Data processing agreement

Which data this covers, and which it does not

It covers personal data we process on your instructions: your own users' account records, and personal data inside material you upload, paste or direct the crawler to. It does not cover the founders and executives our analysis discovers from public sources — for that data we are an independent controller on our own legal basis, and /notice-to-individuals explains it. It also does not cover our billing records or our security and operational logs.

What we will and will not do with it

We process it only on your documented instructions — your subscription terms, this agreement, and your use of the product's features together being those instructions. We will tell you if an instruction appears to us to infringe data-protection law, and may suspend it until that is resolved. Everyone we authorise to process it is bound by confidentiality. We do not sell it, and we do not train models on it.

Security

We maintain the measures below and will not materially reduce them during your subscription:

• Workspace-scoped access enforced at the API layer, with cross-tenant isolation verified by an automated test suite on every deploy — a failing isolation test blocks the deploy.
• Passwords stored only as salted bcrypt hashes; session tokens signed and expiring; verification and reset tokens single-use, auto-expiring and stored as SHA-256 hashes.
• TLS on all connections; managed PostgreSQL with encryption at rest and managed backups.
• Report share links signed, expiring and revocable, scoped to a single report; exports delivered through a token-scoped route.
• Rate limiting on authentication, form submission and export; structured operational logging retained 30 days; error tracking and alerting on unhandled errors and pipeline degradation.
• Account email, organisation name and workspace metadata are never sent to the language model — only the cleaned text of sources you confirmed.
• Self-service data export and company deletion; account deletion on request within 14 days.

What we do not yet have

Stated plainly because a security annex that hides its gaps is worth less than one that does not: we hold no SOC 2 or ISO 27001 certification, we have not yet commissioned a formal penetration test, multi-factor authentication for customer accounts is not yet available, and the service is operated by one person without a documented succession plan.

Subprocessors

You give general authorisation for us to engage the subprocessors listed at /subprocessors. We will notify active customers by email and update that page at least 30 days before adding or replacing one. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection you may terminate the affected part of the service without penalty and receive a pro-rata refund. Because some of these providers are essential to the service running at all, an unresolved objection to one of them may mean termination rather than substitution. We remain fully liable to you for our subprocessors' performance.

Helping you meet your own obligations

The product provides self-service export and deletion so you can answer most data-subject requests yourself. Where a request concerning your data reaches us directly we forward it to you without undue delay and within 3 business days, and do not respond substantively ourselves. We assist you with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing and the information available to us. This assistance is free unless a request is manifestly unfounded, excessive or repetitive.

If there is a breach

We give you an initial notice of the material information without undue delay and, where reasonably practicable, within 24 hours of becoming aware of a personal data breach affecting your data, with supplemental information as the investigation progresses. An acknowledgement of receipt is not that notice. We will not notify your data subjects or a supervisory authority on your behalf without your instruction.

Audit

We make available the information necessary to demonstrate compliance with Article 28. You may audit once in any 12 months on 30 days' written notice, and more often where a supervisory authority requires it or following a breach affecting you. Audits proceed by questionnaire and documentary evidence first, with an on-site inspection only where reasonably necessary; they may not extend to other customers' data or to our trade secrets, including the Vision ontology. You bear your own costs, and our reasonable costs beyond the first audit in any 12-month period.

Transfers outside the EEA

We do not transfer your personal data outside the EEA except to the providers listed at /subprocessors. Where personal data reaches a provider established outside the EEA, the transfer is governed by that provider's data processing terms, which incorporate the European Commission's Standard Contractual Clauses and, for some providers, certification under the EU–US Data Privacy Framework.

Deletion or return, when it ends

During your subscription and for 30 days after it ends you can export your data through the product. At your election, notified within that period, we will either return it through that route or delete it; absent an election we delete. Either way we delete or irreversibly anonymise it within 90 days of termination, unless the law requires us to keep something — in which case we tell you what and why. Backups age out on their own cycle and are not restored to live systems.

Term and precedence

This agreement runs for as long as we process personal data on your behalf. Where it conflicts with your subscription terms on any matter of personal data, this agreement prevails. It is governed by the law of Belgium and disputes are resolved in the courts of the judicial district of Brussels.