Legal
Data Processing Addendum
Last updated 2026-10-30
Draft, pending legal review
This document is a draft template and has not yet been reviewed by a lawyer. It may change before Transcript Audio launches.
1. Scope
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Harvie Software Solutions Ltd(“Processor”) and a business customer (“Customer”, the controller) who uses the Service for their organisation. It applies where we process personal data on the Customer’s behalf under UK GDPR and, where relevant, EU GDPR.
2. Meeting content
Recordings, transcripts and notes are stored on the Customer’s devices and are not stored by us. When a user chooses cloud transcription, AI summaries or Questions as you go in the cloud, we process the relevant audio or text transiently through our AI service and our AI subprocessors, under zero-retention settings where available, solely to return the result. It is then discarded and is not stored or logged by us. Transcription on the user’s computer does not reach us at all.
Cloud processing may take place in the UK or the EU, depending on the model.
3. Details of processing
| Subject matter | Providing the Service: accounts, licences, devices, billing, and transient AI processing of meeting content. |
|---|---|
| Data subjects | The Customer’s users and, for transient AI processing, people who take part in their meetings. |
| Personal data | Email addresses, sign-in provider identifiers, device names, platforms and app versions, meeting counts (random id, start time, duration, platform), usage amounts and hashed IP addresses. Transiently, meeting audio or text sent for cloud AI processing, which may include personal data of meeting participants. |
| Special category data | None intended. Meeting content may incidentally contain it; it is processed transiently and not stored. |
| Duration | The term of the subscription, plus up to 30 days for deletion. |
4. Our obligations
We will:
- process the personal data only on the Customer’s documented instructions, including these terms;
- ensure people authorised to process it are bound by confidentiality;
- apply appropriate technical and organisational measures, including encryption in transit, hashed IP addresses, access controls and data minimisation;
- help the Customer respond to data subject requests and meet its security, breach and impact-assessment duties;
- notify the Customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach;
- delete or return the personal data at the end of the service, unless the law requires us to keep it;
- make available the information needed to show compliance, and allow reasonable audits on 30 days’ notice.
5. Subprocessors
The Customer authorises the following subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment processing and billing | Ireland, United States |
| Vercel Inc. | Website hosting and server functions | United Kingdom (London region); United States (company) |
| Amazon Web Services EMEA SARL | Account database (DynamoDB), account email (SES) and hosting our AI service, which relays meeting content to AI providers without storing it | United Kingdom (London region, eu-west-2) |
| AI transcription and language model providers | Transient processing of meeting content for cloud transcription, summaries and Questions as you go | Named list to be published before launch |
We will give at least 30 days’ notice by email before adding or replacing a subprocessor, and the Customer may object on reasonable data protection grounds. We impose data protection terms on each subprocessor that are at least as protective as this DPA.
6. International transfers
Where personal data is transferred outside the UK or EEA, we rely on adequacy regulations or the UK International Data Transfer Addendum and EU Standard Contractual Clauses, as applicable.
7. Liability and precedence
Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on data protection, this DPA takes precedence.
8. Signed copies
Business customers can ask for a signed copy of this DPA. To request one, email privacy@transcript.audio.
Contact
Harvie Software Solutions Ltd, a company registered in England and Wales (company number [company number]), registered office: [registered office address]. Email: support@transcript.audio.