Data processing agreement.

Unsigned draft. Not reviewed by counsel. Not a signed agreement. Concord (Predictive, operated by Charles Jackson from Quebec) processes personal information on behalf of a customer when that customer connects their systems and Concord runs a cycle. This draft describes that processing. It is offered so a procurement person can see what Concord would agree, not so anyone can quote a signature that does not exist.

The customer is the controller (or, under Quebec’s Law 25, the enterprise responsible for the information). Concord is the processor. Concord acts only on what the customer wrote down. That means their rules, the connections they switched on, and the signatures of the people they named as able to sign.

Concord does not sell the information. Concord does not use it to train a model of its own. When a model is switched on, facts are sent to that model so it can draft proposals. A setup question an operator deliberately asks, with a limited summary of the current setup record, is sent so the model can answer it. When the model is not switched on, the departments run on rules and setup keeps its written guide.

Whatever the connected systems return, and whatever the customer’s people type into the console. That includes invoices, tickets, supplier records, the sealed record of decisions, and the names and addresses of people who may sign. A mailbox, if connected, includes messages written by people who never agreed to this product — that is disclosed on the privacy page. If an operator opens the company line, realtime audio is processed in transit and final turns are filed; Concord does not store raw audio or partial transcripts.

Concord uses other companies to run. The current list is at /legal/subprocessors, versioned. Concord told Intuit, in writing, that Anthropicis a sub-processor: the model that drafts proposals and answers an operator’s setup questions when a company has the model switched on. Facts are sent for proposals; the question and limited setup context are sent for an answer. Saved sign-ins are not included. A company without a key sends Anthropic nothing.

Concord itself uses Cloudflare for hosting and its database. Stripe processes Concord subscription billing. Google Gemini reasons over company turns. LiveKit, Krisp, Deepgram, and Cartesia carry the realtime company line. Resend sends Concord’s mail. Google and Microsoft provide sign-in. Voice processors run only while an operator opens the company line. Customer-connected systems run only after the customer enables them.

Every saved sign-in is encrypted. Every entry in the record is sealed, so any later edit shows up. Concord never rewrites what is already in the record. The customer can export their record. When a company leaves, its saved connection keys are removed from live storage. Provider recovery copies age out under the recovery window below, and any restore must reapply offboarding before service resumes. Identity factors remain so an authorized operator can request full deletion. Full deletion removes those factors with the complete tenant record.

The live record stays while the company exists on Concord. A company can export it, leave, stop billing, pass a second factor, and then request full deletion. The live record is deleted immediately after those checks. App-managed recovery copies are scheduled for deletion after thirty days. Cloudflare D1 Time Travel follows its plan-specific recovery window. A restored deletion must be applied again before service resumes. See the privacy page for the complete retention schedule.

This is not an executed contract. Counsel has not reviewed it. Quebec’s Law 25 assessment and liability for an action the departments carry out are lawyer work. Write to charles@predictive.company.