# Data Processing Addendum Source: https://prolyticshq.com/legal/dpa Current content retained during the coming-soon period. Earlier launch offers are historical; this site provides no purchase or product login. Prolytics Limited Last updated: March 23, 2026 ## 1. Introduction [#1-introduction] This Data Processing Addendum ("DPA") forms part of the agreement between Prolytics Limited ("Prolytics") and the customer using Prolytics OS ("Customer") when Prolytics processes Customer Personal Data on behalf of Customer. This DPA applies only to Customer Personal Data that Prolytics processes as a processor or service provider on behalf of Customer. It does not apply to personal information that Prolytics processes as a controller, such as account, billing, website, support, and service-administration information. If there is a conflict between this DPA and the Terms of Service, this DPA controls for processing of Customer Personal Data. ## 2. Definitions [#2-definitions] "Agreement" means the Terms of Service or other agreement governing Customer's use of the Services. "Applicable Data Protection Laws" means data protection and privacy laws that apply to the processing of Customer Personal Data, including, where applicable, the Hong Kong Personal Data (Privacy) Ordinance, GDPR, UK GDPR, Canadian privacy laws, U.S. state privacy laws, and other applicable privacy laws. "Customer Personal Data" means personal data, personal information, or similar regulated information contained in Customer Data that Prolytics processes on behalf of Customer through the Services. "Controller," "processor," "personal data," "processing," "data subject," and similar terms have the meanings given under Applicable Data Protection Laws. "Subprocessor" means a third-party processor engaged by Prolytics to process Customer Personal Data on behalf of Customer. ## 3. Roles of the parties [#3-roles-of-the-parties] For Customer Personal Data, Customer is the controller, business, or equivalent decision-maker, and Prolytics is the processor, service provider, or equivalent service provider. Customer determines the purposes and means of processing Customer Personal Data, including which sources are connected, which data is made available, which users have access, and how outputs are used. Prolytics processes Customer Personal Data only to provide, secure, support, and improve the Services according to the Agreement, this DPA, Customer's documented instructions, and applicable law. ## 4. Customer instructions [#4-customer-instructions] Customer instructs Prolytics to process Customer Personal Data to: * provide the Services; * connect to Customer-selected providers; * generate metrics, alerts, findings, investigations, reports, and AI-assisted outputs; * store customer-visible service history; * maintain, secure, debug, monitor, and support the Services; * process billing, subscriptions, and credits; * comply with law and enforce the Agreement. The Agreement, this DPA, Customer's use and configuration of the Services, and written instructions from authorized Customer representatives constitute Customer's documented instructions. Prolytics will notify Customer if it believes an instruction violates Applicable Data Protection Laws, unless prohibited by law. ## 5. Customer responsibilities [#5-customer-responsibilities] Customer is responsible for: * providing all required notices and obtaining all required rights, consents, permissions, and legal bases; * ensuring Customer Personal Data may lawfully be processed by Prolytics; * configuring connected-source permissions appropriately; * limiting access to authorized users; * avoiding prohibited or sensitive regulated data unless separately agreed in writing; * responding to data subject requests where Customer is responsible; * reviewing AI outputs, metrics, alerts, and investigations before relying on them. ## 6. Prolytics obligations [#6-prolytics-obligations] Prolytics will: * process Customer Personal Data only according to Customer's documented instructions unless required by law; * ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations; * implement appropriate technical and organizational measures designed to protect Customer Personal Data; * assist Customer with data subject requests where reasonably possible and legally required; * assist Customer with security, breach, and compliance obligations where reasonably possible; * use Subprocessors according to this DPA; * return, delete, or anonymize Customer Personal Data according to the Agreement and this DPA, subject to legal, billing, security, backup, fraud-prevention, dispute-resolution, tax, audit, and legitimate business retention needs; * make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and operational limitations. ## 7. Security measures [#7-security-measures] Prolytics maintains technical and organizational measures designed to protect Customer Personal Data. These may include: * encrypted HTTPS connections and TLS for data in transit; * restricted access to production systems; * role-based access practices; * encrypted managed production database backups; * monitored infrastructure and application reliability; * retention cleanup for rebuildable caches and expired records; * redaction of raw Stripe webhook JSON after 180 days; * support-assisted deletion and export procedures; * incident response procedures; * controlled operational scripts for retention, maintenance, replay, rebuild, and tenant deletion. Additional information is available in the Security Overview and operations documentation. ## 8. Subprocessors [#8-subprocessors] Customer authorizes Prolytics to use Subprocessors to provide the Services. Prolytics will maintain a public Subprocessor List describing the current Subprocessors and their processing purposes. Prolytics will require Subprocessors to protect Customer Personal Data under written terms that are substantially similar to the protections in this DPA. Prolytics remains responsible for Subprocessors' processing of Customer Personal Data to the extent required by Applicable Data Protection Laws. If Prolytics adds or replaces a Subprocessor, Prolytics will update the Subprocessor