Monocle Prism Data Processing Addendum
- Effective date:
- October 27, 2026
Monocle Prism is a trade name of We'll Do It LLC. This Data Processing Addendum ("DPA") forms part of the Terms of Service (or the order form, for Enterprise) between the customer ("Customer") and We'll Do It LLC, doing business as Monocle Prism ("Processor").
1. Scope and roles
1.1 This DPA applies when Processor processes Personal Data contained in Customer's workplace content ("Customer Personal Data") to provide the Service.
1.2 Customer is the controller (or, under US state laws, the "business") and Processor is the processor (or "service provider" or "processor"). Where Customer is itself a processor for its own client, Processor is Customer's sub-processor.
1.3 Processing details are in Annex 1. Sub-processors are in Annex 2. Security measures are in Annex 3.
2. Processing on instructions
2.1 Processor processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's use and configuration of the Service (including instructions given through Monocle AI and integrations Customer connects) are Customer's instructions.
2.2 Processor will tell Customer if it believes an instruction breaks applicable data protection law, unless the law forbids telling.
2.3 US state law terms. Processor will not sell or share Customer Personal Data; will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in Annex 1; will not combine it with personal data from other sources except as the law allows; and will tell Customer if it can no longer meet its obligations.
3. Confidentiality and staff access
3.1 Processor ensures that people authorized to process Customer Personal Data are bound by confidentiality.
3.2 Processor's staff do not access workplace content unless Customer approves, and Customer can withdraw the approval at any time.
4. Security
Processor implements the technical and organizational measures in Annex 3. Customer is responsible for its own account security, its workplace permission settings, and the integrations it connects.
5. Sub-processors
5.1 Customer authorizes the sub-processors in Annex 2.
5.2 Processor will give Customer reasonable notice, by email or in Monocle Prism, before a new or replaced sub-processor starts to process Customer Personal Data, and will keep Annex 2 of this DPA current. Customer may object on reasonable data protection grounds within a reasonable time after the notice; if the parties cannot resolve it, Customer may end the affected Service and receive a prorated refund of prepaid fees for it.
5.3 Processor imposes data protection terms on each sub-processor no less protective than this DPA, and remains responsible for its sub-processors.
5.4 AI providers receive Customer Personal Data only when a workplace member uses Monocle AI. Processor offers only AI provider tiers whose terms, as reviewed by Processor, do not permit training on the data. AI providers may keep requests and responses for a limited time set by their terms, to detect abuse and keep the service safe. They do not use them to train models. We do not promise that a provider keeps nothing, and deleting a conversation in Monocle Prism does not delete a provider's own safety copy within that time. Providers a workplace connects with its own key are Customer's own vendors, not Processor's sub-processors.
6. Assistance
6.1 Processor will, taking into account the nature of processing, help Customer respond to data subject requests, through tools in the Service where available and otherwise on request. If Processor receives a request directly, it will pass it to Customer and not respond except to say so.
6.2 Processor will give reasonable help with data protection impact assessments and consultations with regulators, as they relate to the Service.
7. Personal data breach
Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations, and will take reasonable steps to contain it.
8. Return and deletion
On termination, Customer may export its content using the Service's tools during the period in the Terms. After Customer asks in writing, Processor will delete Customer Personal Data, and remove it from backups when those backups are overwritten in the ordinary course, unless the law requires keeping it. Processor does not promise a deletion time.
9. Audits
Processor will make available information reasonably needed to show compliance with this DPA, by answering a reasonable security questionnaire no more than once a year and sharing a security overview under a non-disclosure agreement. Processor does not currently hold an independent certification (such as SOC 2 or ISO 27001). On-site audits are available only where the law requires them, on reasonable notice and at Customer's cost.
10. International transfers
Processor and its main sub-processors process Customer Personal Data in the United States. For transfers from the EEA, UK or Switzerland, Processor does not yet have standard contractual clauses of its own in place. If Customer needs them, the parties will agree them in writing before that data is transferred. .
11. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA controls.
Annex 1: Processing details
| Item | Detail |
|---|---|
| Subject matter and duration | Providing the Service for the subscription term and the deletion period after it |
| Nature and purpose | Hosting, storing, organizing, searching, transmitting and displaying workplace content; running Monocle AI requests; running integrations Customer connects; support Customer approves; security |
| Data subjects | Customer's workplace members; Customer's customers, contacts, leads, suppliers and others whose data Customer puts into the Service |
| Categories of data | Contact details, business and professional details, communications, files and records, transaction records, any other data Customer chooses to store |
| Sensitive data | Not intended. Customer should not store special-category data, government ID numbers or full card numbers in the Service unless agreed in writing |
Annex 2: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud (Google LLC) | Application hosting, secrets, logs; AI models through Vertex AI | United States |
| Supabase (on Amazon Web Services) | Main database | United States |
| Cloudflare, Inc. | DNS, proxy, firewall, bot protection; file storage (R2) | Worldwide network; file storage in western North America |
| Amazon Web Services (SES, S3) | Email delivery; short-term storage of received email | United States |
| Stripe, Inc. | Payments, tax calculation, payouts, Money features | United States and others |
| Anthropic, PBC | AI model processing (default and premium Claude models) | United States (default model) |
| OpenAI | AI model processing, if offered on the Service | Global endpoint, not only the United States |
| Twilio SendGrid | Email delivery (backup provider) | United States |
| Business verification service | Identity and business checks for providers and payouts | Details available on request |
Annex 3: Security measures (as they exist)
- Encryption in transit (TLS) for all traffic to the Service.
- Encryption at rest provided by the hosting, database and storage providers, each of which states that it encrypts data at rest by default.
- Connection keys and saved credentials stored encrypted (Monocle Vault); no plaintext secrets in application settings.
- Uploaded files stored in a private bucket; each file read is checked against the person's permission.
- Workplace permissions set by Customer's administrators; per-workplace scoping of data. [Do not describe isolation as technically enforced against our own staff until enforcement is on in production.]
- Monocle AI asks for confirmation before any change to workplace data; Prompt Shield warns before credentials are sent to AI.
- Strong authentication and need-to-know access for staff; staff access to workplace content only with Customer approval (policy).
- Bot protection and a web application firewall at the edge.
- Vendor review before a sub-processor is given access to personal data.
Monocle Prism is a trade name of We'll Do It LLC.