Data Processing Addendum
We do not have a DPA to give you yet. Rather than leave this URL as a dead end or hand you a template nobody has reviewed, here is exactly where things stand.
The honest status
No Data Processing Addendum has been drafted or reviewed by a lawyer. A DPA is a contract that binds both sides, and a generated one would be a liability for you as much as for us. So there is nothing to download on this page.
If your organisation cannot enrol a team without a signed DPA, say so on the contact page. That is useful information and it moves this up the queue.
What we can tell you today
The substance a DPA would formalise is already described, in plain language and with its gaps visible, in the privacy policy. Specifically:
- What is processed: rep voice audio, drill transcripts, scores and per-dimension marks, account details, and billing references.
- Roles: where a company buys CloseDrill for its reps, that company determines who is enrolled and what happens to the drill content, and we act on its instructions. We are the controller for our own account and billing data.
- Sub-processors: Supabase (database, auth, recording storage), Vercel (hosting and logs), ElevenLabs (conversational voice and transcription), OpenRouter and Anthropic (transcript scoring), Stripe (payments). The current list is in the privacy policy, section 7.
- Security measures: described on the security page, limited to what we can evidence.
- Retention: not yet set. The privacy policy carries an unfilled retention schedule rather than a number we made up, and that is the single biggest gap a DPA would have to close.
Two things worth raising before you sign anything
We would rather you hear these from us than find them in a review. Voice recordings of identified employees may qualify as biometric identifiers under laws such as the Illinois Biometric Information Privacy Act, which requires written notice and consent before collection and a published destruction schedule. The product does not currently have a consent step. Separately, the field-recording feature captures audio of members of the public who have not consented to anything, which matters a great deal in all-party-consent states.
Both are covered in more detail in the privacy policy.
Contact
DPA and vendor-review requests: [LEGAL CONTACT EMAIL], or use the contact page.