Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between YapperTalk LLC (“YapperTalk”, “Processor”) and the customer identified in the Agreement (“Customer”, “Controller”).

It applies where YapperTalk processes Personal Data on Customer’s behalf in providing the Service, and it takes effect automatically on the date the Agreement takes effect. Where this DPA conflicts with any other part of the Agreement on the subject of data protection, this DPA governs. Where it conflicts with the Standard Contractual Clauses, the Clauses govern.

A Customer that requires a signed counterpart, an entity-specific version, or negotiated changes should write to yappertalkteam@gmail.com. We sign DPAs as a matter of course and do not treat it as an escalation.

• Data Protection Laws means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws including the California Consumer Privacy Act as amended (“CCPA”).
• Personal Data, controller, processor, data subject, processing, and personal data breach have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws carry their equivalent meanings.
• Customer Personal Data means Personal Data contained in Customer Data that YapperTalk processes on Customer’s behalf.
• SCCs means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

For Customer Personal Data, Customer is the controller (or a processor acting for another controller) and YapperTalk is the processor. Where Customer is itself a processor, Customer warrants that it has the controller’s authority to appoint YapperTalk as a subprocessor on these terms.

YapperTalk acts as an independent controller for a limited set of data described in the Privacy Policy, namely website visitor data, sales and support correspondence, and its own billing, tax, and security records. This DPA does not apply to that data.

Each party is responsible for its own compliance with Data Protection Laws in respect of its role.

YapperTalk will process Customer Personal Data only on Customer’s documented instructions, which comprise the Agreement, this DPA, the configuration Customer sets in the admin console, and any further written instruction Customer gives that is consistent with the Agreement.

YapperTalk will not process Customer Personal Data for its own purposes, will not sell or share it as those terms are defined under U.S. state privacy laws, will not use it for advertising, and will not use it to train, fine-tune, or evaluate any model except under a separate written opt-in from Customer that Customer may withdraw at any time.

If YapperTalk is required by law to process Customer Personal Data beyond Customer’s instructions, it will inform Customer of that requirement before processing unless the law prohibits it on important grounds of public interest. If YapperTalk believes an instruction infringes Data Protection Laws, it will inform Customer without undue delay and may suspend performance of that instruction.

The subject matter, duration, nature, and purpose of the processing, and the categories of data and data subjects, are set out in Annex I. In summary: YapperTalk processes speech and the text derived from it in order to return transcribed and rewritten text to the person who spoke, and processes account, seat, and device records in order to authenticate and authorize that person. Processing lasts for the term of the Agreement and the limited retention periods that follow it.

YapperTalk ensures that personnel authorized to process Customer Personal Data are bound by a written duty of confidentiality that survives the end of their engagement, are trained in their data protection obligations, and are granted access only to what their role requires. Access is reviewed periodically and revoked on role change or departure.

YapperTalk implements and maintains the technical and organizational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects.

YapperTalk may update those measures over time provided the update does not materially reduce the overall level of security. The single most significant measure is architectural rather than procedural: dictated audio is never written to persistent storage, so there is no stored corpus of recordings to be exfiltrated, subpoenaed, or exposed by a misconfiguration.

Customer gives YapperTalk general written authorization to engage subprocessors. The subprocessors engaged as at the effective date of this DPA are:

YapperTalk imposes on each subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for each subprocessor’s performance of those obligations.

YapperTalk will give Customer at least thirty (30) days’ notice before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period by writing to yappertalkteam@gmail.com. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service without penalty and receive a refund of prepaid fees covering the unused remainder of the term. To subscribe to subprocessor notices, write to the same address.

• Data subject requests. Taking into account the nature of the processing, YapperTalk will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligation to respond to requests to exercise data subject rights. If a data subject contacts YapperTalk directly about Customer Personal Data, YapperTalk will not respond substantively itself, and will promptly forward the request to Customer and tell the data subject that it has done so.
• Impact assessments. YapperTalk will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to it.
• Government and law enforcement requests. YapperTalk will not disclose Customer Personal Data to a public authority except where legally compelled. If compelled, it will assess the request for validity and scope, challenge it where there is a reasonable basis, disclose only the minimum required, and notify Customer before disclosing unless legally prohibited or there is an imminent risk to life. Where notice is prohibited, YapperTalk will use reasonable efforts to obtain a waiver of the prohibition.

YapperTalk will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, the measures taken or proposed to address it, and a contact point for further information.

YapperTalk will provide further information as the investigation progresses, will take reasonable steps to mitigate and remediate, and will cooperate with Customer’s own notification obligations. Notification is not, and will not be construed as, an admission of fault or liability.

