Data processing agreement

This agreement applies when a business uses CapQA to process personal data on its own behalf: the people in its videos, its clients on review links. It forms part of the Terms of Service between that business (“you”, the controller) and Antoni Nasiadko, Poland (“CapQA”, the processor), and meets Article 28 of the GDPR and of the UK GDPR. It applies without a signature; if your procurement needs a signed copy, write to hello@capqa.app and we send one countersigned.

What we process, and why

• Purpose: providing CapQA as the Terms describe: captions and transcription, the QA checks, Studio's edits and client review links. Nothing else.
• People in your videos: their voice in the audio extract sent for transcription, their words in the transcript and captions, and their image in a preview or package you attach to a review link.
• Your clients on a review link: their name, decision, note and transcript edits.
• Your team: the email address of each account.
• Video is encoded in your browser. It reaches us only when you attach a preview or package to a review link.
• Duration: while you use CapQA, and until the data is deleted as set out below.

Don't put special categories of personal data (health, religion and the like) into captions, brand words or notes unless your video needs them and you have a basis for it.

Your instructions

We process the data only on your documented instructions: the Terms, this agreement and what you do in the product (what you upload, attach, share or delete). If an instruction would break data protection law, we tell you. Where a law requires us to process data otherwise, we tell you first unless that law forbids it.

Confidentiality

Everyone we allow to process the data is bound to keep it confidential.

Security

• Everything travels over TLS; database and file storage are in the EU (Frankfurt).
• Row-level security limits every account to its own rows; service keys stay on our servers.
• Review links carry an unguessable 48-character token, expire within 30 days and are rate-limited.
• The audio extract goes to our transcription provider for one transcript and is not stored by us. We do not use your video or audio to train our own or third-party AI models.
• Studio jobs, and files attached to review links once the link ends, are deleted on the schedule in the privacy policy, by a daily cleanup.

Sub-processors

You authorise the providers listed under Who processes it for us in the privacy policy, each under a contract that limits it to providing its service to us. We give notice of a new provider by adding it to that list and changing the policy's date before it starts; if you object on reasonable data protection grounds, tell us and, if we cannot resolve it, you may end the contract. Transfers outside the EEA rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, as the privacy policy says.

Helping you meet your duties

We help you answer requests from the people whose data it is (access, correction, deletion, objection) and, as far as the nature of the processing and our information allow, with security, breach notification, impact assessments and consultation with an authority. A request that reaches us directly is passed to you, not answered by us.

Personal data breaches

We notify you without undue delay after becoming aware of a breach that affects your data, with what we know: what happened, the data and people concerned, the likely consequences and what we are doing about it, and more as we learn it.

Deletion

The data is deleted on the schedule in the privacy policy's table. When your account ends, or earlier on request, we delete what is left, including files attached to review links, unless a law requires us to keep it.

Audits

We answer written questions and give you the information needed to show that we meet Article 28. If that is not enough, you or an auditor you mandate, bound by confidentiality, may audit with 30 days' notice, at your cost, at most once a year unless an authority requires more.

Liability, precedence and law

Liability under this agreement follows the Terms. Where this agreement and the Terms differ on personal data, this agreement wins. It is governed by Polish law, as the Terms are. Questions: hello@capqa.app.