Legal
Data Processing Agreement
Last updated: May 31, 2026
1. Definitions
Personal Data means any information relating to an identified or identifiable natural person collected through Proven. Processing means any operation on that data, including collection, storage, and deletion.
2. Scope
Proven processes Personal Data solely to provide the validation service — running reports, managing accounts, and processing payments.
3. Your Responsibilities
You must have a lawful basis for any personal data included in your idea submissions. Do not submit other people's personal data as part of an idea description.
4. Our Obligations
Proven commits to:
- Processing data only to deliver the service
- Implementing appropriate security measures (see Security page)
- Notifying you promptly in the event of a breach affecting your data
- Deleting your data within 30 days of account deletion
5. Sub-processors
- Convex, Inc. — database and backend
- Stripe, Inc. — payment processing
- Resend, Inc. — email delivery
- Vercel, Inc. — hosting
- Anthropic, PBC — AI processing for validation reports
We will notify you before adding new sub-processors.
6. Data Transfers
Data may be processed in the United States where our sub-processors operate, protected by Standard Contractual Clauses where applicable.
7. Retention and Deletion
Data is retained for the lifetime of your account and removed within 30 days of deletion. Earlier removal available on request.