Data Processing Addendum

1. Scope and Roles

This Addendum applies when Priowise processes personal data on behalf of the Customer.

• Customer — Data Controller
• Priowise B.V. — Data Processor

2. Nature and Purpose of Processing

Processing includes storing data, retrieving data, AI analysis, and generating reports and recommendations.

Data is never used for advertising or profiling.

3. Lawful Basis and Purpose Limitation

Priowise processes personal data on the basis of contractual necessity — to deliver the services described in the Terms of Service. Data is processed solely for the purpose of providing AI-powered product strategy analysis and recommendations.

Access to Customer content (including strategy inputs, roadmap data, and analysis outputs) is limited to Priowise's administrator and happens only at the Customer's explicit request for support or troubleshooting. Administrative changes to accounts are logged.

4. Data Categories and Subjects

Possible data categories

• Names
• Email addresses
• Job titles
• Team information
• Roadmap or strategy ownership data

Data subjects may include

• Employees
• Contractors
• Authorized users

Retention periods

• Account and workspace data — retained for the duration of the subscription; permanently deleted after a 5-day grace period following a workspace deletion request
• Pipeline analysis outputs — retained for the duration of the subscription; permanently deleted with the workspace
• Deleted products — permanently purged 30 days after deletion
• Billing records — retained for 7 years (Dutch statutory retention obligation)
• Product analytics event data — retained for up to 12 months

5. Subprocessors

Priowise engages the following subprocessors to process Customer data, each bound by equivalent data protection obligations:

• Anthropic — AI model execution (Claude)
• Tavily — web search and market intelligence retrieval
• Vercel — hosting and content delivery
• Supabase — application database (Frankfurt, Germany)
• Clerk — authentication and subscription management
• Inngest — background job processing
• Upstash — rate limiting
• PostHog — product analytics (EU)
• Brevo — transactional email
• Stripe — payment processing
• Cloudflare — DNS and content delivery network

Priowise will notify Customers of material subprocessor changes and provide a reasonable opportunity to object.

6. Data Transfers

Customer data is stored in the EU (Supabase, Frankfurt, Germany) and application servers run in Frankfurt. Where subprocessors process data outside the EEA, transfers are safeguarded by:

• EU-U.S. Data Privacy Framework where the provider is certified
• EU Standard Contractual Clauses (SCCs) in all other cases

7. Security Measures

Security includes:

• Encryption in transit and at rest
• Access control and role-based permissions
• Activity logging
• Backup and recovery systems
• Access to Customer content is limited to Priowise's administrator and happens only at the Customer's explicit request for support or troubleshooting. Administrative changes to accounts are logged.

8. Data Subject Rights Assistance

Priowise assists Customers with requests involving:

• Access
• Correction
• Deletion
• Restriction
• Portability

9. Data Breach Notification

If a breach occurs, Priowise will notify the Customer without undue delay and provide:

• Breach description
• Affected data scope
• Mitigation actions

10. Termination and Deletion

Upon termination, the Customer may request data return or deletion. Anonymized analytics data may be retained.

11. Audit Rights

Customers may request compliance documentation or conduct audits with reasonable notice (maximum once per year unless required by law).

12. Miscellaneous

This Addendum:

• Forms part of the Terms of Service
• Applies while Priowise processes Customer Data
• Prevails over conflicting provisions regarding data protection

Enterprise customers may request a signed DPA by contacting privacy@priowise.com.