Data processing agreement

Your firm is the controller of the personal data in the reports it checks. SurveyStack, which provides StackProof, is your processor. This agreement forms part of the terms your firm accepted when it signed up.

The text of reports your team checks, which may include client and property details, and the flags and calls made on them. We process it only to check reports and keep your QA record, and only on your instructions.

Anthropic (AI review), Railway (database and server), Vercel (hosting), Postmark (email) and Stripe (billing). We will tell your admin before adding or replacing one, and you can object.

Access limited to your team, one-time sign-in links, separation between firms, encryption in transit, and report text deleted once the draft and final are compared.

Only people who need to, to run and support StackProof, can reach your data, and they are bound by confidentiality.

We will tell your admin without undue delay, and within 48 hours of becoming aware, of any breach affecting your data, with what we know and what we are doing.

We will help you answer requests from individuals and the ICO, and with any data protection impact assessment, as far as StackProof is involved.

When your account closes, we delete your firm’s data within 30 days, unless the law requires us to keep it. Your admin can ask for an export of the QA records first.

Where a sub-processor handles data outside the UK, we rely on the UK’s adequacy regulations or the International Data Transfer Addendum.