Data Processing Addendum

This addendum applies when a customer uses Speech Relay to process personal data on its own behalf, such as recordings of other people.

• Roles: the customer is the controller; Speech Relay processes the data only on the customer's instructions, which are these terms and the settings the customer chooses.
• Data: audio, transcripts, account and project identifiers, and usage records. The people involved are the customer's users and anyone who speaks in the audio.
• Purpose: to transcribe audio, keep saved sessions where saving is on, and bill for use.
• Retention: saved sessions are deleted at the end of the chosen period (7, 30 or 90 days), when the customer deletes them, or when the account is deleted, and are erased from our storage within 10 days. Usage records are kept for billing.
• Customer duties: the customer has a lawful basis for the audio it submits and informs speakers or obtains their consent where required.
• Security: encryption in transit, access limited to the owning account, revocable per-project credentials, and short-lived download links.
• Sub-processors: Microsoft Azure, Neon, Vercel, Cloudflare, and GitHub and Google for sign-in. We give notice before adding one that handles customer content.
• Incidents: we notify the customer without undue delay after becoming aware of a breach affecting its data.
• Requests: we help the customer answer requests from the people in its data; customers can export and delete saved sessions themselves.
• Voice data and location: no voiceprints or biometric identifiers are created, and no customer data is used for training. We do not offer a choice of region.
• Contact: privacy@speechrelay.online.

This addendum is provided for transparency and is not legal advice.