# Data processing agreement — Hellofew

> A machine-readable summary. The operative document is the HTML page at
> https://hellofew.com/legal/dpa, and it governs. Nothing here is a substitute for reading it.

Entity: Hellofew, Bengaluru, India.
Contact: adarsh@hellofew.com. Privacy: adarsh@hellofew.com.
Last updated: 2026-09-11.

## Roles

The customer is the controller of the personal data of people they contact.
Hellofew is the processor, and processes it only to provide the
service and only on the customer's instructions.

## Sub-processors

| Vendor | Purpose | What they see | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: application servers and the database | All service data | Germany 🇩🇪 |
| Unipile | Holds the LinkedIn session and performs LinkedIn actions on the customer's behalf | LinkedIn credentials and session, profile data of the customer and the people they contact | France 🇫🇷 |
| Anthropic | Large language model inference: writing ICPs and outreach drafts | Public web page text, prospect profile fields, and the drafts generated from them | United States 🇺🇸 |
| Dodo Payments | Subscription billing and merchant of record | Name, email, billing address, payment details | United States / global |
| Resend | Transactional email: sign-in, alerts, digests | Email address, message content | United States 🇺🇸 |
| Cal.com | The booking calendar on the marketing site, for the intro call | Name, email and timezone given when booking; IP address and browser of visitors who load the calendar | United States 🇺🇸 |

## Retention

| Data | Kept for |
|---|---|
| Account and workspace records | For as long as the account exists |
| ICP and drafts | For as long as the account exists |
| Prospect records (name, headline, employer, public profile) | While the lead is active, then 12 months |
| Provider payloads fetched from LinkedIn | 30 days |
| Activity ledger (what was sent, when, to whom) | 24 months |
| Warning and error logs | 14 days |
| Resolved incidents | 90 days |
| Aggregate daily counters (no personal data) | Indefinitely |
| Suppression list (do-not-contact) | Indefinitely, by design |
| Backups | 30 days |

## The suppression exception

A do-not-contact record is kept indefinitely and is the one category deletion
does not reach. Removing it would re-expose somebody who asked never to be
contacted, which is the opposite of what they asked for.