BriefVox AI Data Processing Agreement
Parties
Data Controller / Client: the user or organization using BriefVox AI as data controller.
Data Processor / BriefVox AI: Filip Ogonowski, a natural person conducting unregistered business activity within the meaning of Art. 5 of the Polish Act of 6 March 2018 – Entrepreneurs' Law, Generała Dezyderego Chłapowskiego 12, 05-825 Grodzisk Mazowiecki, Poland.
1. Subject matter
This Agreement sets out the terms for entrusting the processing of personal data in connection with the Client's use of BriefVox AI, including audio files, video files, linked media imports, transcripts, captions, metadata, AI Notes, and exports.
2. Nature and purposes of processing
receiving audio files, video files, or media links from the Client,
transferring files over an encrypted connection and storing them in private, non-public storage,
automatic transcription of the audio track to text,
speaker identification and generation of timestamps,
providing the online editor, TXT/DOCX/SRT/VTT exports, and rendering captioned MP4 or MOV video,
generating AI Notes (summaries, meeting notes, translations, reports, and other types) from transcript content, where the Client uses that feature,
technical operations, security, backups, and logging.
3. Categories of data subjects and data
Category
Description
Categories of data subjects
individuals appearing in recordings, employees, contractors, conversation partners, the Client's customers, persons who have communicated with the Client
Categories of data
voice recordings, statements, names, contact details, company data, information contained in conversations, timestamps, speaker identification, content of automatically generated AI Notes (where the feature is active)
Special category data
may appear incidentally or intentionally in a recording if uploaded by the Client; the Client is responsible for the legal basis for processing such data
4. Duration of processing
Processing continues while the Client uses the Service and data remains on the account. Source media is removed from active storage after 24 hours, rendered MP4 or MOV files after 7 days, and transcripts, caption settings, and AI Notes when the Client deletes them, closes the account, or terminates the agreement, subject to limited disaster-recovery retention and legal obligations.
5. Obligations of the processor
Process data only on documented instructions from the Client, unless required otherwise by law.
Ensure that persons authorized to process data are bound by confidentiality obligations.
Implement appropriate technical and organizational measures to protect data.
Assist the Client in fulfilling the rights of data subjects, to the extent technically possible.
Assist the Client in handling personal data breaches, where the breach relates to entrusted data.
Upon termination of services, delete or return data in accordance with the Client's instructions, unless law requires continued retention.
Provide the information necessary to demonstrate compliance with processing obligations, within reasonable limits and with protection of business confidentiality and the security of other clients.
6. Client obligations
The Client is responsible for the lawfulness of recordings, source links, and data submitted to BriefVox AI.
The Client is responsible for fulfilling information obligations towards individuals whose data is included in recordings, where applicable.
The Client must not upload or import data that it is not permitted to process or submit for transcription.
The Client must secure its own account and user access on the Client's side.
7. Subprocessors
BriefVox AI may engage subprocessors necessary to deliver the Service. The current Subprocessors Registry forms part of this Agreement and identifies their roles, locations, and transfer mechanisms.
Subprocessor
Role
Location / transfer
Stripe
payments and billing
Ireland (Stripe Payments Europe, Ltd.) and the United States (Stripe, Inc.); international transfers use the safeguards described in Stripe's DPA
Backblaze B2 (Backblaze Inc.)
file storage and infrastructure
European Union (Backblaze B2 EU Central, Amsterdam, Netherlands)
Amazon Web Services (AWS Bedrock)
AI Notes generation from transcript text (audio/video transcription is performed locally by the Operator)
European Union (Stockholm, AWS eu-north-1)
Resend (Resend, Inc.)
system notifications
United States; international transfers use the safeguards described in the provider's DPA
BriefVox AI must notify the Client of material changes to the list of subprocessors, giving the opportunity to raise a reasoned objection to the extent required by GDPR and the agreement.
8. Security measures
encryption in transit,
private file storage,
temporary file access links,
administrative access controls,
security event logging,
limited staff access to data,
user data segregation,
data breach procedure.
9. Personal data breaches
BriefVox AI must notify the Client of any breach of entrusted personal data without undue delay after becoming aware of it, providing available information to allow the Client to assess the risk and fulfil its legal obligations.
10. Audit
The Client may request information confirming the application of data protection measures. On-site audits require prior agreement on timing, scope, and confidentiality rules, and must be conducted in a manner that does not compromise the security or confidentiality of other clients' data.
11. Termination
Upon termination of services, BriefVox AI will delete or return data in accordance with the Client's instructions, unless law requires continued retention. Data held in backups may be deleted in accordance with the backup retention cycle.
Annex 1 — Processing instructions
Element
Description
Subject matter
transcription of audio and video, video captioning, optional AI Notes, and provision of results
Duration
duration of the account and data retention period
Purpose
delivery of the selected transcription, captioning, or AI Notes service
Categories of data
audio files, video files, linked media imports, transcriptions, metadata, timestamps, speaker identifications, AI Notes content (where the feature is active)
Categories of data subjects
individuals present in the recordings