# Data Processing Addendum | Victoria AI > How Victoria AI processes personal data on your behalf as a processor: roles, instructions, subprocessors, retention, security measures and transfers. Source: https://www.versionseven.ai/legal/dpa # Data Processing Addendum **Victoria AI: All Products and Services** Last updated: September 30, 2026 This Data Processing Addendum ("**DPA**") forms part of the Online Terms of Service or the Proof First Services Agreement (the "**Agreement**") between Victoria AI LLC ("**Victoria AI**") and Customer. It governs Victoria AI's Processing of Personal Data within Customer Data on Customer's behalf. Capitalized terms not defined here have the meanings in the Agreement; "Personal Data," "Processing," "Controller," "Processor," "Business," "Service Provider," "Sale," and "Share" have the meanings given by applicable Data Protection Laws. "**Data Protection Laws**" means all laws applicable to the Processing of Personal Data under the Agreement, including as applicable the California Consumer Privacy Act as amended (CCPA/CPRA), the Florida Digital Bill of Rights, other U.S. state privacy laws, and, where applicable to Customer's Personal Data, the EU General Data Protection Regulation and the UK GDPR. ## 1. Roles **1.1 General allocation.** For Personal Data within Customer Data, Customer is the Controller (or Business) and Victoria AI is the Processor (or Service Provider), Processing only on Customer's documented instructions as reflected in the Agreement and Customer's configuration and use of the Services. **1.2 Role matrix.** Because roles differ across products and motions: | Data | Self-serve (Victoria / Pulse) | Managed (Proof First) | | - | - | - | | Customer/Client Data (leads, lists, campaign content, CRM, Engagement Data) | Customer = Controller; Victoria AI = Processor | Client = Controller; Victoria AI = Processor | | Enriched Contact Data. Self-serve: retrieved in Victoria (Lead database) through Victoria AI's enrichment provider, and in Pulse (contact resolution at export) only through Customer's own Connected Provider Account. Includes 30-day Pulse re-download copies | Customer = Controller; Victoria AI = Processor. For the Lead database in Victoria: (a) for email and phone enrichment, FullEnrich Corp acts as Victoria AI's sub-processor, on Victoria AI's instruction; (b) for Search results (people and company data), FullEnrich acts as an independent Controller of its own database (its privacy notice is linked from [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors)). In Pulse, a Connected Provider Account is Customer's own vendor, with Customer as its direct client | Managed: sourced by Victoria AI from its providers and delivered as Client Data; Client = Controller; Victoria AI = Processor | | Pulse Records (company-level records and attributes) | Victoria AI = Controller (its own product data) | Victoria AI = Controller | | Suppression identifiers (hashed) | Victoria AI = Controller (retained to honor opt-outs across the Services) | Victoria AI = Controller | | Victoria AI account, billing, and usage data | Victoria AI = Controller | Victoria AI = Controller | **1.3 Service Provider certification (CCPA/CPRA).** Victoria AI will not: Sell or Share Personal Data received from Customer; retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Services and as permitted for service providers; or combine it with Personal Data from other sources except as permitted for service providers. Victoria AI certifies it understands and will comply with these restrictions. **1.4 De-identified data.** Victoria AI may create de-identified, aggregated data as permitted by the Agreement, will maintain it in de-identified form, will not attempt re-identification, and will contractually require the same of recipients. ## 2. Details of Processing - **Subject matter and duration:** Processing to provide the Services for the term of the Agreement plus the deletion periods below. - **Nature and purpose:** hosting; lead search and contact enrichment through Victoria AI's enrichment provider at Customer's request (Lead database searches in Victoria), contact resolution at export in Pulse through Customer's own Connected Provider Account, and other enrichment; campaign orchestration; message transmission via connected accounts and communications infrastructure; reply handling (including AI-assisted classification and response); analytics; support; and Processing initiated by Customer through the API or through a Connected Assistant that Customer has authorized, which Victoria AI carries out as Customer's instruction. - **Categories of data subjects:** Customer's Users; Customer's prospects, leads, and business contacts. - **Categories of Personal Data:** business contact data (name, title, employer, business email, business phone, professional profile URLs), message content and metadata, engagement and interaction data, CRM records. **No sensitive/special categories are intended to be Processed; Customer will not submit them.