Data Processing Addendum
Effective 23 October 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between SayVelio, based in the Republic of Cyprus ("Processor", "we"), and an organization that sets up a SayVelio team for its staff ("Customer"). It applies automatically when a team owner accepts the Terms on the Customer's behalf and covers personal data we process for the Customer, as required by Article 28 of the EU General Data Protection Regulation ("GDPR"). If the Customer needs a signed copy, write to hello@sayvelio.com.
1. Scope of processing
| Subject matter | Providing team accounts in SayVelio: membership, shared settings and connected Macs and iPhones. |
|---|---|
| Data subjects | The Customer's team owners, admins and members. |
| Personal data | Email address, password hash, team role (owner, admin or member), connected Macs and iPhones (name, dates, SayVelio and operating system versions), daily usage counts (dictations, words, seconds of audio, and requests and tokens per AI model; never text or audio), team settings, prompts and dictionaries that may contain names or terms, snippets that members save to insert later (which may contain contact details of members or other people; stored encrypted), and technical logs. |
| Special categories | None intended. SayVelio does not create voiceprints or identify speakers. |
| Duration | For as long as the team exists, then deletion under section 8. |
Once the Customer adds its own API key, audio, transcripts and cleaned text are not processed by us: the app sends them from members' devices directly to the speech and AI providers selected in the team settings, under the Customer's own agreements with those providers and using the Customer's API key. Those providers are not our sub-processors.
Until the Customer adds an OpenAI key, members may dictate on SayVelio's trial access: the app sends audio and text from members' devices directly to OpenAI under our account, using short-lived tokens we issue. They still do not pass through or get stored on our servers, and OpenAI acts as our sub-processor for this (see section 5).
2. Customer instructions
We process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's settings in SayVelio, unless EU or Member State law requires otherwise, in which case we will inform the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks data protection law.
3. Confidentiality
Everyone we authorize to process the personal data is bound by confidentiality.
4. Security
We maintain appropriate technical and organizational measures under Article 32 GDPR, including encryption in transit (HTTPS), hashed passwords, encrypted storage of team API keys, access to production systems limited to authorized personnel, revocable device tokens and account blocking, and signed, notarized app releases with signed updates.
5. Sub-processors
The Customer authorizes the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway Corporation | Application hosting and database | United States |
| Google LLC | Google sign-in (if used) and reCAPTCHA | United States |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Speech recognition and text cleanup on SayVelio's trial access, only until the Customer adds its own OpenAI key | United States |
| Resend (Plus Five Five, Inc.) | Account emails to team members: address confirmation and password reset | EU (Ireland) / United States |
We impose data protection obligations on each sub-processor equivalent to this DPA and remain responsible for them. We will announce new sub-processors on this page at least 14 days in advance; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection the Customer may stop using the Service.
6. International transfers
Where personal data is transferred outside the EEA, transfers rely on an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by the European Commission.
7. Assistance
Taking into account the nature of the processing, we will help the Customer respond to data subject requests, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR. If a data subject contacts us directly, we will pass the request to the Customer.
8. Personal data breaches
We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations.
9. Deletion and return
When the Customer deletes its team or stops using the Service, we delete the personal data within 30 days, unless the law requires us to keep it. Before that, the Customer may ask us for an export.
10. Audits
We will make available the information needed to demonstrate compliance with this DPA and allow reasonable audits, on at least 30 days' written notice, no more than once a year unless a breach or a supervisory authority requires otherwise, and at the Customer's cost.
11. Liability and precedence
The liability terms in the Terms of Service apply to this DPA, except where the GDPR does not allow them to be limited. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.