**SozAI Data Processing Agreement (DPA)**
Source: https://sozai.app/dpa/

Legal

# Data Processing Agreement

The terms under which VAST FLOW processes personal data for organisations that use SozAI, with the EU Standard Contractual Clauses, applying automatically to business use without a signature.

## The short answer

Yes, SozAI has a standard Data Processing Agreement under Article 28 of the GDPR. It applies automatically to every organisation that uses SozAI for business, including the Team and Education plans, once the [Terms of Service](https://sozai.app/terms/) are accepted. Nothing has to be signed.

The agreement includes the EU Standard Contractual Clauses, the UK Addendum and the Swiss adaptations, because VAST FLOW, the company that publishes SozAI, is registered in Kazakhstan, the data is stored in Germany and some sub-processors are in the United States. If your organisation needs a countersigned PDF, write to [support@sozai.app](mailto:support@sozai.app?subject=DPA) and we return this text signed and unchanged. We do not negotiate edits.

This summary is here for convenience. The numbered sections and the annexes below are the agreement.

**Version 1.0, effective 27 October 2026.**

Related pages: [Terms of Service](https://sozai.app/terms/), [Privacy Policy](https://sozai.app/privacy/), [Sub-processors](https://sozai.app/subprocessors/), [Security](https://sozai.app/security/), [Security questionnaire](https://sozai.app/trust/security-questionnaire/), [Refund Policy](https://sozai.app/refund-policy/).

## 1. Parties and scope

**1.1** This Data Processing Agreement ("DPA") is between VAST FLOW, TOO, a company registered in Kazakhstan, Office 29, 21/20 Askarov Street, Almaty, Kazakhstan, which publishes SozAI ("SozAI", "we", "us"), and the Customer defined in Section 2.

**1.2** This DPA applies when the Customer uses the Service for business, that is, when:

1. the Customer buys a Team or Education plan; or
2. any SozAI account is used on behalf of an organisation, whatever plan it is on,

and the Terms have been accepted for the accounts concerned. It then forms part of the Terms. No signature is needed for it to apply.

**1.3** A Customer that needs a countersigned copy can write to [support@sozai.app](mailto:support@sozai.app?subject=DPA) from an address of the organisation, giving its legal name and address. We return this version of the DPA signed by SozAI, without changes. We do not negotiate or accept changes to this DPA. Terms in a Customer's purchase order, procurement portal or own data processing agreement do not bind SozAI unless SozAI signs that document.

**1.4** This DPA does not cover:

1. personal, non-business use of SozAI;
2. the free tools and the public transcript library on the sozai.app website, which work without an account and use the separate partners listed on the [Sub-processor Page](https://sozai.app/subprocessors/);
3. third-party services that a User connects to their SozAI account. Those services receive data as recipients chosen by the Customer and its Users, not as SozAI's sub-processors.

## 2. Definitions

In this DPA:

1. **"Account Data"** means the data SozAI processes as a controller under its [Privacy Policy](https://sozai.app/privacy/), described in Section 3.3.
2. **"Customer"** means the organisation that buys a Team or Education plan, or on whose behalf a SozAI account is used.
3. **"Customer Personal Data"** means personal data contained in the content that Users upload, record, paste or create in the Service on behalf of the Customer, which SozAI processes as a processor. It does not include Account Data.
4. **"Data Protection Law"** means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and any other data protection law that applies to the processing of Customer Personal Data under this DPA.
5. **"GDPR"** means Regulation (EU) 2016/679.
6. **"SCCs"** means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
7. **"Security Pages"** means [sozai.app/security/](https://sozai.app/security/) and [sozai.app/trust/security-questionnaire/](https://sozai.app/trust/security-questionnaire/), as updated.
8. **"Service"** means the SozAI apps for iPhone, iPad, Android and Mac, the web app at web.sozai.app, and the SozAI browser extensions when they are used with a SozAI account.
9. **"Sub-processor"** means a third party that SozAI engages to process Customer Personal Data.
10. **"Sub-processor Page"** means [sozai.app/subprocessors/](https://sozai.app/subprocessors/), as updated.
11. **"Terms"** means the SozAI [Terms of Service](https://sozai.app/terms/), as updated.
12. **"UK Addendum"** means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner and in force from 21 March 2022.
13. **"User"** means a person who uses the Service on behalf of the Customer, including the members a buyer invites to a Team or Education plan.

"Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR.

## 3. Roles of the parties

**3.1** The Customer is the controller of Customer Personal Data. Where the Customer acts as a processor for another controller, the Customer confirms that its controller has authorised the instructions in this DPA and the appointment of SozAI and its Sub-processors. SozAI deals only with the Customer, and the Customer passes on any information or notice to its controller.

**3.2** SozAI is a processor of Customer Personal Data on behalf of the Customer.

**3.3** SozAI is a controller of Account Data and processes it under its [Privacy Policy](https://sozai.app/privacy/). Account Data includes the identity of each account (name, email address, sign-in method), subscription and billing records, usage counters such as minutes transcribed, support conversations, data used for security and abuse prevention, and the app analytics described in the Privacy Policy. Payments are handled by Polar, the merchant of record for web purchases, and by Apple and Google for purchases in their stores, each under its own terms.

**3.4** Each party complies with the Data Protection Law that applies to it.

## 4. Customer responsibilities

**4.1 Lawful basis.** The Customer is responsible for having a lawful basis for the processing of Customer Personal Data and for the instructions it gives, and for giving data subjects the information that Data Protection Law requires.

**4.2 People who are recorded.** The Customer is responsible for informing every person who is recorded, or whose voice or personal data appears in content Users upload, and for obtaining any consent that the law requires, including under laws on recording conversations. The Service does not notify meeting participants by itself. SozAI does not give legal advice.

**4.3 Special categories of data.** The Service is not designed for special categories of personal data (Article 9 GDPR), data about criminal convictions and offences (Article 10 GDPR) or other data that needs heightened protection. If Users upload such data, that is the Customer's decision and the Customer's responsibility, including any impact assessment. SozAI is not designed for health data, is not HIPAA compliant and does not sign a Business Associate Agreement (BAA). Users must not upload protected health information.

**4.4 Users and their accounts.** The Customer is responsible for the people it invites or allows to use the Service on its behalf, for their compliance with the Terms (including the age rules), and for removing seats when people leave. Each User has their own SozAI account and library. The Service has no administrator console, the Customer cannot see Users' libraries through the Service, and SozAI does not separate business content from a User's personal content in the same account. The Customer instructs its Users to export or delete Customer Personal Data before a seat is removed or a person leaves.

**4.5 Suitability.** The Customer has reviewed the measures in Annex II and the Security Pages and has decided that they are appropriate for the Customer Personal Data it will process with the Service.

**4.6 Claims caused by the Customer.** If a data subject, supervisory authority or other third party brings a claim against SozAI that results from the Customer's breach of this Section 4, the Customer is responsible for that claim and reimburses SozAI's reasonable costs of dealing with it.

## 5. Processing on instructions

**5.1** SozAI processes Customer Personal Data only on the Customer's documented instructions. The instructions are the Terms, this DPA, and the Customer's and its Users' use and configuration of the Service: uploading or recording content, choosing features such as transcripts, summaries, notes, quizzes, flashcards, translations and chat, giving or withdrawing the account's consent to AI features, exporting and deleting. These are the Customer's complete instructions on the effective date. Any additional instruction needs SozAI's written agreement, and SozAI may charge for it.

**5.2** SozAI may also process Customer Personal Data where a law to which SozAI is subject requires it. In that case SozAI tells the Customer before processing, unless that law prohibits this on important grounds of public interest.

**5.3** SozAI tells the Customer if, in its opinion, an instruction infringes Data Protection Law. SozAI is not obliged to carry out a legal review of the Customer's instructions, and may suspend the processing concerned until the Customer confirms or changes the instruction.