** ## 3. Victoria AI Obligations Victoria AI will: - Process Personal Data only on Customer's documented instructions, unless required by law (in which case Victoria AI will inform Customer unless prohibited); - notify Customer if it believes an instruction violates Data Protection Laws; - ensure persons authorized to Process are bound by confidentiality; - implement and maintain the technical and organizational measures in **Annex II**; - taking into account the nature of the Processing, reasonably assist Customer with data subject requests, and with security, breach, and assessment obligations under Data Protection Laws; - make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in Section 7; and - notify Customer **without undue delay and no later than 72 hours** after becoming aware of a Personal Data Breach affecting Customer's Personal Data, with information reasonably available to Victoria AI, supplemented as it becomes available. ## 4. Subprocessors **4.1 Authorization.** Customer generally authorizes Victoria AI's use of subprocessors. Customer specifically authorizes FullEnrich Corp, 28 Geary St, Suite 650, San Francisco, CA 94108, United States, as a subprocessor for contact enrichment in Victoria. Its processing: it receives the identifiers Victoria AI sends for a search or enrichment request (name, company, title, LinkedIn URL), returns verified work email addresses and, where requested, phone numbers, and retains request data under its own data processing agreement with Victoria AI. For Search results it acts as an independent controller as described in Section 1.2. The current list is maintained at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors) and includes as of the last update: | Subprocessor | Function | Location | Transfer mechanism | | - | - | - | - | | FullEnrich | Lead search and contact enrichment: self-serve Lead database searches and verified emails in Victoria, and waterfall enrichment for managed services (products: Victoria, Managed services). Acts as our processor for the search and enrichment requests we send and as an independent controller of its own database and reverse lookup. Self-serve contact resolution in Pulse uses the customer's own Connected Provider Account; that provider is the customer's vendor, not our subprocessor | United States | SCCs Module 2 + UK Addendum | | Unipile | Email/LinkedIn message processing and delivery | France | EU internal | | Supabase | Database and storage | United States | SCCs Module 2 + UK Addendum | | Vercel | Application hosting | United States | SCCs Module 2 + UK Addendum | | Anthropic | AI model processing | United States | SCCs Module 2 + UK Addendum | | OpenAI | AI model processing (embeddings and fallback generation in Victoria) | United States | SCCs Module 2 + UK Addendum | | Railway | Backend application hosting | United States | SCCs Module 2 + UK Addendum | | Inngest | Background job orchestration (Pulse) | United States | SCCs Module 2 + UK Addendum | | Stripe | Payments (Victoria AI as Controller) | United States | SCCs Module 2 + UK Addendum | | Resend | Transactional email delivery | United States | SCCs Module 2 + UK Addendum | | Slack | Internal operational notifications, which may include customer and prospect data in alerts and briefs | United States | SCCs Module 2 + UK Addendum | | Google (Google Calendar) | Scheduling integration | United States | SCCs Module 2 + UK Addendum | | Google (Google Analytics) | Site and product analytics (Victoria AI as Controller) | United States | SCCs Module 2 + UK Addendum | | Amplitude | Product analytics in Victoria (Victoria AI as Controller) | United States | SCCs Module 2 + UK Addendum | | Calendly | Scheduling integration | United States | SCCs Module 2 + UK Addendum | The list may include providers approved for planned integrations that are not yet in production use. Enrichment providers whose accounts Customer connects to Pulse for contact resolution at export (for example Apollo, FullEnrich, Hunter, or Prospeo) are Customer's own vendors under Customer's agreement with them, not Victoria AI subprocessors. Likewise, a Connected Assistant (a third-party AI assistant or agent, such as Claude, ChatGPT, or Claude Code, that Customer connects to its workspace through the API or the MCP server) and its provider are Customer's own vendors: Victoria AI transmits to the Connected Assistant only what Customer's requests and the tools the assistant invokes return, on Customer's instruction, and the assistant's provider is not a Victoria AI subprocessor. **4.2 Changes.** Victoria AI will update the list at least 30 days before adding or replacing a subprocessor and offers a change-notification subscription at that page. Customer may object in writing on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Services with a pro-rata refund of prepaid unused fees. **4.3 Flow-down.