
• How long: while your account is open. When it closes, we delete this data within 30 days of your asking (and send you a copy first if you want one), apart from the do-not-contact list, which we keep as controller so people who asked are never contacted again.

• We process this data only to run Hound for you, as you set it up, and never sell it or use it for anyone else.
• Everyone at 360 LABS LTD who can reach it is bound to keep it confidential.
• We keep it secure: encrypted in transit and at rest, mailbox access encrypted in our database, keys held in a secrets manager, and access limited to the people who run the service.
• We help you answer people who ask to see, correct or delete their data or who object, and with security questions, impact assessments and questions from a regulator.
• We tell you without undue delay, and within 48 hours of finding out, if a breach affects your data.
• We give you the information you need to show this agreement is kept, and answer reasonable questions about it.
• When data goes outside the UK, it goes under safeguards UK law accepts, such as adequacy rules, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contract clauses.

You allow us to use the providers below. Each one is bound by a contract that protects the data at least as well as this agreement. Before we add or replace one we update this list and tell you by email when the change matters; if you object for a good reason and we can’t solve it, you can cancel at any time.

• Google Cloud: hosts the app, its database and its secrets, in Belgium (EU).
• Cloudflare: DNS and network delivery for our website, and measuring how fast our pages load for visitors outside the EU, without cookies.
• Stripe: takes payments and runs the billing portal.
• Google: sign-in with Google, if you choose it, and your website's small icon for Your business (it sees your website address).
• Unipile: connects your LinkedIn account and mailbox, sends and reads messages for you, and reads public LinkedIn posts and who engaged with them, and your own LinkedIn profile when you ask.
• Resend: sends our system emails, such as sign-in links and your morning email, from updates.houndreach.com, receives the replies you forward to Hound, and tells us about each early access request and each new account.
• Serper and Apify: search the public web, Reddit and X, and read a website's public pages when the site blocks our own reader.
• X: searches public posts on X through X's official API.
• Jina AI: reads a website's public pages when the site blocks our own reader.
• Brandfetch: suggests company names and logos while you type in a website box; it sees what you type there.
• Prospeo and Anymailfinder: look up work email addresses.
• Hunter: looks up work email addresses, only if you add your own Hunter key in Settings.
• Snitcher or Dealfront (Leadfeeder): tell Hound which companies visited your own website, only if you add your own key in Settings.
• ipapi.is: names the company that owns the network a visit to your website came from, using the visitor's IP address, only if you add Hound's line to your site; Hound keeps the company, never the address.
• Google (Gemini), Anthropic, OpenRouter and Amazon Web Services (Bedrock): AI models that read posts, score fit and write messages.
• Dealfront (Leadfeeder), on our own website: looks up which company a visit to our public website came from, using the IP address, and links return visits with a cookie only if you accept it.
• PostHog (EU): error reports from our servers, counts visits to our public website without cookies, and runs optional product analytics and screen recordings inside the app and on our website, only if you accept cookies.

You decide who to contact and why, so you need a lawful basis for it and must follow UK GDPR, PECR and the law where the people you contact live. People can stop all contact through Hound at houndreach.com/contacted, and you agree to honour every opt-out.

The limits on liability in our Terms apply to this agreement too. Questions, or a signed copy for your records: 360 LABS LTD, 66 Paul Street, London EC2A 4NA, or support@houndreach.com.