**5.4** SozAI processes Customer Personal Data to provide, maintain, secure and support the Service for the Customer and its Users, including fixing faults and preventing abuse. SozAI does not sell Customer Personal Data, does not use it for advertising and does not use it to train or improve AI models.

## 6. Confidentiality and personnel

Everyone SozAI authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law. They access it only as far as needed to run the Service, deal with a problem a User reports, or comply with the law. SozAI does not open the content of a User's recording except for those purposes or when the User asks, for example in a support request.

## 7. Security

**7.1** SozAI applies the technical and organisational measures described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to data subjects.

**7.2** SozAI may change these measures over time, provided the overall level of protection is not materially reduced. Annex II describes the measures on the effective date. The current description is on the Security Pages.

**7.3** The Customer is responsible for the security of its Users' devices, their Google, Apple and email accounts used to sign in, and any content Users export or share outside the Service.

**7.4** SozAI holds no security certification and no audit report of its own. The ISO/IEC 27001 certificate mentioned in Annex II belongs to SozAI's hosting provider.

## 8. Sub-processors

**8.1 Authorisation.** The Customer gives SozAI a general written authorisation to engage Sub-processors. The Sub-processors on the effective date are listed in Annex III. The Sub-processor Page is the current list.

**8.2 Terms with Sub-processors.** SozAI engages each Sub-processor under a written agreement, which may be the Sub-processor's standard data processing terms, that imposes data protection obligations giving the protection required by Article 28(3) GDPR, as far as they apply to the service that Sub-processor provides. SozAI remains responsible to the Customer for its Sub-processors' performance of their data protection obligations, subject to Section 14.

**8.3 Notice of a new Sub-processor.** SozAI updates the Sub-processor Page, and the date at its top, at least 14 days before a new Sub-processor starts to process Customer Personal Data. A Customer that wants this notice by email writes to [support@sozai.app](mailto:support@sozai.app?subject=Sub-processor%20updates) with the subject "Sub-processor updates"; SozAI then emails that address whenever it updates the page. Otherwise the Customer is responsible for checking the page.

**8.4 Urgent replacements.** Where SozAI has to replace a Sub-processor or add one at short notice to protect security or to keep the Service working, for example because a Sub-processor or an AI model stops being available, fails, or changes its terms, SozAI may do so before the 14 days have passed. It then updates the Sub-processor Page as soon as reasonably possible, and the 14-day objection period in Section 8.6 runs from that update.

**8.5 What is not a new Sub-processor.** These are not new Sub-processors: a change in which model of a listed provider handles a task; the hosts and suppliers that a listed Sub-processor uses for its own service; and services that handle only Account Data.

**8.6 Objections.** The Customer may object to a new Sub-processor within 14 days after the notice, in writing to support@sozai.app, on reasonable grounds relating to data protection, explaining those grounds. SozAI will discuss the objection in good faith and may propose a change, such as a way to use the Service without the feature concerned. If SozAI cannot reasonably accommodate the objection within 30 days after receiving it, the Customer may terminate the affected plan or subscription by written notice. That is the Customer's sole and exclusive remedy. SozAI then refunds the fees the Customer prepaid on the web (through Polar) for the unused part of the paid period after termination, pro rata. For this case only, this Section overrides the [Refund Policy](https://sozai.app/refund-policy/), which otherwise does not refund unused parts of a period. Purchases in the App Store or Google Play are refunded only by Apple or Google under their own rules. If the Customer does not object within 14 days, it is treated as having accepted the new Sub-processor.

**8.7 Copies.** On the Customer's request SozAI provides a copy of, or a link to, the data protection terms it has with a Sub-processor. SozAI may remove commercial information first. Where those terms are public, a link is enough.

## 9. International transfers

**9.1 Where the data is.** Customer Personal Data is stored on servers in Germany. VAST FLOW is established in Kazakhstan, for which the European Commission has made no adequacy decision, and runs the Service from there. Some Sub-processors process data in the United States or on global networks, as Annex III shows. SozAI's access to Customer Personal Data from outside the EEA is treated as a transfer.

