Effective date: 2026-09-08
This Data Processing Agreement ("DPA") forms part of the Proust Terms & Conditions between Proust (the Processor) and the business that creates a Proust account and runs interviews ("Customer", the Controller). It governs Proust's processing of Personal Data on Customer's behalf in connection with the Proust service (the "Service"). Customer accepts this DPA by click-through when publishing an interviewer; no signature is needed. It supplements the Confidentiality Agreement accepted at the same time.
"Personal Data," "Controller," "Processor," "Data Subject," "Processing," and "Supervisory Authority" have the meanings given in applicable Data Protection Law. "Data Protection Law" means all privacy and data protection laws applicable to the Processing, including the California Consumer Privacy Act as amended (CCPA/CPRA) and, to the extent applicable, the EU/UK GDPR. "Subprocessor" means a third party engaged by Proust to process Customer Personal Data. "Customer Personal Data" means Personal Data in Interview Data — transcripts, analyses, and insights from interviews run under Customer's account. "Term" means the period during which Customer holds a Proust account.
2.1 Proust will process Customer Personal Data only (a) to provide the Service as configured by Customer, and (b) per Customer's documented instructions, unless required otherwise by law (in which case Proust will notify Customer before processing, where legally permitted).
2.2 Data minimization by design. Proust receives only what a participant volunteers in conversation after tapping Start under the disclosure copy. Proust does not receive Customer's customer database, point-of-sale data, or account systems.
2.3 Excluded data. Proust will not request, Customer will not send, and the Service is not designed to collect: consumer financial account or transaction data, bank credentials, credit or lending data, government identifiers (SSN/EIN), payment card data, or any "nonpublic personal information" as defined under the Gramm-Leach-Bliley Act. If a participant volunteers such data incidentally (e.g., inside an interview response), Proust will redact or delete it promptly upon discovery or upon Customer's notice, and it is not used in synthesis outputs.
2.4 Participant reward data. Contact details a participant provides to receive a reward (email, phone number, Venmo handle) are processed by Proust as an independent controller, solely to pay rewards and prevent fraud, and are never disclosed to Customer.
Proust will ensure that every person it authorizes to process Customer Personal Data (including its personnel) is bound by confidentiality obligations. Access to production data is limited to Proust's founding team, on a need-to-operate basis.
Proust will implement and maintain the technical and organizational measures described in Annex B, and will not materially degrade them during the Term. Customer acknowledges Proust's compliance posture as stated in Annex B: Proust is an early-stage company and is pre-SOC 2 — no independent third-party audit report exists and none is represented. In its place, Proust will complete Customer's vendor security questionnaire on reasonable request and will pursue SOC 2 certification as the company matures.
5.1 Customer provides general written authorization for the Subprocessors listed in Annex C.
5.2 Proust will give Customer at least 14 days' notice before adding or replacing a Subprocessor that processes Interview Data (notice is given on the "Your data & privacy" page and, where Proust has a notice address, by email). Customer may object in writing within 30 days of notice on reasonable data-protection grounds; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the Service without penalty.
5.3 Proust will bind each Subprocessor to data-protection obligations no less protective than this DPA and remains responsible for its Subprocessors' performance.
5.4 AI / no-training. Proust will not use Customer Personal Data to train or improve any machine-learning model, and engages only AI providers whose terms exclude Customer Personal Data from model training. Specifically: (a) LLM processing runs exclusively through the Anthropic API under Anthropic's standard commercial terms, which prohibit training on API inputs and outputs, incorporate Anthropic's Data Processing Addendum by reference, and automatically delete API inputs and outputs within 30 days under Anthropic's published retention policy; (b) voice interviews run on ElevenLabs under its standard terms and published Data Processing Addendum, with Proust's account-level training opt-out exercised and audio storage disabled, so participant audio is not stored and transcripts are not used to train or improve ElevenLabs' models.
Taking into account the nature of the processing, Proust will assist Customer in responding to Data Subject requests (access, correction, deletion, opt-out) concerning Interview Data. If a Data Subject contacts Proust directly regarding Interview Data, Proust will notify Customer rather than respond substantively, except for requests concerning participant reward data (§2.4), which Proust handles directly.
7.1 Proust retains Customer Personal Data for the Term. Customer controls how long transcripts are kept and may delete individual interviews, or the whole account, at any time.
7.2 During the Term, Customer may request export of Customer Personal Data at any time, delivered in a portable format (CSV/JSON).
7.3 Deletion: on deletion by Customer, or on account termination, Proust deletes Customer Personal Data from the live database; short-lived backup copies expire on a fixed schedule. On written request within 30 days of termination, Proust will instead export Customer Personal Data to Customer before deletion. Aggregated or de-identified insights that no longer identify any Data Subject may be retained.
7.4 Provider copies: no audio is stored by Proust or its voice provider; the voice provider's transient transcript copy is deleted automatically within 30 days (Proust's database holds the canonical transcript).
7.5 Proust will confirm deletion in writing on request, except for copies required to be retained by law (which remain protected under this DPA).
Proust will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data. The notice will describe the nature of the incident, the data affected, mitigation taken, and a contact point, with updates as the investigation progresses. Notification is not an admission of fault.
Once per 12-month period, and additionally following a security incident, Customer may (a) submit a written security questionnaire, which Proust will complete within a reasonable time, and (b) request Proust's then-current security documentation. Proust will maintain records of its processing under this DPA for the Term plus 1 year. On-site audits require justified grounds and 30 days' notice; if Data Protection Law requires more, the parties will agree on scope, timing, and cost in advance.
To the extent CCPA/CPRA applies, Proust acts as Customer's "service provider": it will not sell or share Customer Personal Data, will not retain, use, or disclose it for any purpose other than performing the Service (or as permitted by CCPA), will not combine it with data from other sources except to perform the Service, and certifies that it understands these restrictions.
All processing occurs in the United States on the infrastructure listed in Annex C. Proust will not transfer Customer Personal Data outside the United States without Customer's prior written consent; if such a transfer is later agreed and involves EU/UK data, the parties will execute the EU Standard Contractual Clauses (Module 2) and UK Addendum, incorporated by reference.
This DPA applies for as long as Proust processes Customer Personal Data for Customer. Each party's liability under this DPA is subject to the limitations in the Proust Terms & Conditions. If this DPA conflicts with the Confidentiality Agreement or the Terms, this DPA controls for Personal Data processing. Governing law and venue follow the Terms (California, USA). Proust may amend this DPA by publishing a new version; Customer will be asked to accept the new version before next publishing an interviewer, and the version accepted is recorded per account.
| Subprocessor | Role | Location | Reads or hears conversations? |
|---|---|---|---|
| Railway Corp. | Application hosting and database (managed Postgres) | USA | Yes — transcripts are stored in Proust's database on Railway, encrypted at rest |
| Anthropic, PBC | LLM processing (interview conversation + synthesis) | USA | Yes — processes conversations to run them; standard commercial API terms, no training on inputs/outputs; Anthropic's Data Processing Addendum incorporated by reference; inputs/outputs auto-deleted within 30 days |
| ElevenLabs, Inc. | Voice conversations (speech in, speech out) | USA | Yes (voice interviews only) — audio storage disabled; account-level training opt-out exercised; its transcript copy auto-deletes in 30 days |
| Vercel, Inc. | Web application hosting | USA | In transit only — nothing stored |
| Resend | Transactional email (reward claims, sign-in) | USA | No — email addresses only |
| Tremendous / PayPal | Reward payouts | USA | No — payout contact details only (never disclosed to Customer) |
The current list is maintained on the "Your data & privacy" page.