Legal
Data Processing Agreement
Last updated: August 28, 2026
1. Definitions
Personal Data means any information relating to an identified or identifiable natural person collected through Proven. Processing means any operation on that data, including collection, storage, and deletion.
2. Scope
Proven processes Personal Data solely to provide the service: running the onboarding flow and the tools inside a founder's roadmap, managing accounts, processing payments, and sending service and follow-up emails (each with an opt-out).
3. Your Responsibilities
You must have a lawful basis for any personal data included in your idea submissions. Do not submit other people's personal data as part of an idea description.
4. Our Obligations
Proven commits to:
- Processing data only to deliver the service
- Implementing appropriate security measures (see Security page)
- Notifying you promptly in the event of a breach affecting your data
- Deleting your data within 30 days of account deletion
5. Sub-processors
- Convex, Inc. — database and backend
- Stripe, Inc. — payment processing
- Resend, Inc. — email delivery
- Vercel, Inc. — hosting
- Anthropic, PBC — AI processing for roadmap tools and onboarding
- Datafast — product analytics (first-party identifiers, no cross-site tracking)
We will notify you before adding new sub-processors.
6. Data Transfers
Data may be processed in the United States where our sub-processors operate, protected by Standard Contractual Clauses where applicable.
7. Retention and Deletion
Data is retained for the lifetime of your account and removed within 30 days of deletion. Earlier removal available on request.