**9.2 EU Standard Contractual Clauses.** For Customer Personal Data subject to the GDPR, the SCCs are incorporated into this DPA by reference, with the Customer as data exporter and SozAI as data importer, as follows:

1. Module 2 (controller to processor) applies where the Customer is a controller. Module 3 (processor to processor) applies where the Customer is a processor.
2. Clause 7 (docking clause) applies.
3. Clause 9(a): Option 2 (general written authorisation) applies, with the time period of 14 days set out in Section 8.
4. Clause 11(a): the optional language does not apply.
5. Clause 13(a): where the Customer is established in an EU Member State, the supervisory authority of that Member State is competent. Where the Customer is not established in the EU but falls under Article 3(2) GDPR and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State where the representative is established is competent. Where the Customer has no such representative, the supervisory authority of the Member State in which the data subjects concerned are located is competent.
6. Clause 17: Option 1 applies. The SCCs are governed by the law of Germany.
7. Clause 18(b): disputes are resolved by the courts of Germany.
8. Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

**9.3 Acceptance.** By accepting the Terms for business use, the parties are treated as having signed the SCCs, including their annexes, as completed in this DPA.

**9.4 How the SCCs are carried out.** Section 8 describes how the parties perform Clause 9 of the SCCs, Section 10 how they perform Clause 8.6, Section 11 how they perform Clause 10, Section 12 how they perform Clause 8.9, and Section 13 how they perform Clauses 8.5 and 16(d). Where any of these Sections conflicts with the SCCs, the SCCs prevail.

**9.5 United Kingdom.** For Customer Personal Data subject to the UK GDPR, the UK Addendum is incorporated into this DPA by reference. Table 1: the parties and their details are as in Annex I. Table 2: the Addendum EU SCCs are the SCCs as incorporated in Section 9.2, with the modules and options selected there. Table 3: the Appendix Information is in Annexes I, II and III. Table 4: the importer may end the UK Addendum as set out in its Section 19. The Mandatory Clauses of the UK Addendum apply.

**9.6 Switzerland.** For Customer Personal Data subject to the FADP, the SCCs as incorporated in Section 9.2 apply with these adaptations: references to the GDPR are read as references to the FADP where the transfer is governed by the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers, in parallel with the authority under Section 9.2 where the GDPR also applies; and the term "Member State" in Clause 18(c) does not prevent data subjects in Switzerland from bringing claims where they habitually reside.

**9.7 Onward transfers.** When SozAI transfers Customer Personal Data to a Sub-processor outside the EEA, the UK or Switzerland, it relies on a transfer mechanism recognised by Data Protection Law, such as standard contractual clauses in the Sub-processor's data processing terms or the Sub-processor's certification under the EU-U.S. Data Privacy Framework where it is certified.

**9.8 Requests from public authorities.** If a public authority asks SozAI for Customer Personal Data, SozAI follows Clause 15 of the SCCs. SozAI will answer the Customer's reasonable questions about the laws of Kazakhstan that matter for the Customer's assessment under Clause 14.

**9.9 Changes to transfer mechanisms.** If a transfer mechanism in this Section is replaced, amended or held invalid, SozAI may adopt another mechanism recognised by Data Protection Law, such as a new version of the standard contractual clauses, by updating this DPA under Section 16.

## 10. Personal data breaches

**10.1** SozAI notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. SozAI aims to send that notice within 72 hours after confirming the breach.

**10.2** The notice gives the information available at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned where known, its likely consequences, the measures taken or proposed, and a contact point. Where the information is not available at once, SozAI provides it in stages as the investigation develops.

**10.3** SozAI sends the notice to the email address of the account that bought the Customer's plan, or of the Customer's account, and to any security contact the Customer has given in writing to support@sozai.app. The Customer keeps these contacts up to date.

**10.4** SozAI takes reasonable steps to contain the breach, investigate it and reduce its effects.

**10.5** The Customer decides whether to notify supervisory authorities and data subjects, and makes those notifications. SozAI does not notify them on the Customer's behalf unless the law requires it.

