Data Processing Addendum
Last updated · June 2026
This addendum describes how expertOS processes personal data on behalf of customers, the roles of each party, and the sub-processors we rely on. It supplements our Terms of Service and Privacy Policy and forms part of our agreement with customers who process personal data through the service.
Roles
For personal data a customer submits to the service, the customer is the controller and expertOS is the processor. expertOS processes that data only to provide the service and on the customer’s documented instructions.
Scope of processing
- Subject matter: provision of the expertOS research and expert-network service.
- Categories of data: business contact details, expert profile and résumé content, interview transcripts/recordings, and usage data.
- Data subjects: customer personnel and experts who use the service.
- Duration: for the term of the agreement, subject to retention and deletion terms.
Security
expertOS maintains technical and organizational measures appropriate to the risk, including encryption in transit, access controls, monitoring, logging, and backups. SOC 2 status and a security overview are available to enterprise customers on request.
Confidentiality
Personnel authorized to process personal data are bound by confidentiality obligations.
Sub-processors
expertOS uses the following sub-processors to deliver the service. We will provide notice of material changes to this list.
- Vercel — application hosting and delivery.
- Supabase — database and storage.
- Resend — transactional email delivery.
- Vapi — real-time voice interview infrastructure.
- ElevenLabs — text-to-speech / voice synthesis.
- OpenAI and OpenRouter — large-language-model processing.
- Bright Data — public professional-profile enrichment.
- Google Analytics — website analytics (loaded only with consent).
International transfers
Where personal data is transferred across borders, expertOS uses appropriate safeguards such as standard contractual clauses where required.
Data subject requests
expertOS will assist the customer, taking into account the nature of processing, in responding to data subject requests and in meeting the customer’s obligations under applicable law.
Deletion and return
On termination, expertOS will delete or return customer personal data in accordance with the agreement, except where retention is required by law. Experts can also delete their own profile and interview data from the expert dashboard.
Incident notification
expertOS will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data.
Contact
Data protection enquiries: privacy@getexpertos.com.