Data Processing Terms
Draft for legal review ยท Last updated 30 September 2026.
Status and scope
These draft terms describe the intended data-processing relationship when a Panther Hook customer uses the service to collect and route lead or submission data. They are provided as a product-facing draft for legal review and are not a representation that a separate negotiated or executed DPA already exists.
Customer and Panther Hook roles
For lead and submission data a customer sends into Panther Hook, the customer generally determines why that data is collected and how it will be used. Panther Hook processes that data to provide and configure the service, including storage, security, routing, delivery, integrations, support, and related operations. Where applicable, that commonly corresponds to the customer acting as controller (or an equivalent business role) and Panther Hook acting as processor or service provider; the exact legal labels depend on the applicable law and processing context. The customer remains responsible for its collection instructions, notices, permissions, and other legal obligations for that data.
Processing instructions
Panther Hook processes customer data to provide the service and according to product configuration and customer-directed actions, except where different processing is required by applicable law. Panther Hook does not use customer lead data to create an advertising profile.
Confidentiality and security
Access to production systems and customer data is restricted by the service's technical controls. Panther Hook uses server-side sessions, CSRF protection, encrypted application secrets, bounded delivery queues and retries, destination validation, private storage architecture for the implemented file path, and other safeguards described on the Security page. These terms do not claim certifications or service levels that Panther Hook has not obtained or published.
Service providers and customer-directed integrations
Panther Hook may use service providers to operate infrastructure, authentication, email, database, and billing functions. The current list is maintained on the Subprocessors page. Separately, customer-configured destinations such as Zapier, Make, Google Sheets, Slack, Telegram, or Discord receive data only when the customer configures and uses those destinations.
Data-subject requests
Where applicable and reasonably possible, Panther Hook will assist a customer with requests concerning lead or submission data processed through the service. A person whose data was collected by a Panther Hook customer should normally contact that customer first because the customer controls the collection and business use of the lead data.
Deletion and return
Self-service workspace and account deletion are available in the product. Deletion removes the relevant primary application records and stored file objects handled by the deletion flow. Deleting an individual workspace does not cancel the account subscription; deleting the Panther Hook account cancels its active paid subscription first. Provider backups, logs, recovery history, and records that must be retained for security, billing, legal, or operational reasons may follow separate bounded lifecycles. Automatic submission-retention cleanup is active for primary submission records according to each workspace's configured retention period within its plan maximum; attached file objects are removed through the bounded R2 cleanup lifecycle.
Security incidents
Panther Hook will investigate security incidents affecting customer data and cooperate with affected customers as appropriate to the incident, the available information, and applicable obligations. This draft does not invent a contractual notification deadline that has not been adopted.
International processing
Service providers may process data in locations associated with their configured services. The appropriate international-transfer wording and any required transfer mechanism must be finalized through legal review. Panther Hook does not currently claim that Standard Contractual Clauses, an adequacy mechanism, certification, or another specific transfer framework has been executed for every customer.
Items still requiring legal review
The legal operator/controller identity, business address where required, DPA acceptance or execution mechanism, governing-law and venue choices, and final international-transfer language are not yet published as finalized legal terms. Those items must be completed before broad commercial launch rather than guessed in this draft.
Contact
Data-processing and privacy questions can be sent to support@pantherhook.com.