Draft. This document is not legal advice. A lawyer must review it before launch.
Data processing agreement
On this page
- 1. Parties and scope
- 2. Roles
- 3. Details of the processing
- 4. Data minimisation
- 5. AI processing
- 6. Emails to customers
- 7. Consent and withdrawal
- 8. Security
- 9. Deletion and return
- 10. Sub-processors
- 11. International transfers
- 12. Help with data subject requests
- 13. Data breaches
- 14. Audits
- 15. Governing law
- 16. Contact
1. Parties and scope
This agreement ("DPA") is between the business that uses Proven Praise (the "controller") and [Company legal name] ([ABN]), [address] ("Proven Praise", the "processor"). It is part of the terms of service. It applies to the personal data of the controller's customers that Proven Praise processes to give the service.
2. Roles
- The controller decides why customer data is processed. The controller chooses which customers get a request.
- Proven Praise processes customer data only on the documented instructions of the controller. These terms and the settings in the dashboard are those instructions.
- If Proven Praise thinks that an instruction breaks the law, Proven Praise tells the controller.
3. Details of the processing
| Data subjects | Customers who paid the controller through Stripe. |
|---|---|
| Personal data | Name and email (encrypted, deleted when the request flow ends); a keyed hash of the email; payment date, currency and amount band; Stripe customer and charge IDs; video, transcript, AI selections, text, display name, title and rating; consent choices. |
| Special categories | Proven Praise does not ask for special category data. A video shows the face and voice of the customer. [Lawyer: confirm if this is biometric data under the laws that apply. Proven Praise does not do face or voice recognition.] |
| Purpose | Send one request and one reminder; record, transcribe and cut testimonials; sign verification records; show approved testimonials in widgets and on verification pages. |
| Duration | While the controller uses Proven Praise, then as section 9 describes. |
4. Data minimisation
- Proven Praise has read-only access to Stripe customers and charges. It never asks for write access.
- Proven Praise never collects card numbers. It keeps an amount band, not the exact amount.
- Proven Praise deletes the customer email when the request flow ends. A keyed hash prevents duplicate requests.
- Public pages never show the customer's email, card, exact amount or Stripe charge ID.
5. AI processing
The AI only selects and cuts. It never writes, changes or generates a customer's words, voice or face. Proven Praise sends the transcript to Anthropic to select clip times and a quote. Proven Praise checks that each quote is an exact part of the transcript. Proven Praise does not use customer data to train AI models.
6. Emails to customers
- Proven Praise sends a maximum of one request and one reminder to each customer for each business.
- Every email has an unsubscribe link and a postal address. The unsubscribe works with one click.
- The controller must make sure that it can lawfully contact each customer.
7. Consent and withdrawal
- Before a customer sends a testimonial, the customer chooses where the controller can use it: website, social media or ads. Proven Praise stores these choices with the date and time.
- The customer can withdraw at any time through the link on the verification page. Proven Praise then deletes the media, the transcript, the text and the verification record, and removes the testimonial from all widgets.
- The controller must stop all use of a withdrawn testimonial, including copies that it made outside Proven Praise.
8. Security
- Encryption in transit (HTTPS) and encryption of customer emails and Stripe tokens at rest.
- Row-level security: each business can read only its own data. Only server code writes verification data.
- Single-use request links, stored as hashes, that expire after 21 days.
- Access to production systems only for authorised staff. [List staff controls.]
- Proven Praise staff who process customer data have a duty of confidentiality.
9. Deletion and return
When the controller closes its account, Proven Praise deletes customer data within [number] days, unless the law requires Proven Praise to keep it. [Describe how the controller can export its data before it closes the account.]
10. Sub-processors
The controller gives general authorisation for Proven Praise to use these sub-processors. Proven Praise tells the controller at least [number] days before it adds or replaces a sub-processor. The controller can object. Proven Praise puts data protection terms in place with each sub-processor.
| Sub-processor | Use | Location |
|---|---|---|
| Supabase | Database, login and file storage | [region] |
| Cloudflare | Hosting of the website, the API and the widget script | [region] |
| Stripe | Read-only access to customers and charges | [region] |
| Mux | Video upload, encoding, storage and playback | [region] |
| AssemblyAI | Transcripts | [region] |
| Anthropic | AI selection of clips and a quote from the transcript | [region] |
| Resend | Request and reminder emails | [region] |
| Trigger.dev | Background jobs | [region] |
| Fly.io | Video render worker | [region] |
11. International transfers
[Lawyer: add the transfer mechanism, for example standard contractual clauses, for each region.]
12. Help with data subject requests
If a customer sends a request to Proven Praise (for example access or deletion), Proven Praise tells the controller without undue delay. Proven Praise helps the controller to answer requests. The withdraw flow lets a customer remove a testimonial directly.
13. Data breaches
If Proven Praise finds a personal data breach that affects customer data, Proven Praise tells the controller without undue delay and within [number] hours. Proven Praise gives the facts that the controller needs to notify regulators and people.
14. Audits
On request, Proven Praise gives the controller the information that it needs to show compliance with this DPA. [Lawyer: add audit terms.]
15. Governing law
[governing law]
16. Contact
[Company legal name], [address]. Email: [contact email].