Legal
Data Processing Agreement
Last updated: July 16, 2026
1. Definitions
Personal Data means any information relating to an identified or identifiable natural person collected through Proven. Processing means any operation on that data, including collection, storage, and deletion.
2. Scope
Proven processes Personal Data solely to provide the validation service — running Founder's Brief reports, processing re-runs with user corrections, managing accounts, processing payments, sending service and follow-up emails (each with an opt-out), and (for users whose plan includes it and who explicitly request it) delivering human-reviewed brief feedback.
3. Your Responsibilities
You must have a lawful basis for any personal data included in your idea submissions. Do not submit other people's personal data as part of an idea description.
4. Our Obligations
Proven commits to:
- Processing data only to deliver the service
- Implementing appropriate security measures (see Security page)
- Notifying you promptly in the event of a breach affecting your data
- Deleting your data within 30 days of account deletion
5. Sub-processors
- Convex, Inc. — database and backend
- Stripe, Inc. — payment processing
- Resend, Inc. — email delivery
- Vercel, Inc. — hosting
- Anthropic, PBC — AI processing for validation reports and Sharpen re-runs
- Datafast — product analytics (first-party identifiers, no cross-site tracking)
We will notify you before adding new sub-processors.
6. Data Transfers
Data may be processed in the United States where our sub-processors operate, protected by Standard Contractual Clauses where applicable.
7. Retention and Deletion
Data is retained for the lifetime of your account and removed within 30 days of deletion. Earlier removal available on request.