Data processing agreement.

This agreement applies when a customer ("you") uses the Quantiveo platform in a way that has us process personal data on your behalf — for example, names of people you track in a watchlist, recipients of the reports you send, or content you upload for analysis. It forms part of the Terms of Service. To sign a copy, or to request one with the standard contractual clauses attached, write to legal@quantiveo.com.

It does not cover the public-coverage records Quantiveo holds about people in the news for its own purposes; those are described in Part B of the Privacy Policy, for which Quantiveo is the controller.

1. Roles

For the personal data you put into the service, you are the controller (or a processor acting for your own controller) and TheCrux Studios Inc., doing business as Quantiveo, is your processor. We process it only on your documented instructions, which are the Terms of Service, this agreement, and your use of the product's features.

2. Subject matter, duration, nature and purpose

Subject matter: the personal data you enter into or generate with the service. Duration: the term of your subscription plus the deletion period in section 8. Nature and purpose: storing, indexing, analysing and delivering that data so the service can do what you use it for — monitoring coverage, running agents, producing and delivering reports.

3. Categories of data and data subjects

Typically: names and public roles of people and organisations you choose to track; names and email addresses of your team members and of recipients you configure for deliveries; content of documents you upload; and usage records tied to your users. Data subjects are your staff, your delivery recipients, and the people named in what you track or upload. You must not put special-category data, children's data, or data you have no right to share into the service.

4. Our obligations

• Process only on your instructions and tell you if an instruction appears to break the law.
• Keep the data confidential; anyone with access is bound by confidentiality and trained.
• Apply the security measures in section 6.
• Help you answer data-subject requests and meet your security, breach-notification and impact-assessment duties, within the limits of what the service can do.
• Delete or return the data as section 8 provides.
• Make available the information needed to show compliance and allow audits under section 7.

5. Sub-processors

You authorise the sub-processors below. We will post changes to this list at least 30 days before a new sub-processor handles your data; if you object on reasonable grounds and we cannot resolve it, you may end the affected part of the service and receive a pro-rated refund.

Sub-processor	Purpose	Location
Amazon Web Services	Hosting, databases, storage, authentication, transactional email	Canada (ca-central-1); some services United States
Stripe	Payments and billing	United States
Cloudflare	DNS, CDN, edge protection	Global
PostHog	Product analytics (cookieless)	European Union
Sentry	Error monitoring	United States
Resend	Transactional email	United States
OpenAI, Anthropic, Voyage AI	Model inference over public content and entity metadata	United States
GitHub	Source control and build (no customer data)	United States

Every sub-processor is under a written agreement with data-protection terms at least as protective as these. We remain responsible for their performance.

6. Security

Encryption in transit (TLS) and at rest; role-based access with multi-factor authentication and least privilege; hashed credentials and API keys; logged and reviewed access; version-controlled, tested and reversible changes (pull-request review and CI gating on the main branch are being enabled and are not yet in force); backups with tested restores; an incident-response process with severity levels and post-mortems. Our published policies are listed on the security page and available under NDA.

7. Audits

Once a year, or after a security incident affecting your data, you may audit our compliance with this agreement by reviewing our policies, control descriptions and any third-party reports we hold, and by putting written questions to us. An on-site audit needs 30 days' notice, a reasonable scope, and is at your cost unless it finds a material breach.

8. Breach notification, deletion and return

We notify you without undue delay, and within 72 hours of confirming it, of any breach affecting your personal data, with what we know and what we are doing. When your subscription ends, you may export your data for 30 days; we then delete it from live systems within 90 days and from backups on their rotation, unless the law requires us to keep it.

9. International transfers

Production data is stored in Canada. Where a sub-processor processes data outside Canada, we rely on the safeguards its contract provides; for data subject to the GDPR or UK GDPR we sign the standard contractual clauses (and the UK addendum) on request, and this agreement is read with them.

10. Liability and precedence

Liability under this agreement is subject to the limitation in the Terms of Service. If this agreement conflicts with the Terms, this agreement governs for the processing it covers. It is governed by the law of British Columbia.