Data Processing Agreement

Effective date: 2026-10-05

This agreement is between Proust (the "Processor") and the business that creates a Proust account and runs interviews (the "Controller", "you"). It is part of the Proust Terms of Use. You accept it when you create your account. There is nothing to sign.

1. Definitions

"Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in Data Protection Law.

"Data Protection Law" means the privacy and data-protection laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA/CPRA) and, where it applies, the EU and UK GDPR.

"Interview Data" means transcripts, analyses and insights from interviews run under your account, and the identifiers and fields you attach to them.

"Customer Personal Data" means the Personal Data in Interview Data.

"Subprocessor" means a company Proust uses to process Customer Personal Data.

"Term" means the period during which you hold a Proust account.

2. Subject-matter of the agreement

This agreement covers Proust's processing of Customer Personal Data on your behalf to provide the Service. Annex I describes the processing.

3. Duration of the processing

This agreement applies for as long as Proust processes Customer Personal Data for you: the Term, plus the deletion window in article 20.

4. Controller's instructions

4.1 Proust processes Customer Personal Data only to provide the Service as you configured it, and on your documented instructions. If the law requires Proust to process it otherwise, Proust tells you first, where the law allows.

4.2 Proust receives only what a participant says in conversation after tapping Start under the disclosure text. Proust does not receive your customer database, point-of-sale data or account systems.

4.3 Identifiers you include in interview links are Customer Personal Data supplied under your instructions. Proust does not verify them. You approve each interview before a reward is released.

4.4 The contact details a participant gives to receive a reward (email or Venmo phone number) are not Interview Data. Proust processes them as an independent Controller, only to pay rewards and prevent fraud, and never discloses them to you.

5. Assistance to the controller

Proust helps you respond to Data Subject requests about Interview Data: access, correction, deletion, opt-out. On request, Proust gives you the information reasonably needed to show compliance with this agreement.

6. Information obligations

If Proust becomes aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, Proust notifies you without undue delay, and in any event within 72 hours. The notice describes what happened, which data is affected, what Proust has done about it, and whom to contact, with updates as the investigation continues. Giving notice is not an admission of fault.

Proust gives you at least 14 days' notice before adding or replacing a Subprocessor that processes Interview Data (article 9).

7. Processor's obligations

Proust:

• processes Customer Personal Data only as this agreement allows;
• does not use Customer Personal Data to train or improve any machine-learning model, and uses only AI providers whose terms exclude it from training (article 9.4);
• keeps records of its processing under this agreement for the Term plus 1 year;
• confirms deletion in writing on request (article 20).

8. Controller's obligations

You must not send, and the Service is not designed to collect: consumer financial account or transaction data, bank credentials, credit or lending data, government identifiers (SSN, EIN), payment card data, or "nonpublic personal information" as defined in the Gramm-Leach-Bliley Act. If a participant volunteers such data in an answer, Proust redacts or deletes it promptly once it is discovered or once you tell us, and it is not used in any analysis.

You are responsible for the lawfulness of your instructions and for the identifiers you place in interview links (article 4.3).

9. The use of subprocessors

9.1 You give general written authorization for the Subprocessors in Annex III.

9.2 Notice of a new or replaced Subprocessor is posted on the "Your data & privacy" page and, where Proust has a notice address for you, sent by email. You may object in writing within 30 days of the notice on reasonable data-protection grounds. The parties then work in good faith to resolve the objection. If they cannot, you may end the Service without penalty.

9.3 Proust binds each Subprocessor to data-protection obligations at least as protective as this agreement, and remains responsible for how its Subprocessors perform.

9.4 AI providers:

• Language-model processing runs only through the Anthropic API under Anthropic's standard commercial terms, which prohibit training on API inputs and outputs, incorporate Anthropic's Data Processing Addendum by reference, and delete inputs and outputs within 30 days under Anthropic's published retention policy.
• Voice interviews run on ElevenLabs under its standard terms and published Data Processing Addendum. Audio storage is disabled, so participant audio is not stored. Proust's account-level training opt-out is exercised, so transcripts are not used to train or improve ElevenLabs' models.

10. Rights of the data subjects

If a participant contacts Proust directly about Interview Data, Proust tells you rather than answering the request itself. Requests about reward contact details (article 4.4) are handled by Proust directly.

11. Security measures

Proust maintains the technical and organizational measures in Annex II and does not materially weaken them during the Term.

Proust is an early-stage company and is pre-SOC 2. No independent audit report exists, and none is claimed. Instead, Proust completes your vendor security questionnaire on reasonable request and will pursue SOC 2 as the company grows.

12. Audit

Once in any 12-month period, and again after a security incident, you may send Proust a written security questionnaire, which Proust completes within a reasonable time, and ask for Proust's current security documentation. On-site audits need justified grounds and 30 days' notice. If Data Protection Law requires more, the parties agree scope, timing and cost in advance.

