Data processing addendum

This addendum explains how Curbside handles the personal information it processes on your behalf when you use Spotlight. It applies to buyer inquiries submitted through your listing pages, and it forms part of our Terms of use. You accept it when you accept those terms.

The roles

For the buyer inquiries you collect through Spotlight, you are the controller (the business that decides why the information is collected) and Curbside is your processor (the service provider that handles it on your behalf). For your own account details, such as your email and profile, Curbside is the controller and our Privacy policy governs.

What we process and why

• Whose information: the buyers and prospects who contact you through your Spotlight listing pages.
• What information: the name, email, phone, and message each person submits through a listing inquiry form.
• Why: to store the inquiry, alert you, and deliver it to you so you can follow up. We do not use it for anything else.

Your instructions

We process this information only to provide Spotlight and only on your instructions, which are set by these terms and by how you use the product. We do not sell it, and we do not use it to market to your buyers.

Confidentiality and security

We keep the information confidential and limit access to the people who need it to run the service. We use reputable providers and reasonable technical and organizational safeguards to protect it. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security.

Sub-processors

We use the following service providers to process this information on our behalf. This list matches the one in our Privacy policy:

• Supabase stores accounts, listings, and buyer inquiries.
• Cloudflare stores and delivers listing photos and headshots.
• Resend delivers inquiry alerts and buyer-lead notifications.
• Anthropic processes listing text you paste into the create form.
• Vercel hosts and serves the application.

We require each sub-processor to protect the information to a standard consistent with this addendum. If we add or change a sub-processor, we will update this page.

Helping you respond to buyers

If a buyer asks you to access, correct, or delete the information they submitted, we will help you meet that request for the data we hold on your behalf. You can also access and delete buyer inquiries yourself from your Spotlight dashboard.

If there is a data breach

If we become aware of a security incident affecting the buyer information we process for you, we will notify you without undue delay and share what we know so you can meet your own notification obligations.

Keeping and deleting the information

We keep buyer inquiries while your account is active. You can delete an inquiry at any time, and when you close your account we will delete or return the buyer information we hold on your behalf, except where the law requires us to keep it.

Service provider terms (CCPA)

Where the California Consumer Privacy Act applies, Curbside acts as your service provider. We process buyer information only to provide Spotlight to you, we do not sell or share it, and we do not retain, use, or disclose it outside our direct relationship with you or for any other purpose.

International transfers

Our providers may process information in the United States and other countries. If you serve buyers in the European Union or United Kingdom, contact us so we can put the appropriate transfer terms in place before you rely on Spotlight for that audience.

Contact

Questions about this addendum, or want a countersigned copy for your records? Email us at hello@buildwithcurbside.com or use our contact page.