Updated September 27, 2026
Data Processing Summary
This summary describes how No-Bull Marketing processes personal data on behalf of dealers using the Service. It supplements the Terms of Service and Privacy Policy. A signed data processing agreement is available on request at support@no-bullmarketing.com.
Roles
The dealer is the business/controller for its customer and lead data. We act as its service provider/processor and process that data only on the dealer’s documented instructions (its configuration and use of the Service), not for our own purposes, and we do not sell it.
Data and purpose
- Categories of people: the dealer’s customers, prospects and leads; the dealer’s staff users.
- Categories of data: contact details, product interest, consent records, messages, call metadata, rental agreement and payment status, web/visit data.
- Sensitive data: not required. Dealers should not upload Social Security numbers, full payment card numbers, bank account numbers or health information.
- Purpose: lead capture and follow-up, messaging, advertising measurement and reporting for the dealer.
Security measures
- TLS encryption for all web traffic; HTTPS on dealer custom domains once verified.
- Tenant isolation: every record is scoped to one organization and access is checked on the server for every request.
- Role-based permissions (owner, manager, store staff) and store-level access limits; support access is logged.
- Password hashing; integration secrets encrypted at rest; webhook signatures verified (Twilio, Meta).
- Hardened Linux hosting on Linode in the United States with firewalling, least-privilege service accounts and regular security updates.
- Database backups before every release and on a routine schedule; tested restore procedures.
- Automatic enforcement of opt-outs and a suppression list across SMS, email and ad audiences.
Subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Akamai Technologies (Linode) | Cloud hosting: application servers, database and backups | All Service data | United States |
| Twilio Inc. | SMS messaging and call-tracking phone numbers (only when a dealer turns these on) | Phone numbers, message content, call metadata and recordings if enabled | United States |
| Meta Platforms, Inc. | Facebook/Instagram lead forms, ad reporting and hashed custom audiences (only when a dealer connects Meta) | Lead form answers; hashed email/phone for audiences; ad performance data | United States |
| No-Bull Marketing mail server (email.no-bullmarketing.com, hosted on Linode) | Transactional email: lead alerts, digests, account email and dealer email campaigns | Email addresses, names, message content | United States |
We will give dealers at least 30 days’ notice (by email or in the app) before adding a new subprocessor that will process their customer data. A dealer may object and cancel if the change is unacceptable.
Incidents
We will notify affected dealers without undue delay, and within 72 hours where feasible, after confirming a breach of security affecting their data, with the information reasonably available to help them meet their own notice obligations.
Dealer requests, export and deletion
- We assist dealers in responding to consumer access, correction and deletion requests.
- Dealers can export customers, leads and reports at any time, and for 30 days after cancellation on request.
- On cancellation, data is deleted from live systems after 30 days and from backups within a further 35 days, except suppression records and data we must keep by law.
TCPA and messaging responsibilities
The dealer is the sender of its texts, calls and emails and is responsible for consent, content and quiet hours. We provide consent capture, STOP handling, suppression and send-blocking tools and operate them as described. See Section 5 of the Terms.