** Victoria AI will impose data protection obligations on subprocessors no less protective than this DPA and remains responsible for their performance. ## 5. Retention and Deletion - **Enriched Contact Data:** copies stored for Pulse re-download are permanently deleted no later than **30 days** after retrieval, including removal from logs, queues, and backups in the ordinary rotation cycle. Contact data delivered into a customer's workspace (including leads added from the Lead database in Victoria) becomes Customer Data, retained as Customer Data and deleted under the Victoria contact data rule below. Transient processing copies are deleted in the ordinary course, and within Pulse, contact fields are redacted or excluded from persistent operational logs and error traces by design. - **Victoria contact data:** Contact data delivered into a Victoria workspace from the Lead database is deleted within 90 days after the earlier of Customer deleting the record or the Customer account closing, including from backups, archives, and logs. - **Customer Data:** deleted or, on request, returned at Customer's choice within 30 days of termination, subject to the export window in the Agreement, then deleted from active systems, with backup copies aging out per the backup cycle not to exceed 35 days. - **Suppression identifiers:** retained in hashed form as Controller for as long as necessary to honor opt-outs. - **Legal holds:** Victoria AI may retain data as required by law, protected by this DPA. ## 6. Data Subject Requests Victoria AI will promptly forward to Customer any data subject request it receives that identifies Customer's Personal Data, and will not respond substantively except to direct the requester to Customer, unless required by law. Victoria AI provides self-service tools (export, deletion, suppression) to assist Customer in fulfilling requests. Victoria AI will pass on to Customer any opt-out or deletion notice it receives from a data provider about a contact in Customer's workspace, will suppress that contact on its side, and Customer will honor the notice within its workspace. ## 7. Audits Not more than once per 12 months (except after a Personal Data Breach or evidence of material non-compliance), Customer may audit Victoria AI's compliance with this DPA by: (a) reviewing Victoria AI's then-current security documentation and third-party attestations, if and when obtained; and (b) submitting a reasonable written security questionnaire, which Victoria AI will answer within 30 days. On-site audits require 30 days' notice, occur during business hours, are limited in scope, and are at Customer's cost. ## 8. International Transfers To the extent Personal Data subject to the EU GDPR or UK GDPR is transferred to a country without an adequacy decision (including to Victoria AI in the United States), the parties incorporate by reference the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller to Processor), and, for transfers subject to the UK GDPR, the UK International Data Transfer Addendum, in each case with the Annexes deemed completed by the information in Section 2, Annex II, and Annex III of this DPA. If the SCCs conflict with this DPA, the SCCs control for the transfers they govern. ## 9. Order of Precedence; Liability If this DPA conflicts with the Agreement regarding Processing of Personal Data, this DPA controls to the extent required by Data Protection Laws. Liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. --- ## Annex I: Processing Details - **Data exporter:** Customer (Controller). **Data importer:** Victoria AI LLC (Processor), 7901 4th St N, STE 300, St. Petersburg, FL 33702, USA. - **Categories of data subjects and Personal Data:** as set out in Section 2. - **Frequency and duration:** continuous, for the term of the Agreement plus the deletion periods in Section 5. - **Retention:** as set out in Section 5. **Subprocessor transfers:** as set out in Section 4 and Annex III. ## Annex II: Technical and Organizational Measures - Access control: role-based access, least privilege, MFA for administrative access, per-tenant isolation of Customer Data. - Encryption: TLS in transit; encryption at rest for databases and backups. - Boundary controls (Pulse): contact fields redacted from persistent logs, job queue payloads, webhook replay bodies, and error traces; TTLs on transient stores that could carry contact data. - Auditability: administrative and data-affecting actions logged to an audit table with actor identity. - Secure development: code review for changes to data-handling paths; dependency monitoring. - Availability: managed cloud infrastructure with provider-level redundancy; backups with defined rotation not exceeding 35 days. - Personnel: confidentiality obligations; access revoked on role change or departure. - Incident response: documented triage, escalation, and customer notification path per Section 3. - Vendor management: subprocessor diligence and contractual flow-down per Section 4. ## Annex III: Subprocessors The current subprocessor list is maintained at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors). The table in Section 4.1 is the snapshot as of the Last updated date above.