Data Processing Addendum

1. Who is who

The organisation (“you”) decides why and how its people use Just Say It; for the personal information the product handles for you — your people’s and their guests’ speech, the slides, notes and recordings it makes, the connected accounts they choose to connect, the faces and voices they choose to give — you are the controller (or business) and ELAV8 AI LLC (“we”) is your processor (or service provider).

For the account itself — who signed in, the plan, the payment — ELAV8 AI LLC is the controller, as the Privacy Policy says; this addendum covers the processing we do for you inside the product.

2. What we process, and on whose instructions

The kinds of information, the purposes and how long each is kept are the ones the Privacy Policy and the Data Retention table describe — nothing more, and for no purpose of our own beyond operating, securing and improving the product as the Privacy Policy says. The people it concerns are your account holders, the people they invite into a room, the people on a call they capture, and the people whose photo or voice a host adds.

Your instructions are these terms, the settings and choices your people make in the product (a host’s setting, a deletion, a share, a consent given or refused), and any written instruction you give us that the product can carry out. We process only on them; if an instruction would break the law, we tell you instead of following it.

We do not sell personal information, do not share it for cross-context behavioural advertising, do not combine it with information from other sources for our own purposes, and do not use it to train a model of our own or anyone else’s.

3. Our people

The people who operate the product for us are bound to confidentiality, reach your information only when operating or supporting the service requires it, and reach it through named accounts whose use is recorded. Our own logs carry codes and counts — never a word anyone said, wrote or showed.

4. Security

We keep measures appropriate to the risk, which today include:

• Encryption in transit everywhere (TLS to the site, to the server, and between the server and every provider), and encryption at rest by the hosting and storage providers that hold recordings, pictures and films.
• The keys to connected accounts kept encrypted in a vault that only the connector service can open; the sign-in cookies encrypted; every secret the product holds kept as a secret of the deployment, never in code or in a log.
• Access to a recording only by the people who were in the meeting, decided by the roster; the product’s own tools for deletion, which remove a recording and its media everywhere we hold them.
• Every request from a browser checked for its origin and rate-limited; every request to a provider bounded in size and time; the product fails closed — a call it cannot verify is refused, and a judge it cannot reach delivers nothing rather than something unchecked.
• A monitoring service that records when the product itself fails and what failed in our own code — never what was said, written or shown, never who was there.
• A Security page that says what shipped and what is still short, kept current.

We may improve a measure at any time; we do not lower the protection this section describes without telling you.

5. Sub-processors

We use service providers in the categories the Privacy Policy lists — hosting and storage; speech and language processing; identity and payment; network, security and media relay; public map and picture sources; web search; picture- and video-making; e-mail delivery; a meeting-bot service; error reporting — each bound by written terms at least as protective as these, each processing only what that section says it receives, and we remain responsible to you for them.

The list with each provider’s name and country is available to an organisation under this addendum on request to [email protected]. We tell you by e-mail, to your account’s address, at least thirty days before a new provider begins processing your information; you may object on reasonable grounds within that time, and if we cannot resolve the objection you may end the agreement for the affected part and we refund any prepaid part of the period not used.

6. Helping you with people’s rights

Most requests you receive the product answers directly: a person sees, exports and deletes their recordings from their own history; a host revokes a share, removes a team face or a cast member; the Your Privacy Choices page says how each right is exercised. If a request reaches us about information we process for you, we pass it to you within five business days and act only on your instruction, except where the law requires us to act ourselves. We help you, as the law requires and at your reasonable request, with a data protection impact assessment and a consultation with an authority about the processing this addendum covers.

7. Security incidents

If we confirm a breach of security that has led to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information we process for you, we tell you without undue delay and no later than seventy-two hours after confirming it, at your account’s e-mail address, with what we know: what happened, what information and how many people it concerns as far as we can tell, what we have done and what we suggest you do. We keep you informed as we learn more and help you with the notices the law requires of you.

8. Return and deletion

During the agreement your people export what the product made — the notes, the slides as a PDF, a replay — from the product itself. When the agreement ends, or earlier on your written instruction, we delete the personal information we process for you — every recording under your accounts and its media everywhere we hold them — within thirty days, except what the law requires us to keep (a payment’s record, for as long as it says) and what another person who was in a meeting is entitled to keep under the Privacy Policy. The Data Retention table says how long each thing is kept otherwise.

9. Showing you

Once a year on request we give you a written description of our measures and answer your reasonable questions about them, and we share a third-party assessment when one exists. Where the law gives you a right to audit, you may, on thirty days’ notice, at a time that does not disrupt the service and at your cost, have an independent auditor bound to confidentiality review the processing this addendum covers, once in any twelve months unless an incident or an authority requires more.

10. Where the processing happens

We process in the United States. For personal information of people in the European Economic Area, the United Kingdom or Switzerland, we enter into the European Commission’s Standard Contractual Clauses (the module for a controller to a processor), with the United Kingdom’s addendum and the Swiss amendments where they apply, on request; this addendum then forms part of them, and where they conflict the clauses prevail.

11. The rest

This addendum lasts as long as we process personal information for you. Where it conflicts with the Terms of Service, it prevails for that processing; the Terms’ limits of liability apply to it as to the rest of the agreement, to the extent the law allows. Changes to it are made as the Terms say, and a change that lowers your protection does not apply to you until you have been told and had thirty days to object. Questions: [email protected], ELAV8 AI LLC, 1343 Main Street, Suite 205, Sarasota, FL 34236, United States.