Data Processing Addendum

1. Subject matter

Processing of audio recordings, transcripts, and related metadata to provide the Echo service.

2. Duration

For the term of your subscription, plus deletion within 30 days after termination.

3. Nature & purpose

Storage, transcription, summarisation, analytics, and export of customer content.

4. Categories of data subjects

Participants in the conversations you record or upload, and end users of your account.

5. Sub-processors

• Cloud hosting and database (Supabase, AWS).
• AI transcription and summarisation (OpenAI).
• Payments (Stripe).
• Email delivery (Resend).

We will notify you of new sub-processors and give you a chance to object.

6. Security measures

TLS in transit, AES-256 at rest, RBAC, audit logs, regular backups, principle of least privilege.

7. International transfers

Where data leaves the EEA/UK, transfers rely on Standard Contractual Clauses.

8. Breach notification

We notify you without undue delay (within 72 hours) of becoming aware of a personal data breach.

9. Data subject requests

We assist you in responding to access, deletion, and portability requests through in-product tools and direct support.

10. Audit

On reasonable notice we will provide compliance documentation sufficient to demonstrate adherence to this DPA.

11. Contact

dpo@echo.app