Data processing agreement (DPA)

This data processing agreement applies between you as the customer (controller) and Ad Vitam Invest AB (trading as ProfitLens Consulting) (processor) and becomes applicable when you start using the service. No signature is required; the terms apply in their latest published version and can be downloaded from this page.

In case of conflict between this agreement and the terms of purchase, this agreement prevails on matters concerning the processing of personal data.

Processing covers automated pricing analysis: storing client files, quality checks, deterministic computations in the customer’s browser, interviews, transcripts, analysis results, reports and presentation content. AI support uses Azure OpenAI in the EU. Voice is optional, activated only by the respondent, and may be disabled; ProfitLens records or stores no audio and saves only written transcripts.

For help-guide guidance, a limited summary of column names, mapping, check results and, if enabled, pseudonymised sample rows is sent to Azure OpenAI in the EU. The customer can disable sample-row sharing. Microsoft does not use this content to train foundation models; its applicable security and abuse-monitoring terms may permit limited retention.

Processing continues for as long as you use the service and for the retention periods stated in the privacy policy.

Data subjects: your employees using the service, interview respondents, and individuals who may appear in uploaded data, such as sales representatives or contacts at your customers.

Data: name, title, email, customer identifiers and transaction data. Special categories of data under Article 9 GDPR must not be uploaded. Customer names may be masked, provided masking is consistent.

We process personal data only on your documented instructions, where your use of the service and these terms constitute the instruction.

Personnel with access are bound by confidentiality. Access is permission-controlled and limited to what the work requires.

We implement appropriate technical and organisational security measures under Article 32: encryption at rest and in transit, separation per account and analysis, logging and recovery routines.

We assist you in responding to data subject requests and with impact assessments and prior consultation to the extent reasonably required.

We notify you without undue delay, and at the latest within 48 hours of discovery, of any personal data breach affecting your data.

On termination we delete your personal data, or return it if you so request within thirty days, except where law requires us to retain it.

You give general prior authorisation for us to engage sub-processors. We impose on each sub-processor obligations at least equivalent to those in this agreement and remain responsible for their processing as for our own.

Current sub-processors and functions: Microsoft Ireland Operations Limited (Azure Blob Storage, client files in Sweden; Azure Database for PostgreSQL, transcripts, analyses, reports and presentation content in Ireland; Azure OpenAI, text AI and optional voice/transcription in the EU Data Zone). Supabase (website and application platform, server-side access and service orchestration, accounts, authentication, access metadata and credits). Email providers deliver system notifications. This allocation describes the services used; it does not claim that hosting or support is exclusively in the EU.

We inform you before a new sub-processor is put into use. You may object on reasonable grounds, and if we cannot accommodate the objection you may terminate the service and have unused credits refunded.

Primary client-content storage is in Azure EU regions: files in Sweden Central (Sweden), and transcripts, analysis results, reports and presentation content in North Europe (Ireland). Azure OpenAI EU Data Zone inference may take place in different EU member states. Global AI deployments are not used. Deterministic calculations run locally in the customer’s browser. EU storage and inference do not imply that every application server or supporting supplier processes data only within the EU.

Temporary client-content copies in the previous Supabase EU storage remain during verification and fallback. Final removal requires separately approved deletion and does not happen automatically when these terms change. For supporting suppliers’ third-country access or transfers, we apply GDPR transfer safeguards, including standard contractual clauses where required. Microsoft’s applicable data protection and service terms also govern security and abuse monitoring; no zero-retention exemption has been verified.

On request we provide the documentation needed to demonstrate compliance with Article 28 GDPR. An audit may be carried out once a year, on reasonable notice and without exposing other customers' data.

AI support is used only in a few steps and never receives the full uploaded dataset. Calculations are performed by versioned code without AI.

Before example values are sent to an AI sub-processor, customer names, product names, sales representatives and segments are replaced by stable codes. The translation table is built temporarily in memory and is not stored.

The customer can select Standard (coded example values), Limited (column and sheet names only) or No AI on data (AI support in the data steps switched off). The setting applies to the account and can be changed per analysis.

Before every AI call the customer can view the exact text being sent. Each call is logged per analysis with time, step, mode, character count and whether example values were included; the log can be downloaded and supports your own records under Article 30 GDPR.