Data processing agreement

You determine the purposes and means of processing the personal data contained in the media you submit: you are its controller. We process that data solely on your behalf and on your instructions: we are your processor.

This applies only to the content of your media. For your account data — e-mail address, billing details, technical logs — we act as controller, on the terms described in the legal notice.

• Subject matter: automatic transcription into text of the audio and video content you submit.
• Nature of the operations: receipt, temporary storage, transcoding, processing by a speech recognition model, delivery and retention of the transcript.
• Purpose: providing the service, and nothing else. Your content is never used to train a model, nor for statistical, commercial or advertising purposes.
• Duration: the term of your contract, plus the deletion periods set out in article 7.

We have no control over the content of your media. The data processed is whatever you choose to submit, and may include:

• the voice and statements of the people recorded;
• any identifying data spoken aloud: name, role, contact details, organisational affiliation;
• where applicable, special-category data within the meaning of article 9 GDPR, whose submission is your responsibility alone and requires a specific legal basis.

The data subjects are those appearing in your media: meeting participants, interviewees, speakers, third parties mentioned.

We undertake to:

• process the data only on your documented instructions, which your use of the service expresses;
• keep the data confidential and ensure that persons authorised to process it are bound by confidentiality;
• implement the security measures described in article 6;
• notify you without undue delay, and at the latest within seventy-two hours of becoming aware of it, of any personal data breach affecting your content, with the information you need for your own notification;
• assist you, so far as possible, in responding to data subjects' requests and in meeting your obligations under articles 32 to 36 GDPR;
• inform you if we consider an instruction to infringe the GDPR.

You give general authorisation for the use of the sub-processors listed below. We will inform you by e-mail of any addition or replacement at least thirty days before it takes effect; you may then terminate free of charge if you object on legitimate grounds.

Your media and the transcripts produced are processed and stored exclusively within the European Union. The only transfer outside the EU concerns the identification data tied to signing in with Google or GitHub, where the user chooses that method; it relies on the EU-US Data Privacy Framework. Signing in with an e-mail address involves neither of those providers.

Taking into account the state of the art and the risks involved, we implement in particular:

• encryption of communications in transit (TLS);
• encryption at rest of stored media and transcripts;
• per-account data isolation, with session-based or revocable API-key authentication;
• access restricted to those who need it, with logging of technical access;
• regular backups and security updates of infrastructure components.

Submitted media files are deleted after processing. The transcripts produced remain accessible from your account until you delete them.

At the end of the contract, or at your request, your transcripts are deleted from our live systems within thirty days, and from backups within ninety days, that being their rotation period. No copy is kept beyond that, save where the law requires retention.

You may export your transcripts from your account at any time before deletion.

We make available the information needed to demonstrate compliance with this agreement. Once a year, and on reasonable notice, you may request documentary evidence of our security measures.

An on-site audit is available only on serious grounds — a personal data breach affecting you, or a demonstrated failure — at the requesting party's expense, and under conditions that do not compromise the security or confidentiality of our other customers' data.

For any question about this agreement or about data protection, write to contact@techtuel.com or use the contact form.