List or provide notice as required by the Agreement or Applicable Data Protection Laws. ## 9. AI providers [#9-ai-providers] Prolytics may use AI providers such as Google Vertex AI/Gemini and Anthropic to provide AI-assisted features. AI providers may process selected prompts, metrics, evidence, provider context, source metadata, and related service records as needed to generate outputs. Production customer prompts, evidence packs, and AI outputs are not reused by Prolytics for model training or evaluation datasets by default. Non-operational reuse requires separate customer authorization. AI providers may process AI inputs and outputs according to their own service terms, data-processing terms, retention settings, abuse-monitoring rules, and customer configuration. Customer is responsible for ensuring that Customer Personal Data submitted to AI-assisted features may lawfully be processed for that purpose. ## 10. Personal data breach [#10-personal-data-breach] Prolytics will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will include available information reasonably required for Customer to meet its legal obligations, taking into account the nature of the Services, the information available to Prolytics, and any law enforcement, security, or confidentiality constraints. Prolytics may provide notice in stages as additional information becomes available. Customer is responsible for determining whether notice to data subjects, regulators, customers, or other parties is required, unless applicable law states otherwise. ## 11. Data subject requests [#11-data-subject-requests] If Prolytics receives a request from a data subject relating to Customer Personal Data, Prolytics may refer the requester to Customer unless legally required to respond directly. Prolytics will reasonably assist Customer with data subject requests where the request relates to Customer Personal Data processed by Prolytics and where Customer cannot reasonably fulfill the request without Prolytics' assistance. Export and deletion requests are support-assisted for MVP. ## 12. Return and deletion [#12-return-and-deletion] Upon Customer's request or termination of the Services, Prolytics will delete, return, or anonymize Customer Personal Data according to the Agreement, this DPA, and applicable operational procedures. Deletion may be limited or delayed where retention is required or permitted for billing, tax, legal, audit, security, fraud-prevention, dispute-resolution, backup, or legitimate business purposes. Managed production database backups expire no later than 90 days after creation unless a legal hold or incident-preservation requirement applies. ## 13. Audits [#13-audits] Upon reasonable written request, Prolytics will provide information reasonably necessary to demonstrate compliance with this DPA. Audits must be limited to once per year unless required after a material security incident or by law, must be conducted during normal business hours, must not disrupt the Services, and must not compromise the security or confidentiality of other customers or Prolytics systems. Prolytics may satisfy audit requests by providing security documentation, written responses, summaries, or third-party reports where available. ## 14. International transfers [#14-international-transfers] Customer authorizes Prolytics and its Subprocessors to process Customer Personal Data in Hong Kong, the United States, Canada, the European Economic Area, the United Kingdom, and other jurisdictions where Prolytics or its Subprocessors operate. Where Customer Personal Data subject to GDPR, UK GDPR, or similar transfer restrictions is transferred internationally, the parties will use appropriate transfer mechanisms as required by applicable law. These may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or UK International Data Transfer Agreement, contractual safeguards, or other lawful transfer mechanisms. Customers that require signed transfer documentation or specific SCC terms should contact [legal@prolyticshq.com](mailto:legal@prolyticshq.com). Prolytics may update transfer mechanisms if laws, regulatory guidance, or service providers change. ## 15. Duration [#15-duration] This DPA remains in effect for as long as Prolytics processes Customer Personal Data on behalf of Customer. ## Annex A: Details of processing [#annex-a-details-of-processing] ### Subject matter [#subject-matter] Provision of Prolytics OS, including product analytics, billing/revenue analysis, reliability analysis, alerts, investigations, issue tracking, AI-assisted outputs, support, security, and related workflows. ### Duration [#duration] For the duration of Customer's use of the Services and as needed for retention, backup, legal, billing, security, dispute-resolution, and operational purposes. ### Nature and purpose [#nature-and-purpose] Collection, retrieval, hosting, storage, organization, analysis, transformation, aggregation, redaction, deletion, transmission, and generation of customer-visible service records. ### Categories of data subjects [#categories-of-data-subjects] Customer's users and team members; Customer's end users, customers, subscribers, or product users where present in connected-source data; billing contacts; support contacts. ### Categories of personal data [#categories-of-personal-data] Names, email addresses, account identifiers, customer identifiers, subscription identifiers, event identifiers, usage metadata, product analytics metadata, billing metadata, reliability/error metadata, prompts, outputs, investigation records, and related source/context data. ### Sensitive data [#sensitive-data] The Services are not intended for sensitive regulated data unless Prolytics agrees in writing. ### Subprocessors [#subprocessors] Current Subprocessors are listed in the Subprocessor List. ## Annex B: Technical and organizational measures [#annex-b-technical-and-organizational-measures] Measures may include encrypted transport, restricted production access, encrypted backups, role-based access practices, monitoring, retention cleanup, Stripe webhook JSON redaction, support-assisted export/delete, operational runbooks, and incident response procedures.