13. Transfer to third parties

Where the CCPA/CPRA applies, Proust is your "service provider". Proust does not sell or share Customer Personal Data; does not keep, use or disclose it for any purpose other than providing the Service, or as the CCPA permits; does not combine it with data from other sources except to provide the Service; and certifies that it understands these restrictions.

14. International transfer

All processing takes place in the United States, on the infrastructure in Annex III. Proust does not transfer Customer Personal Data outside the United States without your prior written consent. If such a transfer is later agreed and involves EU or UK data, the parties sign the EU Standard Contractual Clauses (Module 2) and the UK Addendum, which are incorporated by reference.

15. Conduct towards authorities

If a public authority asks Proust for Customer Personal Data, Proust tells you before complying, where the law allows (article 4.1).

16. Intellectual property

Interview Data is yours. Proust owns the Service.

17. Confidentiality

Everyone Proust authorizes to process Customer Personal Data is bound by confidentiality obligations. Production data access is limited to Proust's founding team, on a need-to-operate basis.

18. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Use.

19. Jurisdiction

Governing law and venue follow the Terms (California, USA). If this agreement conflicts with the Confidentiality Agreement or the Terms on a question of personal-data processing, this agreement controls.

20. Termination of the agreement

20.1 Proust keeps Customer Personal Data for the Term. You control how long transcripts are kept. You can delete individual interviews, or the whole account, at any time.

20.2 During the Term you can ask for an export of Customer Personal Data at any time, in a portable format (CSV or JSON).

20.3 When you delete data, or when your account ends, Proust deletes Customer Personal Data from the live database. Backup copies are deleted within 14 days. If you ask in writing within 30 days of the account ending, Proust exports Customer Personal Data to you before deleting it. Aggregated or de-identified insights that no longer identify anyone may be kept.

20.4 No audio is stored by Proust or by its voice provider. The voice provider's transient copy of a transcript is deleted automatically within 30 days. Proust's database holds the canonical transcript.

20.5 Copies the law requires Proust to keep remain protected under this agreement.

21. General provisions

Proust may publish a new version of this agreement. You are asked to accept the new version before you next publish an interviewer, and the version you accepted is recorded for your account.

Annex I — Parties and description of the processing

Parties. Controller: the business holding the account, identified by its account email. Processor: Proust.

Subject matter and purpose. AI-conducted customer interviews. Proust's interviewer holds short one-to-one conversations, by text or voice, with participants who open your link, embed or QR code and tap Start, and produces findings for you.

Duration. The Term, plus the deletion window in article 20.

Data Subjects. Your customers and other participants who choose to start an interview, and your staff who administer the account.

Personal Data. Interview answers and conversation content: text, and live voice transcripts where a participant chooses voice. Any personal information a participant shares in conversation. Research insights attributable to a participant. The identifiers and fields you attach to an interview through its link. A coarse location label you choose for a QR placement.

Sensitive data. None intended. Incidental disclosures are handled under article 8. Voice is processed for its content only: no voiceprint, biometric identification or speaker recognition. For interviews at a venue, presence is checked once at the start, and only the verified-or-not result is kept, never coordinates.

Out of scope. The excluded categories in article 8; participant reward contact details (article 4.4); your customer database, point-of-sale data and platform-partner data.

Annex II — Technical and organisational measures

• Encryption. TLS in transit. Encryption at rest within Proust's infrastructure (managed Postgres; the application is served only over HTTPS). Voice interviews run over the voice provider's TLS-encrypted service.
• Infrastructure. Fully managed platforms: Vercel for the web application, Railway managed containers and Postgres for the backend. No self-managed servers or operating systems.
• Audio. Never stored. Conversations are transcribed live, and audio storage is disabled at the voice provider.
• Tenant isolation. Every access path to Interview Data is checked server-side against account ownership. The browser never receives another account's data. Interview links carry an opaque identifier, not data.
• Identity and access. Business sign-in through Google. Server-to-server calls behind a shared proxy secret. Production secrets held in platform-managed environment stores. Production data access limited to the founding team on a need-to-operate basis.
• Participant-link integrity. Reward-claim links are cryptographically signed.
• Backups. Automated database backups. Deleted data leaves backups within 14 days.
• Consent. Each participant's Start tap is recorded with the version of the disclosure text shown. Your acceptance of this agreement is recorded per account and version.
• Incident response. Founder-led, with the 72-hour notice in article 6.
• Compliance status. Pre-SOC 2. No certification is claimed. SOC 2 is on the roadmap.

Annex III — List of subprocessors

The current list is kept on the "Your data & privacy" page.

Change note, v3 (2026-10-05): rewritten in plain English and restructured into 21 articles and three annexes; same obligations as v2. Added: art. 4.3 identifiers in links; 14-day backup deletion (art. 20.3, Annex II); PostHog in Annex III; "identifiers and fields you attach" inside Interview Data. Removed: "signed sign-in codes" from Annex II. Acceptance moved to account creation, to match the Terms. Reward contact details are "email or Venmo phone number".