Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between BottomUP, Inc., a Delaware corporation (“BottomUP”), and the business customer (“Customer”) that uses Foxy Pro, its API or its connector for AI assistants (the “Service”), including the Terms. It applies where BottomUP processes personal data on Customer’s behalf. Where BottomUP decides why and how personal data is processed, for example for its own accounts and billing, the Privacy Policy applies instead.

Customer is the controller, and BottomUP is the processor, of personal data contained in content Customer or its users submit to the Service: questions, report requests, files and the identifiers of users in Customer’s workspace (“Customer Personal Data”). Each party complies with the data protection laws that apply to it, including the GDPR, the UK GDPR and the CCPA where relevant.

• Subject matter and purpose: providing the Service, which answers market research questions, writes reports and returns market data, and billing usage to Customer’s token balance.
• Duration: the term of the agreement, plus the deletion period in section 9.
• Data subjects: Customer’s users and any people named in content they submit.
• Categories of data: names, email addresses, account and workspace identifiers, IP addresses, request content and usage records. The Service is not designed for special categories of data, and Customer will not submit them.

BottomUP processes Customer Personal Data only on Customer’s documented instructions, which are the agreement, this DPA and Customer’s use of the Service, unless the law requires otherwise, in which case BottomUP will tell Customer first where the law allows. BottomUP does not sell Customer Personal Data or use it to train models. Everyone at BottomUP who can access it is bound by confidentiality.

BottomUP keeps appropriate technical and organisational measures, including TLS encryption in transit, encryption of credentials at rest, API keys stored only as hashes, restricted and logged access to production systems with multi-factor authentication, per-workspace isolation of data, rate limits and monitoring.

Customer authorises BottomUP to use these sub-processors, each bound by written terms at least as protective as this DPA:

• Railway (application hosting and databases, European Union)
• Cloudflare (network, DNS and edge security)
• Google Firebase (authentication and messaging)
• Anthropic and other model providers (generating answers from request content)
• Stripe (payments, for billing data only)

BottomUP will announce a new sub-processor on this page at least 14 days before it starts processing Customer Personal Data. Customer may object on reasonable data protection grounds by writing to privacy@bottomup.app, and if the parties cannot resolve the objection, Customer may end the affected Service.

Where Customer Personal Data leaves the EEA, the UK or Switzerland, the parties rely on the European Commission’s Standard Contractual Clauses (Module Two or Three, as applicable) and the UK Addendum, which are incorporated by reference.

• BottomUP helps Customer answer data subject requests and with data protection impact assessments, taking into account the nature of the processing.
• BottomUP notifies Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs.
• BottomUP makes available the information needed to show compliance with this DPA and answers reasonable written audit questions once a year, or after a breach.

When the agreement ends, BottomUP deletes Customer Personal Data within 30 days, except where the law requires BottomUP to keep it (for example billing records), in which case it stays protected by this DPA.

When Customer connects an AI assistant to the Service, the assistant’s provider is chosen by Customer and is not a sub-processor of BottomUP. BottomUP processes only what the assistant sends to the Service and returns only the Service’s answer. The connector cannot place orders, move money or read exchange credentials.

Questions about this DPA, or a signed copy: privacy@bottomup.app. BottomUP, Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware 19801, USA.