Data Processing Addendum

01Roles and scope

For personal data contained in the subjects you assess and your tenant content, you are the controller and we are the processor. We process such data only on your documented instructions, which include this DPA and your use of the service.

02Subject matter and duration

We process customer personal data for the purpose of providing the diligence platform, for the duration of your subscription, plus the return-and-deletion period below and any legally required retention period.

03Nature and purpose of processing

Ingestion, structuring, retrieval, scoring, and storage of public-record and submitted materials to generate cited risk × upside scorecards and maintain a tamper-evident audit trail. We do not use customer personal data to train machine-learning models.

04Categories of data and data subjects

Primarily public-record company and founder data, plus any personal data you choose to submit. Customers are instructed to submit only data they are entitled to process; an inline sensitive-data quarantine and DLP guard reduce the risk of inadvertent special-category data entering the processing path.

05Sub-processors

You authorise us to engage the sub-processors listed below. We will give at least 30 days' notice, by email to your workspace admins and on this page, before adding or replacing one, so you can object on reasonable grounds. This list was last updated on 5 October 2026.

Infrastructure

• Supabase — database and user authentication, including account emails such as sign-up confirmation and sign-in links (EU, Zurich).
• Fly.io — application servers and background workers (EU, Frankfurt).
• Cloudflare — website hosting, DNS, TLS and network security (global edge network).

Payments, sign-in and email

• Stripe — payments, subscriptions, invoicing and the billing portal.
• Google — optional “Continue with Google” sign-in.
• Resend — email replies to demo requests.

AI processing

• phi-cloud — our model gateway. It runs the language and embedding models that analyse public-record data, generate reports and answer questions in the Ask assistant, including the messages and files you send it. By default it uses open-weight models hosted in the EU by Scaleway (France) and Infomaniak (Switzerland); where a feature requires a frontier model it can route to Anthropic, OpenAI, Microsoft Azure OpenAI or Google.
• Laya — classifies news headlines and court-record captions to decide whether a monitoring alert is relevant.
• AdaptivMapr — turns documents you upload privately into structured tables. For spreadsheets and Office tables it sends at most column headers and a few sample cells to a language model; PDFs and images are read in full by models routed through phi-cloud.

Data collection

• twin-browser — fetches and renders public web pages (such as company websites) used to build company and contact profiles.

None of these providers may use your data to train models.

06Security measures

Encryption in transit and at rest; a separate database schema per workspace, with access bound to the authenticated workspace on every request; least-privilege service credentials; an append-only, hash-chained audit trail for regulated actions; and access logging.

07International transfers

We host the service in the EU (database in Switzerland, application servers in Germany). Some sub-processors — Cloudflare's edge network, Stripe, Google sign-in, Resend and any US model provider reached through phi-cloud — may process data outside the EEA/UK. Where they do, we rely on the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

08Assistance, breach notification, and audits

We assist you with data-subject requests and DPIAs, notify you without undue delay of a personal-data breach affecting your data, and make available information necessary to demonstrate compliance, including audit support and our security-controls evidence bundle.

09Return and deletion

On termination, we make customer personal data available for export for 30 days and then delete or anonymise it within a further 30 days, except billing records we must keep by law (10 years). During the subscription, workspace admins can set automatic deletion of monitoring alerts and Ask assistant history (30, 90, 180 or 365 days; by default they are kept for the life of the workspace), and each user can delete their own account in Settings.

10Contact

Data-protection enquiries: privacy@marketprior.com; security matters: security@marketprior.com.