Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (“DPA”) forms part of the Terms of Servicebetween Ricord AI, Inc. (“Ricord,” “Processor”) and the customer using the Service (“Customer,” “Controller”). It applies to the extent Ricord processes Personal Data on the Customer’s behalf that is subject to the GDPR, the UK GDPR, the Swiss FADP or other data protection laws that require a processor agreement (“Data Protection Laws”).

For Your Content (audio, video, screenshots, documents and the transcripts, summaries and action items generated from them), the Customer is the Controller and Ricord is the Processor. For account, billing and service-security data, Ricord is an independent controller as described in the Privacy Policy.

2. Details of processing

• Subject matter: providing the Ricord note-taking service.
• Duration: for as long as the Customer’s account is active, plus the short deletion period described in section 9.
• Nature and purpose: storing, transcribing, reading text from, analyzing and summarizing Customer content, and generating and displaying action items and answers to the Customer’s questions.
• Types of Personal Data: voices and speech content in recordings; names, contact details and other personal data that appear in screenshots, documents and transcripts; and account identifiers. The Customer decides what content to upload.
• Data subjects: the Customer’s users and the individuals who are recorded, mentioned or shown in the Customer’s content, such as colleagues, clients and meeting participants.

3. Processing on instructions

Ricord will process Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the Service’s features. Ricord will tell the Customer if it believes an instruction infringes Data Protection Laws. Ricord will not use Customer content to train AI models, and will not sell it or use it for advertising.

The Customer is responsible for having a lawful basis to process Personal Data in its content, including obtaining the consent of everyone recorded where the law requires it.

4. Confidentiality

Ricord ensures that personnel authorized to process Personal Data are bound by confidentiality obligations and access Customer content only when necessary to provide support requested by the Customer, to maintain security, or as required by law.

5. Security measures

Ricord maintains appropriate technical and organizational measures, including:

• encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• authentication via Firebase Authentication and per-account isolation enforced on every API request;
• signed, time-limited URLs for access to stored files;
• hosting on Google Cloud infrastructure with managed physical and network security; and
• access controls, logging and a process for handling security incidents.

More detail is on our Security page.

6. Subprocessors

The Customer gives general authorization for Ricord to engage the following subprocessors. Ricord imposes written data protection obligations on each that are no less protective than this DPA and remains responsible for their performance.

Ricord will notify the Customer of intended additions or replacements, by email or in the Service, at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may stop using the affected part of the Service or terminate.

7. International transfers

The Customer authorizes transfers of Personal Data to the United States and other countries where Ricord or its subprocessors operate. Where Data Protection Laws require a transfer mechanism, the parties agree that the Standard Contractual Clauses (Module Two, controller to processor) and, for the UK, the UK International Data Transfer Addendum, are incorporated by reference, with the details in this DPA completing their annexes.

8. Assistance with data subject requests

Taking into account the nature of the processing, Ricord will help the Customer respond to requests from data subjects to exercise their rights. Many requests can be fulfilled by the Customer directly in the Service, for example by editing or deleting a Ricord. If Ricord receives a request about the Customer’s content, it will refer the person to the Customer where it can identify the Customer. Ricord will also reasonably assist with data protection impact assessments and consultations with authorities.

9. Personal data breaches

Ricord will notify the Customer without undue delay, and within 72 hours, after becoming aware of a Personal Data breach affecting the Customer’s content. The notice will describe the nature of the breach, the likely consequences and the measures taken or proposed, and Ricord will provide information as it becomes available.

10. Deletion and return

The Customer can delete Ricords and their contents at any time in the Service, and can request deletion of the account at privacy@ricord.ai. When content is deleted, the recordings, screenshots, documents, transcripts and action items associated with it are removed from active systems. Residual copies in backups are overwritten on a rolling schedule. The Customer may export its content before deletion; ask support@ricord.ai if you need help.

11. Audits and information

On reasonable written request, Ricord will provide the information needed to demonstrate compliance with this DPA and Article 28 of the GDPR, and will allow and contribute to audits no more than once a year (unless required by a supervisory authority or following a breach), on reasonable notice, during business hours, and without disrupting operations or exposing other customers’ data. Each party bears its own costs.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms about the processing of Personal Data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. This DPA is governed by the law that governs the Terms, except where Data Protection Laws or the Clauses require otherwise.

13. Contact

To request a signed copy of this DPA or ask questions, email legal@ricord.ai or privacy@ricord.ai.