Data processing agreement

1. Parties and purpose

The controller is the Scribe user acting in a professional capacity ("you"). The processor is Swalent (Edmond Ivanov), Rue de la Limite 60, 1970 Wezembeek-Oppem, Belgique, enterprise number 1042.844.426 ("Swalent").

This agreement applies as soon as you accept the terms, for as long as Swalent processes personal data on your behalf. Where it conflicts with the terms on data protection, this agreement prevails.

2. Description of the processing

• Data subjects: you, the people you record or mention (participants, counterparts, clients, patients), the people you share with.
• Data: voice and audio, image and video, transcribed speech, names and roles, any information spoken or written, including, depending on your use, sensitive data (art. 9) that you alone decide to process.
• Nature: hosting, transcription and document generation by the AI provider you designate, display, search, sharing, export, backup, deletion.
• Purpose: providing Scribe to you, and nothing else.
• Duration: that of the contract, then deletion as set out in the privacy policy.

3. Your instructions

Swalent processes the data only on your documented instructions: your use of the app and its settings, this agreement, and any reasonable additional written instruction. Swalent tells you if an instruction appears to infringe the GDPR.

If Union or Member State law requires other processing, Swalent informs you beforehand, unless that law prohibits it.

4. Swalent’s obligations

• Confidentiality: only the operator has access to the data, under a duty of confidentiality, and only to assist you, handle an incident or comply with the law.
• Security: the measures in the security annex below (GDPR, art. 32).
• Assistance: Swalent helps you, as far as possible, answer data subjects’ requests (export and deletion tools), and carry out an impact assessment or consult the authority.
• Data breach: Swalent notifies you without undue delay, and at the latest 48 hours after becoming aware of it, with the information available (art. 33.2).
• End of contract: your data is deleted within the periods in the privacy policy; you can export it beforehand. Backups disappear within 30 days.
• Documentation and audit: Swalent makes available the information needed to demonstrate compliance with this agreement. An on-site audit, at your cost, is possible with 30 days’ notice and a confidentiality undertaking, at most once a year unless there has been a breach.

5. Sub-processors

You authorise Swalent to use the sub-processors below. Swalent informs you of any addition or replacement at least 30 days in advance, by email; you may object on reasonable data protection grounds, and terminate at no cost if no solution is found. Swalent imposes equivalent data protection obligations on each by contract and remains liable to you for their performance.

• Vercel Inc.: hosting and compute, Frankfurt; fetching linked media. United States: DPF and standard clauses 2021/914.
• Databricks, Inc. (Neon): database, Frankfurt. DPF and standard clauses.
• Cloudflare, Inc.: file storage, European Union (R2, EU jurisdiction). DPF and standard clauses.
• Resend (Plus Five Five, Inc.): service emails carrying a document you send. DPF and standard clauses.
• Google LLC: Drive, Calendar and Tasks access, if you turn it on. DPF and standard clauses.

The AI providers you designate with your own key (ElevenLabs, Mistral, AssemblyAI, OpenAI, Anthropic, Google) are not Swalent’s sub-processors: you engage them directly, under your contract with them, and Swalent sends them data on your instruction. It is up to you to conclude with them the data processing agreement they offer.

6. International transfers

Swalent transfers data outside the European Economic Area only to a sub-processor listed above, on the basis of adequacy decision (EU) 2023/1795 or standard contractual clauses (EU) 2021/914.

7. Security measures

• Encryption in transit (HTTPS); provider keys and tokens encrypted at rest; files stored in the Union.
• File access through short-lived signed links; no public file.
• Authentication through Google; signed, revocable sessions; protection against requests from other sites.
• Account separation checked by automated tests on every code change.
• Daily backup kept 30 days; daily service check; incident log.
• Complete deletion of an account, audio included, and export of all its data, available in the app.

8. Liability and termination

Each party’s liability follows the GDPR (art. 82) and the limits for professionals in the terms, except where the law sets them aside. You remain solely responsible for the lawfulness of the data you have processed.

This agreement ends with the contract. The confidentiality and deletion obligations survive until complete deletion.