Back to appPravado

Data Processing Addendum

Last updated: October 12, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Saipien Labs LLC, which operates Pravado ("Pravado", "we"), and the business customer that uses the Pravado service ("Customer", "you") under our Terms of Service (the "Agreement"). It applies when Pravado processes Customer Personal Data on your behalf.

How to sign. This page is published for information. To put a signed DPA in place, request a countersigned copy by email or through our contact page. The signed copy has this text and the annexes described below.

1. Definitions

"Data Protection Laws" means the laws that apply to the processing of Customer Personal Data under the Agreement, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and US state privacy laws such as the California Consumer Privacy Act ("CCPA"). "Customer Personal Data" means personal data that you or your users submit to the service, or that Pravado processes on your behalf to provide it. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR, and "service provider" has the meaning given in the CCPA.

2. Roles

  • For Customer Personal Data, you are the controller and Pravado is your processor (and, under the CCPA, your service provider).
  • Pravado is a controller for account, billing, security and product usage data it needs to run its business, as described in our Privacy Policy.
  • The journalist and media database that Pravado makes available in the service is Pravado's own data, not Customer Personal Data. Journalists can manage their data through Pravado for Journalists.

3. Details of the processing

  • Subject matter and purpose: providing the Pravado service under the Agreement, including AI Visibility measurement, recommendations, content and PR workflows, email you approve, analytics and support.
  • Duration: the term of the Agreement, plus the deletion period in section 9.
  • Data subjects: your users; people named in content you add (for example spokespeople); and contacts you correspond with through the service (for example journalists who reply to a pitch).
  • Personal data: names, business contact details, job titles, account identifiers, message content, and personal data contained in content you submit.
  • Special categories: none are intended. Please do not submit special category or sensitive personal data to the service.

4. Pravado's obligations

Pravado will:

  • process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA and your use and configuration of the service, and tell you if we believe an instruction breaks Data Protection Laws;
  • not sell or share Customer Personal Data (as those terms are used in the CCPA), and not use it for any purpose other than providing the service;
  • ensure that people authorized to process Customer Personal Data are bound by confidentiality;
  • maintain the technical and organizational measures described on our Security page, which may be updated as long as protection is not reduced;
  • taking into account the nature of the processing, help you respond to data subject requests and, where reasonably required, with data protection impact assessments and consultations with supervisory authorities;
  • make available the information reasonably necessary to show compliance with this DPA, and answer reasonable written security questionnaires. Pravado does not currently hold third-party security certifications.

5. Subprocessors

You authorize Pravado to use the subprocessors listed in our subprocessor list. Pravado imposes data protection terms on each subprocessor that protect Customer Personal Data to the standard required by this DPA, and remains responsible for its subprocessors' performance.

We update the list before a new subprocessor starts processing Customer Personal Data. If you have a signed DPA, we will also email you at least 30 days before that change. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service.

6. International transfers

Pravado and most of its subprocessors process data in the United States. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the signed DPA incorporates the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 (Module Two, controller to processor, and Module Three, processor to processor, where you are a processor). For data subject to the UK GDPR, it incorporates the UK International Data Transfer Addendum to those clauses. If these terms conflict with the Standard Contractual Clauses, the clauses prevail.

7. Security

Pravado implements appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit, encryption at rest provided by our database host, database row-level security and server-side tenant isolation, access controls, and secrets kept out of source code. They are described on our Security page.

8. Personal data breaches

Pravado will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain the breach. Notifying you is not an admission of fault.

9. Return and deletion

You can request an export of your data at any time. When the Agreement ends, Pravado keeps Customer Personal Data for up to 90 days so you can request an export, then deletes it, unless the law requires us to keep it. Data in backups is deleted as backups expire on their normal schedule.

10. General

  • Liability under this DPA is subject to the limitations in the Agreement.
  • If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data.
  • This DPA ends when Pravado stops processing Customer Personal Data.

Contact

Data protection questions: privacy@pravado.io. Signed copy: request by email or use our contact page.