**10.6** A notice under this Section is not an admission of fault or liability by SozAI.

**10.7** Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, failed sign-in attempts and requests blocked by SozAI's network, are not personal data breaches.

## 11. Help with data subject requests and assessments

**11.1 Self-service tools.** The Customer and its Users answer data subject requests with the tools in the Service. A User can open and export transcripts in the formats the apps offer (for example PDF, TXT, SRT, VTT or JSON in the iPhone and Android app, and TXT, SRT or VTT on web.sozai.app), correct transcript text in the iPhone and Android app, rename speakers in the iPhone and Android app and on the web, delete any recording, and delete the whole account.

**11.2 Requests sent to SozAI.** If a data subject sends SozAI a request about Customer Personal Data, SozAI tells the data subject to contact the Customer and, where SozAI can identify the Customer, tells the Customer without undue delay. SozAI does not answer the request itself unless the Customer authorises it or the law requires it.

**11.3 Further help.** Where the tools are not enough, SozAI gives reasonable help on the Customer's written request, taking into account the nature of the processing and the information available to SozAI.

**11.4 Impact assessments and authorities.** SozAI helps the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to SozAI. It does this by making available this DPA and its annexes, the Security Pages and the Sub-processor Page, and by answering reasonable written questions. SozAI cooperates with supervisory authorities as the law requires.

**11.5 Costs.** Help that goes beyond the self-service tools and the published documents is at the Customer's cost, at charges SozAI tells the Customer in advance, unless the need for it results from SozAI's breach of this DPA.

## 12. Audits and information

**12.1 Information first.** SozAI makes available the information needed to demonstrate its compliance with Article 28 GDPR and this DPA through:

1. this DPA and its annexes;
2. the Security Pages and the Sub-processor Page;
3. written answers to one reasonable security or privacy questionnaire per Customer in any 12 months, or more often after a personal data breach affecting the Customer or when a supervisory authority requires it. Where the published security questionnaire already answers a question, SozAI may refer to it.

**12.2 When an audit is possible.** An audit or inspection by the Customer or by an independent auditor it appoints takes place only:

1. when a supervisory authority with jurisdiction over the Customer requires it;
2. after a personal data breach that affected the Customer's Customer Personal Data; or
3. where the Customer shows in writing that the information in Section 12.1 is not sufficient to demonstrate SozAI's compliance with the SCCs, as far as the SCCs give the Customer that right.

**12.3 Conditions.** An audit under Section 12.2:

1. takes place at most once in any 12 months, unless a supervisory authority requires more or a new breach occurs;
2. needs 30 days' written notice to support@sozai.app, with the proposed scope, date and auditor;
3. takes place during business hours in Kazakhstan and is carried out remotely first, through documents and video calls, because SozAI keeps no Customer Personal Data on premises of its own;
4. is carried out by the Customer or by an independent auditor that is not a competitor of SozAI, and both sign a confidentiality agreement with SozAI before it starts;
5. gives no access to other customers' data, to SozAI's trade secrets beyond what the audit needs, or to systems in a way that could put their security or availability at risk;
6. is at the Customer's cost. The Customer bears its own and its auditor's costs and reimburses SozAI's reasonable costs, including the time of its personnel, at charges SozAI tells the Customer in advance;
7. results in a report that the Customer shares with SozAI and treats as SozAI's confidential information.

**12.4 Sub-processors.** SozAI cannot give access to its Sub-processors' premises. Audits of Sub-processors are carried out through the certifications, reports and terms the Sub-processors make available.

**12.5** This Section sets out how the parties have agreed to carry out the audit rights in Clause 8.9 of the SCCs, as far as the SCCs allow.

## 13. Deletion and return

**13.1 Deletion at any time.** Users can delete Customer Personal Data themselves at any time in the Service. Deleting a recording removes its audio file and everything generated from it from SozAI's live systems right away: the transcript, summary, notes, flashcards, quizzes, translations and chat messages. Notes a User wrote themselves from that recording, and an empty chat thread, stay until the User deletes them. Deleting an account removes everything that belongs to it.