Customer may export or delete Customer Data through the admin console at any time during the term. On expiry or termination of the Agreement, YapperTalk will delete Customer Personal Data within ninety (90) days, except to the extent it is required to retain a copy by applicable law, in which case it will isolate the retained copy, keep it subject to this DPA, and delete it when the retention requirement ends.

Data deleted from live systems is removed from backups within thirty-five (35) days as those backups roll off their retention cycle. Dictated audio is not covered by this section because it is never persisted in the first place. YapperTalk will certify deletion in writing on Customer’s request.

YapperTalk will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, including its security documentation, infrastructure descriptions, and answers to a reasonable security questionnaire.

Where that information is not sufficient, Customer may audit YapperTalk’s compliance no more than once in any twelve-month period, on at least thirty (30) days’ written notice, during business hours, without unreasonably disrupting operations, subject to confidentiality obligations, and at Customer’s expense. A supervisory authority may audit at any time to the extent Data Protection Laws require. Customer may audit more frequently following a personal data breach affecting its data, or where a supervisory authority requires it.

Where YapperTalk processes Customer Personal Data originating in the EEA, the United Kingdom, or Switzerland in a country that has not received an adequacy decision, the following apply and are incorporated by reference:

1. EEA transfers. The SCCs, Module Two (controller to processor) where Customer is a controller, or Module Three (processor to processor) where Customer is a processor. Clause 7 (docking) applies. Clause 9 option 2 applies, with the notice period in section 8 above. Clause 11 does not include the optional independent dispute resolution body. Clause 17 selects the law of Ireland. Clause 18(b) selects the courts of Ireland. Annexes I and II of the SCCs are populated by Annex I and Annex II of this DPA.
2. UK transfers. The UK Addendum, with Tables 1 to 3 populated by the corresponding details in this DPA, and Table 4 selecting “neither party” as able to end the Addendum under section 19.
3. Swiss transfers. The SCCs as amended so that references to the GDPR are to the Swiss FADP, the competent authority is the Federal Data Protection and Information Commissioner, and the term “member state” does not prevent data subjects in Switzerland from suing in their place of habitual residence.

YapperTalk will carry out and document a transfer impact assessment and will make it available to Customer on request. Supplementary measures include encryption in transit, the absence of any audio at rest, access controls and logging, and the commitments on government requests in section 9.

Where the CCPA or a comparable U.S. state privacy law applies, YapperTalk is a “service provider” or “processor” and Customer is a “business” or “controller”. Customer discloses Personal Information to YapperTalk only for the limited and specified business purpose of providing the Service.

YapperTalk certifies that it understands and will comply with these restrictions. It will notify Customer promptly if it determines it can no longer meet them, and Customer may then take reasonable steps to stop and remediate unauthorized use.

Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, except where Data Protection Laws provide otherwise. Nothing in this DPA limits a data subject’s rights or remedies under Data Protection Laws, or the parties’ liabilities under the SCCs as between themselves and to data subjects.

• Encryption. TLS for all data in transit between client applications, the website, and the engine. Encryption at rest for databases and backups.
• No audio at rest. Dictated audio is held in process memory for the duration of a single request and released when it completes. It is not written to disk, queues, logs, crash dumps, or backups at any stage.
• No content logging. Application and error logs record request metadata, outcome, and timing. They do not record transcript or rewrite content.
• Access control. Least-privilege access to production systems, multi-factor authentication required, access reviewed periodically and revoked on role change or departure.
• Customer-side access control. Single sign-on, SCIM provisioning and deprovisioning, and role-based permissions administered by Customer’s own administrators.
• Authorization at the boundary. Every transcription request is authorized against a live license before audio reaches any model. Revocation takes effect on the next request, with no offline grace period.
• Model protection. Model weights are held in private storage, fetched by the engine at start using rotatable credentials, and never distributed to client devices.
• Pseudonymization. Seats are identified to the engine by license key and device identifier rather than by name or email address.
• Resilience and recovery. Managed hosting with provider-level redundancy, automated database backups, and a documented restoration process.
• Incident management. A documented incident response process covering detection, triage, containment, notification within the timeframe in section 10, and post-incident review.
• Subprocessor governance. Written data protection terms with every subprocessor, zero-retention and no-training terms with those that process transcript text, and advance notice to customers before the list changes.
• Secure development. Version control with peer review, dependency management, and secrets held in managed environment configuration rather than in source.

To request a signed counterpart, raise a subprocessor objection, or ask a question about this DPA: yappertalkteam@gmail.com

Contract notices: yappertalkteam@gmail.com

YapperTalk LLC
Los Angeles, California