Data Processing Addendum

1. Definitions and roles

“Personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject”, and “personal data breach” have the meanings given in the GDPR. In relation to personal data within Customer Content, you are the Controller (or a processor acting for a third-party controller) and we are the Processor. You determine the purposes and means of processing by choosing what to upload, which processing policy to apply, and how to use the outputs.

2. Scope and instructions

We process personal data only on your documented instructions, which comprise the Terms, this DPA, the configuration you set in the product (matters, processing policy, retention, sharing), and any further written instructions you give. We will inform you if, in our opinion, an instruction infringes applicable data-protection law. We will not process the personal data for our own purposes, and we will not sell it or use Customer Content to train AI models. The subject matter, duration, nature, and purpose of processing, and the categories of data and data subjects, are described in Annex I.

3. Confidentiality of personnel

We ensure that personnel authorized to process personal data are bound by confidentiality obligations and are trained appropriately, and we limit access to those who need it to provide the Service. The application admin console does not expose recordings or transcript text. Exceptional infrastructure access is subject to restricted credentials, time-limited authorization, and infrastructure audit logging.

4. Security measures

We implement appropriate technical and organizational measures to protect personal data, as summarized in Annex II and described in the Security overview. You are responsible for configuring the Service (access, roles, retention, sharing) appropriately for your risk and for the security of your own systems and credentials.

5. Sub-processors

You grant a general authorization for us to engage the sub-processors listed on the Sub-processors page to process Customer Content, each under a written contract imposing data-protection obligations no less protective than this DPA. We remain responsible for their performance.

We will give reasonable prior notice of any intended addition or replacement of a sub-processor. You may object on reasonable data-protection grounds within the notice period; if we cannot accommodate the objection, you may terminate the affected part of the Service.

6. Assistance: data-subject requests and compliance

Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures — including the product’s access, export, correction, and deletion tools — to respond to data-subject requests and to meet your obligations regarding security, breach notification, data-protection impact assessments, and prior consultation. If a data subject contacts us directly about Customer Content, we will refer them to you.

7. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Content, and provide the information reasonably available to help you meet your notification obligations. Our append-only, hash-chained audit trail supports investigation of privileged actions.

8. International transfers

Where processing involves a transfer of personal data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, which are incorporated into this DPA by reference. Where your plan supports regional processing, you may configure matters to remain within a specified region.

9. Return and deletion

On expiry or termination, and at your choice, we will delete or return Customer Content and delete existing copies, except to the extent applicable law requires storage. During a reasonable wind-down window you may export your data using the product’s export tools. Deletion follows your configured retention settings and applies across our systems and, on instruction to our sub-processors, within their standard deletion cycles.

10. Audits and information

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior written notice and subject to confidentiality, allow for and contribute to audits, including through up-to-date documentation and, where available, third-party reports. Audits must not compromise the security or confidentiality of other customers.

11. Annex I — Description of processing

Parties. Controller: the customer organization identified in its Tracecanon account. Processor: Nimavera Inc. (in formation).

Subject matter and duration. Processing of Customer Content to provide Tracecanon for the duration of the Terms plus any wind-down and retention period.

Nature and purpose. Secure storage; transcription and speaker diarization; translation; indexing and embeddings; cited retrieval and question answering; conservative inconsistency analysis; chronology building; export generation; secure sharing; and audit logging.

Categories of data subjects. Speakers and individuals appearing in the recordings and documents you upload, and your authorized users. Depending on your matters, this may include witnesses, parties, clients, and other third parties, and may include vulnerable individuals.

Categories of personal data. Identifiers, voice and image, the contents of statements and documents, and any personal data (potentially including special-category data) that you choose to upload. Account data for your users (name, email, credentials, role).

Frequency and retention. Continuous for the term; retained per your plan and matter retention settings and deleted thereafter, subject to legal hold.

12. Annex II — Technical and organizational measures

Measures include, without limitation:

• per-organization tenant isolation, with an organization key on every record and authorization on every read;
• private object storage with short-lived signed URLs; encryption of data in transit and of secrets;
• MFA-ready authentication (including TOTP) with server-side session revocation, and role-based access control;
• isolated validation of untrusted uploads and prompt-injection defenses that treat retrieved content as data;
• an ordered, append-only, hash-chained metadata audit trail across evidence handling, processing, model activity, access, reviews, corrections, exports, and sharing; no evidence, transcript text, prompts, questions, answers, credentials, or model responses duplicated into that trail or exposed in the application admin console; restricted and logged infrastructure break-glass access;
• rate limiting and quota enforcement; durable, leased background processing with retries; backups and restore procedures.

See the Security overview for detail. Measures may evolve; we will not materially reduce their overall level during the term.

13. Annex III — Sub-processors and liability

The authorized sub-processors are those listed on the Sub-processors page, which is incorporated into this DPA and updated as described in the Sub-processors section above.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. This DPA does not create rights beyond those required by applicable data-protection law.

14. Contact

DPA and data-protection enquiries: legal@tracecanon.com and privacy@tracecanon.com.