**13.1a Audio retention setting.** Each account can also choose how long audio stays on SozAI's servers after transcription: kept until deleted (the default), 30 days, or deleted as soon as the transcript is ready. The choice applies to recordings transcribed after it is made. Transcripts and everything made from them are not affected by it.

**13.2 Return.** The Customer obtains a copy of Customer Personal Data by having its Users export transcripts with the export options described in Section 11.1. SozAI does not provide other export formats.

**13.3 When business use ends.** When a Team or Education plan or other business use ends, SozAI does not delete data automatically, because each User's account continues under the Terms. The Customer chooses deletion or return, either through its Users using the tools above or by a written request to support@sozai.app that names the accounts or recordings concerned and confirms that they hold Customer Personal Data. SozAI carries out such a request within 30 days for accounts used only on behalf of the Customer, or with the User's confirmation where an account also holds the User's personal content.

**13.4 Backups.** The database (transcripts, notes, account data) is backed up every night in encrypted form. SozAI keeps 14 daily, 8 weekly and 12 monthly copies, so deleted database content can remain in an encrypted backup for up to 12 months, and is removed as each copy expires on that schedule. Until then the backups stay encrypted, are not used for any other purpose, and are restored only to recover the Service. If SozAI restores a backup into the live system, it takes reasonable steps to delete again the data that had been deleted before the restore. Audio files are not in these backups.

**13.5 Sub-processors.** Data a Sub-processor has received follows that Sub-processor's own retention terms. In particular, deleting in SozAI does not yet send a deletion request to AssemblyAI, so the copy it processed follows AssemblyAI's own retention terms. The AI model providers listed in Annex III receive text per request and handle it under their own terms.

**13.6 Recordings on a Mac.** Meetings recorded in the Meeting mode of the SozAI Mac app are transcribed on the Mac, and only the text is saved to the account. The app deletes the audio file from the Mac once the text is saved to the account.

**13.7 Retention required by law.** SozAI may keep Customer Personal Data where a law to which it is subject requires it, only for that purpose and protected under this DPA.

**13.8 Confirmation.** On the Customer's written request, SozAI confirms in writing what it has deleted and the date by which the backups described in Section 13.4 will have expired.

## 14. Liability

**14.1** Each party's liability arising out of or related to this DPA, including the SCCs to the extent permitted by Data Protection Law and the SCCs, is subject to the limitations and exclusions of liability in the "Limitation of Liability" section of the Terms, as far as they apply to that party. Those limits apply to the Terms and this DPA together, not separately to each.

**14.2** This DPA does not make either party's liability uncapped. Nothing in it limits a data subject's rights under Article 82 GDPR or under Clause 12 of the SCCs where those rights cannot be limited by law. Where the SCCs require, Clause 12 applies as written.

**14.3** SozAI is not responsible for processing carried out in line with the Customer's instructions, or for harm resulting from the Customer's breach of Section 4, from acts of Users, or from content Users export or share outside the Service.

## 15. Order of precedence

For matters of data protection only, the SCCs (with the UK Addendum and the Swiss adaptations where they apply) prevail over this DPA, and this DPA prevails over the Terms. In all other matters the Terms govern.

## 16. Term, changes and contact

**16.1 Term.** This DPA applies from when Section 1.2 is met until SozAI no longer processes Customer Personal Data, including in backups. Sections that by their nature should continue after that, such as Sections 13 and 14, continue.

**16.2 Changes.** SozAI may update this DPA to reflect changes in law, guidance or decisions of authorities, new versions of transfer mechanisms, changes of Sub-processors, or to correct or clarify it. SozAI publishes each version on this page with a new version number and date, and tells Customers about material changes by email or in-app notification as the Terms provide. A change that materially reduces the protection of Customer Personal Data does not apply to an existing Customer before the end of its current paid subscription period. A change that the law requires applies when the law requires it. Changes of Sub-processors follow Section 8 only. Earlier versions are available on request.

**16.3 Governing law.** This DPA is governed by the law that governs the Terms, except that the SCCs, the UK Addendum and the Swiss adaptations are governed as set out in Section 9.

