Crankshaft

Placeholder Document. This Data Processing Agreement is a placeholder and has not been reviewed by legal counsel. It is not legally binding. Final DPA will be published before public launch.

1. Parties

[Placeholder] This Data Processing Agreement ("DPA") is between Crankshaft ("Data Processor") and the customer ("Data Controller") who has agreed to the Crankshaft Terms of Service.

2. Scope of Processing

[Placeholder] Crankshaft processes personal data on behalf of the customer solely to provide the live transfer platform services described in the Terms of Service. Categories of data processed include:

Consumer contact information (name, phone number)
Consumer insurance intent signals and verbal responses
Call recordings and transcripts
Agent account and licensing data

3. Processor Obligations

[Placeholder] Crankshaft as Data Processor shall:

Process personal data only on documented instructions from the controller
Ensure persons authorized to process personal data are subject to confidentiality obligations
Implement appropriate technical and organizational security measures
Assist the controller in responding to data subject rights requests
Delete or return personal data upon termination of services
Provide information necessary to demonstrate compliance

4. Sub-processors

[Placeholder] Crankshaft uses the following sub-processors in the delivery of services:

Supabase — database hosting (USA)
Google Cloud — infrastructure (USA)
Stripe — payment processing (USA)
Resend — transactional email (USA)
Attio — CRM (USA)
PostHog — product analytics (USA / EU)
[AI/LLM provider] — call screening AI (TBD)

5. Security Measures

[Placeholder] Crankshaft implements the following security measures:

Encryption of data in transit (TLS 1.2+)
Encryption of data at rest (AES-256)
Role-based access controls
Regular security assessments
Incident response procedures

6. Data Breach Notification

[Placeholder] In the event of a personal data breach, Crankshaft shall notify the affected customer without undue delay and no later than 72 hours after becoming aware, to the extent feasible.

7. International Transfers

[Placeholder] Data is primarily processed in the United States. Crankshaft will ensure any cross-border data transfers are made subject to appropriate safeguards.

8. Contact

DPA inquiries: privacy@crankshaft.ai