Loading…
This addendum is part of the Bastro terms of service at bastro.ai. It governs how we process the personal data inside the lists you upload — the phone numbers and accompanying fields that belong to your contacts, not to us — and it applies automatically to every customer account.
For the personal data contained in uploaded lists and the job results derived from them ("Customer Data"), you are the controller — or the business, under U.S. state privacy law — and Bastro is your processor. We decide nothing about that data except how to execute your instructions.
For your own account, billing, and usage data, Bastro is an independent controller; the privacy policy at bastro.ai/legal/privacy governs that data.
We process Customer Data only to perform the services you initiate: normalizing numbers, running the scrub scopes you select, generating job reports, and delivering results to you. Processing is job-scoped — verdicts are stored only as your job's report and are not reused across jobs or customers. We do not sell Customer Data, use it for advertising, use it to train models, or process it for any purpose of our own.
Two categories of subprocessor handle Customer Data on our behalf:
Scrub vendors receive only the phone numbers in your list, only for the scopes you selected, only at job time — never names, emails, or other columns. Each subprocessor is bound by written terms at least as protective as this addendum, and we remain responsible for their performance. We give account holders notice before adding or replacing a subprocessor category.
We protect Customer Data with, at minimum:
Personnel with access to Customer Data are bound by confidentiality obligations, and access is limited to what operating the service requires.
You can export your job results at any time from the dashboard, and delete uploaded lists and job results yourself. On written request — or on account closure — we delete all Customer Data within 30 days, except where law requires retention, and confirm deletion in writing on request.
If we confirm a breach of security affecting Customer Data, we notify you without undue delay and no later than 72 hours after confirmation, with what we know: scope, data affected, and remediation underway. Taking into account the nature of the processing, we assist you with data subject requests and with your own compliance assessments that concern our processing.
This addendum is effective 2026-07-18, applies for as long as we process Customer Data for you, and survives until deletion under § 05 completes. If it conflicts with the terms of service, this addendum controls for the processing of Customer Data.