# Unposted for Agencies: Data Processing Addendum (template) Last updated: October 25, 2026. Operated by G2 Advisors. This addendum applies when both parties have signed it. It does not attach Standard Contractual Clauses. ## Status of this document This is the data-processing addendum for Unposted for Agencies, operated by G2 Advisors ("Processor"). It applies when the Controller and the Processor sign it. It does not include executed Standard Contractual Clauses. Until it is signed, the Privacy Policy and the Terms of Service govern a self-serve subscription. The public page and the downloadable file are the same text. Last updated October 25, 2026. ## Parties and roles The Controller is the recruiting agency that opens an Unposted account and uploads candidate, client, and contact information. The Processor is G2 Advisors, which provides the Unposted software. For data the agency uploads or that the service collects on the agency's instructions (candidates, contacts, mailbox contents used for sending and reply detection, outreach drafts and sends), the agency is the controller and G2 Advisors is the processor. Where a person signs up for the candidate product on their own, G2 Advisors is the controller of that account. This addendum is written for the agency product. It does not make an agency the controller of a job seeker's separate personal account. ## Subject matter and duration The subject matter is the Unposted agency account: reading a book of candidates, finding companies, drafting and sending confidential outreach from the agency's own connected email and LinkedIn accounts, and keeping the record of what was sent and how people replied. Processing lasts for the subscription, plus the retention window in the Privacy Policy (data is kept while the account is active and for 90 days after a lapse so the agency can export or resume, then it is eligible for deletion). Suppression entries that record an opt-out are kept after account deletion so the opt-out is not forgotten. On a written instruction at the end of the service, the Processor will delete or return controller personal data, except where keeping a copy is required by law or is that suppression record. ## Nature of the data and the people it is about Data subjects are the agency's users, the candidates whose information the agency uploads, and the business contacts the agency asks the service to find or email. Categories include account data (name, email), candidate career data (résumé, thesis, notes), business contact data (name, title, company, work email, LinkedIn URL), and message data (drafts, sends, reply state). Payment card numbers are handled by Stripe and are not stored by the Processor. ## Instructions The Processor handles this data to provide the service the Controller configures: the account the Controller sets up, the mailboxes and LinkedIn account the Controller connects, the off-limits list the Controller maintains, and the send mode the Controller chooses. The default send mode is review. Auto-send is off until the Controller turns it on. The Processor does not sell controller personal data and does not use it to train public AI models. If the Processor believes an instruction violates applicable data-protection law, it will tell the Controller and pause that instruction until the question is resolved. A change to the product that materially changes processing is described in an update to the Privacy Policy, with email notice before it takes effect. ## Security The Processor keeps customer data isolated per account with Postgres row-level security, encrypts data in transit, stores integration credentials in an application-level encrypted vault where that vault is in use, and limits access to people operating the service. The current controls are on the security page at https://app.unposted.ai/legal/security. The Processor does not hold a SOC 2 report and has not published a penetration test. ## Subprocessors The Controller authorizes the subprocessors listed in the Privacy Policy. As of October 25, 2026 they are: WorkOS (sign-in), Anthropic (drafting and analysis), Stripe (payments), Resend (transactional email to the Controller), Sentry (error monitoring), PostHog (product analytics, only after the user allows analytics cookies), Vercel Analytics (cookieless usage counts), Vercel and Railway (hosting), Neon (database, United States). When the Controller uses the feature: Nylas (connected email), Unipile (connected LinkedIn), Apollo (contact discovery, and, on the marketing site, company-level visitor identification only after consent), Adzuna (job-market data), Merge (ATS connection), Instantly (optional email rail), ZeroBounce (email verification). The Processor will update the Privacy Policy before adding a subprocessor that handles controller personal data, and will email the account owner when the change is material. The Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Controller may stop using the affected feature or close the account. ## People who run the Processor People who can access controller personal data are bound to confidentiality by employment or contractor terms. Access is limited to operating, supporting, and securing the service. ## Assistance, breaches, and audits The Processor will assist the Controller with data-subject requests it receives about controller data, using the export and deletion tools in the product where they cover the request, and by hand where they do not. Requests can be sent to eric.hawthorne@g2advisors.io. If the Processor becomes aware of a personal-data breach affecting controller data, it will notify the account owner without undue delay and no later than 72 hours after becoming aware of the breach, with what happened, what data is involved, and what is being done. The Processor will make the information reasonably needed to show compliance available to the Controller. An on-site audit is not included in the self-serve subscription; any audit is agreed separately, scoped to this processing, and carried out on reasonable notice without disrupting the service. ## International transfers The service is hosted in the United States. This addendum does not attach Standard Contractual Clauses. A Controller established in the EEA, the UK, or Switzerland that needs a transfer mechanism executes that mechanism as its own document with the Processor. ## Deletion and return The Controller can export the account from Settings and close it there (Data & privacy, Close account). Closing stops scheduled sends, cancels any trial or subscription, revokes connected mailbox, LinkedIn, and ATS access, and deletes the account's personal data as described in the Privacy Policy. Suppression records are kept so an opt-out survives, and billing identifiers are kept for tax. An agency owner with teammates chooses to transfer the desk or close every desk. After the 90-day post-lapse window, remaining data is eligible for deletion. A person who cannot sign in can email eric.hawthorne@g2advisors.io; that request is completed within 48 hours for data the product stores, not for copies a subprocessor keeps under its own retention (error reports, payment records). ## How to use this template Sign this addendum with the order or checkout record that identifies the Controller. Questions go to eric.hawthorne@g2advisors.io.