This Data Processing Agreement (“DPA”) forms part of the Proust Terms & Conditions and applies to every business (“Customer”) using Proust to run interviews. By agreeing to the Terms when creating a Proust account, the Customer also agrees to this DPA on behalf of their company. It is not necessary to sign this document.
The Customer is the controller of Interview Data — transcripts, analyses, and insights from interviews run under the Customer’s account. Proust is the processor of Interview Data. Proust is the independent controller of (a) Customer account and billing data and (b) participant reward data (contact details participants provide to receive rewards), which is never disclosed to the Customer.
Processing activities: conducting AI interviews (text and voice), live transcription, analysis and synthesis, storage, and display in the Customer’s dashboard. Data subjects: the Customer’s customers and other participants. Data categories: interview responses and any personal information a participant chooses to share in conversation. Duration: the term of the Customer’s account.
Proust processes Interview Data only on the Customer’s documented instructions — the configuration of the Customer’s interviewers and the features of the service — and not for any other purpose. Proust does not use Interview Data to train AI models and does not permit its subprocessors to do so.
Access to Interview Data is restricted to personnel who need it to operate the service, and all such personnel are bound by confidentiality obligations.
Proust maintains technical and organizational measures appropriate to the risk: encryption in transit (TLS) and at rest; no storage of call audio (live transcription only); single-session tokenized interview links; role-limited production access with multi-factor authentication; vendor risk review of all subprocessors; and monitoring of production systems. Measures evolve; they will not materially decrease during a Customer’s term.
The Customer authorizes the subprocessors listed on Your data & privacy (hosting, AI, voice, email, and payout providers). Proust will give 14 days’ notice before adding a subprocessor that processes Interview Data; the Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve, up to and including termination with a pro-rata refund.
Proust will forward to the Customer any data-subject request concerning Interview Data and will assist with fulfilling it. Requests concerning reward data are handled by Proust directly.
Proust will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Interview Data, including the nature of the breach, likely consequences, and measures taken.
On deletion by the Customer, or on account termination, Proust deletes Interview Data from the live database immediately; backup copies expire on a fixed schedule. On written request within 30 days of termination, Proust will instead export Interview Data to the Customer before deletion.
Proust will make available information reasonably necessary to demonstrate compliance with this DPA. Audits are satisfied by Proust’s documentation and third-party reports where available; on-site audits require justified grounds and 30 days’ notice.
Each party’s aggregate liability under this DPA is capped at the fees paid by the Customer in the 12 months preceding the event, and consequential damages are excluded, as set out in the Terms.
This DPA applies for as long as Proust processes Interview Data for the Customer. Proust may amend this DPA with 30 days’ notice; continued use after the notice period constitutes acceptance. Governing law and venue follow the Terms (California, USA).