Data Processing Addendum
Effective 29 October 2026 · Draft
This Data Processing Addendum ("DPA") is part of the Terms of Service between SayVelio Technologies, Republic of Cyprus ("Processor", "we"), and an organization that uses Velio Notes for its staff, for example by setting up a team ("Customer"). It applies automatically when the Customer, or a team owner on its behalf, accepts the Terms, and covers personal data we process for the Customer, as required by Article 28 of the EU General Data Protection Regulation ("GDPR"). If the Customer needs a signed copy, write to hello@velionotes.com.
1. Scope of processing
| Subject matter | Providing Velio Notes to the Customer: transcribing meetings its users record, storing transcripts and notes, sending notices to meeting attendees, and running team accounts. |
|---|---|
| Nature and purpose | Transcription, storage, AI summarization, search, sharing within the Customer's account, notice and objection handling, and deletion, on the Customer's instructions. |
| Data subjects | The Customer's team owners, admins and members; participants and calendar attendees of meetings the Customer's users record, including people outside the Customer. |
| Personal data | Account data of users (SayVelio account identifier, email, name, role, devices, usage counts); meeting content (transcripts, notes, titles and times, speaker names and labels, questions asked about meetings); calendar data (event titles, times, organizer and attendee names and email addresses); notice logs and objections; technical logs. |
| Special categories | None intended. Meeting content may incidentally contain any information participants say. We do not create voiceprints, identify or verify speakers by their voice, or process biometric data. |
| Duration | For as long as the Customer uses the Service, then deletion under section 9. |
Audio. Meeting audio is sent from the user's device directly to the speech recognition sub-processor (OpenAI) using short-lived tokens we issue, and is not received or stored by us. If the Customer uses a feature that imports recordings from a third-party service such as Zoom (planned), we process the audio in memory and in transit only, to send it for transcription, and do not store it. Audio a user chooses to keep on their own device stays under the Customer's control.
2. Customer instructions
We process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's settings in Velio Notes, including its notice and retention settings, unless EU or Member State law requires otherwise, in which case we will inform the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks data protection law. The Customer is responsible for having a legal basis for recording meetings and for giving participants the information and obtaining the consent the law requires.
3. Confidentiality
Everyone we authorize to process the personal data is bound by confidentiality. Our staff do not read meeting content, except where the Customer asks us to for support or where the law requires it.
4. Security
We maintain appropriate technical and organizational measures under Article 32 GDPR, including: encryption in transit (HTTPS) and at rest, with meeting content encrypted under keys kept separately from the database; short-lived, single-purpose access tokens for transcription instead of long-term keys on devices; no storage of meeting audio on our servers; access to production systems limited to authorized personnel, with two-step verification and logging of access to accounts; revocable device tokens and account blocking; signed, notarized app releases with signed updates; and encrypted backups. [Annex with detailed measures, to be completed.]
5. Sub-processors
The Customer authorizes the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway Corporation | Application hosting and database (data centre in the Netherlands) | EU / United States |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Speech recognition and AI notes. OpenAI does not use API data for training | United States |
| Resend (Plus Five Five, Inc.) | Notice emails to meeting attendees and account emails | EU (Ireland) / United States |
| Google LLC / Microsoft Corporation | Calendar connection, only if a user connects a Google or Microsoft calendar | EU / United States |
We impose data protection obligations on each sub-processor equivalent to this DPA and remain responsible for them. We will announce new sub-processors on this page at least 14 days in advance; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection the Customer may stop using the Service. Services the Customer connects under its own account, such as its Zoom account, are not our sub-processors.
6. International transfers
Where personal data is transferred outside the EEA, transfers rely on an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by the European Commission (Module 3, processor to processor, with our sub-processors).
7. Assistance
Taking into account the nature of the processing, we will help the Customer respond to data subject requests, including requests from meeting participants who are not users, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR. The notice log of each meeting is available to the Customer to document how participants were informed. If a data subject contacts us directly, we will pass the request to the Customer.
8. Personal data breaches
We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations.
9. Deletion and return
Users can delete meetings at any time, and the Customer can set automatic deletion. When the Customer deletes its team or stops using the Service, we delete the personal data within 30 days, unless the law requires us to keep it. Before that, the Customer may export its transcripts and notes.
10. Audits
We will make available the information needed to demonstrate compliance with this DPA and allow reasonable audits, on at least 30 days' written notice, no more than once a year unless a breach or a supervisory authority requires otherwise, and at the Customer's cost.
11. Liability and precedence
The liability terms in the Terms of Service apply to this DPA, except where the GDPR does not allow them to be limited. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.