Data Processing Addendum

How CtrlLane processes customer and platform data for businesses

This Data Processing Addendum applies when a business uses CtrlLane to process contact, customer, communication, WhatsApp, Instagram, SMS, AI voice, file, transcript, and campaign data. It explains the processor relationship, security commitments, subprocessors, and data handling expectations for business customers.

Roles

The business using CtrlLane is the controller or business owner for its contact and customer data. CtrlLane acts as a processor or service provider when it stores, routes, analyzes, sends, receives, summarizes, or otherwise processes that data on the business's instructions.

Processing instructions

CtrlLane processes business data only to provide the configured platform features, including authentication, contact intake, messaging, voice calling, AI-assisted replies, transcripts, summaries, campaign reporting, billing, support, security, abuse prevention, audit, and integration operations.

Protected data

Protected data may include names, phone numbers, email addresses, message content, call recordings or transcripts, structured contact fields, invoice references, campaign metadata, source data, uploaded knowledge files, media, delivery events, wallet records, and connected platform identifiers.

Security measures

CtrlLane uses HTTPS, server-side credential storage, encrypted provider secrets, role-based access, tenant separation, audit records, webhook signature verification where supported, operational monitoring, and least-privilege controls for production systems. Raw provider secrets, OAuth client secrets, and access tokens must not be exposed in browser code, screenshots, logs, or public repositories.

Subprocessors

CtrlLane may use cloud infrastructure, database, storage, telecom, messaging, WhatsApp Business Platform, Meta, Google, analytics, security, support, and AI model providers where needed to operate selected services. Subprocessors are used only for platform operation, delivery, support, security, or compliance.

Customer responsibilities

Businesses must provide lawful instructions, maintain required customer consent or opt-in, configure workflows responsibly, respect opt-outs, use approved templates where required, and avoid uploading or connecting data they are not authorized to process.

Deletion and return

On request, CtrlLane will assist with export, deletion, or deactivation of business data, subject to legal, billing, security, audit, dispute, provider, and abuse-prevention retention requirements. Deletion instructions are available at /data-deletion.

Contact

For data processing questions, contact info@ctrllane.com.

Last updated: August 27, 2026