Data Processing Agreement

1. Roles

For the customer content you submit, you are the data controller and Prelude (currently operated as a sole trader pending incorporation) is the data processor, processing personal data only on your documented instructions — which, for the standard product, are the operations described in our Privacy Policy and Trust & Privacy page. This DPA forms part of, and is governed by, our Terms of Service.

2. Scope of processing

• Subject matter: providing the Prelude service.
• Duration: for the term of your subscription, until deletion.
• Nature and purpose: generating and reviewing deal artifacts, maintaining your Answer Vault, and related operations.
• Types of data: the content you submit (transcripts, artifacts, Vault items) and any personal data it contains.
• Data subjects: the people referenced in your content — typically your prospects, customers, and colleagues.

3. Our obligations

• process personal data only on your instructions;
• ensure people authorized to process it are bound by confidentiality;
• apply appropriate technical and organizational security measures (section 5);
• assist you, taking account of the nature of processing, with data-subject requests and with your security, breach-notice, and impact-assessment obligations;
• notify you without undue delay after becoming aware of a personal-data breach.

4. Subprocessors

You authorize us to use the subprocessors below to deliver the service. Each is bound by data-protection terms no less protective than this DPA, including no-training and zero/short retention for AI processors. We’ll give notice of intended changes so you can object.

• Anthropic — AI generation/review (post-redaction transcript content; no training on inputs).
• Scaleway — Vault embeddings on an EU-sovereign endpoint (when the Vault is enabled).
• Neon — Postgres hosting (eu-west-2, London).
• Vercel — application hosting.
• Clerk — authentication and identity.
• Stripe — billing (account/billing data, not call content).
• Resend — transactional email (your email address only; no call content).
• Sentry — error monitoring (error + metadata only; never call/artifact content).

The following are used only where you choose to connect them, to move data between Prelude and your own account at that provider: HubSpot, Salesforce, Google (Gmail + Calendar), Granola, Zoom, and Slack.

5. Security measures

• UK/EU data residency (Neon eu-west-2, London).
• PII redaction before content reaches an AI processor — client-side for paste/upload, server-side for connected sources.
• Encryption of integration tokens at rest (AES-256-GCM); encryption in transit.
• Metadata-only logging; content never logged.
• Server-side limits on AI calls: timeouts, retries, token budgets, per-user daily spend caps.
• Hard deletes enforced at the database layer.

6. International transfers

Data is stored in the UK/EU. Where a subprocessor processes data outside the UK/EU — for example, Anthropic in the United States — it is done under an appropriate transfer mechanism (the UK IDTA and/or EU Standard Contractual Clauses with supplementary measures). Embeddings stay EU-sovereign via Scaleway.

7. Return and deletion

On termination, or on your request, we delete your content. When you delete your account, deletion is a hard delete that cascades through every deal, call, artifact, version, Vault item, embedding, and questionnaire you own — immediate and irreversible.

8. Audit

We’ll make available the information reasonably necessary to demonstrate compliance with this DPA, and support audits as required by applicable law. We do not currently hold SOC 2 or ISO 27001 certification; our security posture is documented on the Trust & Privacy page.

Signing this DPA

These processor terms are incorporated into, and take effect with, your Terms of Service — no separate signature is required for them to apply. Enterprise customers who need a separately countersigned copy can request one at finnlawfordmee@gmail.com.