**16.4 Contact.** VAST FLOW, TOO, Office 29, 21/20 Askarov Street, Almaty, Kazakhstan. Email: [support@sozai.app](mailto:support@sozai.app?subject=Privacy), with "Privacy" or "Security" in the subject.

## Annex I. Description of the processing

### A. List of parties

| Role | Details |
| --- | --- |
| Data exporter | The Customer. Name and address as given in its account, its Polar billing details or a countersigned copy of this DPA. Contact: the email address of the account that bought the plan, or of the Customer's account. Activities: use of the Service. Role: controller (Module 2) or processor (Module 3). Signature and date: by accepting the Terms for business use. |
| Data importer | VAST FLOW, TOO, Office 29, 21/20 Askarov Street, Almaty, Kazakhstan, publisher of SozAI. Contact: support@sozai.app. Activities: providing the Service. Role: processor. Signature and date: by publishing this DPA and making the Service available under it. |

### B. Description of the transfer

| Item | Description |
| --- | --- |
| Categories of data subjects | Users; people whose voice, image or personal data appears in audio, video, files, PDF pages or photos that Users upload or record, such as meeting participants, interviewees, students, lecturers and the Customer's clients; people mentioned in that content. |
| Categories of personal data | Audio and video recordings and files; YouTube links Users submit; transcripts with speaker labels and timestamps; speaker names Users assign; summaries, notes, tasks, quizzes, flashcards, mind maps and translations generated from them; chat messages with the assistant; PDF pages and photos added as sources and the text read from them; titles, folders and notes Users write; the account identifier and email address linked to that content. |
| Special categories | None intended. If the Customer decides that Users will upload them (Section 4.3), the measures in Annex II apply and no additional restrictions are offered. |
| Frequency of the transfer | Continuous, as Users use the Service. |
| Nature of the processing | Hosting and storage; speech recognition with speaker labels and timestamps; AI processing of transcript text and added sources to produce summaries, notes, quizzes, flashcards, translations, titles and chat answers; reading text from PDF pages and photos; transmission, display, export and deletion; push notifications; support. |
| Purpose | Providing the Service to the Customer and its Users, support, security and abuse prevention. |
| Duration and retention | For as long as the Service is used on behalf of the Customer, and until the data is deleted as described in Section 13: in live systems until a User deletes it, in encrypted database backups for up to 12 months after that, and at Sub-processors under their own retention terms. |
| Transfers to Sub-processors | As listed in Annex III, for the task each Sub-processor performs and for as long as that task needs. |

### C. Competent supervisory authority

Determined under Clause 13 of the SCCs as set out in Section 9.2(5), with the adaptations for the UK and Switzerland in Sections 9.5 and 9.6.

## Annex II. Technical and organisational measures

These are the measures in place on the effective date. The Security Pages describe the current measures.

| Area | Measure |
| --- | --- |
| Hosting and location | The database and the audio files are stored on servers at Hetzner in Germany. Hetzner's data center parks are certified to ISO/IEC 27001:2022. That certificate is Hetzner's; SozAI has no certification of its own. |
| Encryption in transit | Every connection from the apps, the web app and the extensions uses HTTPS (TLS 1.2 or 1.3). The API sends HSTS. Cloudflare sits in front of SozAI's domains, so traffic is decrypted at Cloudflare's edge and encrypted again on the way to SozAI's servers. |
| Encryption at rest | SozAI does not add disk or volume encryption on its servers. The nightly database backups are encrypted on the server before they leave it, with a key held by SozAI. |
| Backups and recovery | The database is backed up every night to Cloudflare R2, keeping 14 daily, 8 weekly and 12 monthly copies. Once a month the latest backup is restored and checked for integrity. Audio files are kept on a separate storage volume and are not part of these backups. |
| Sign-in | SozAI has no passwords. Users sign in with Google, with Apple, or with a six-digit code sent by email and valid for three minutes. The web app always requires sign-in. SozAI has no separate two-factor option; two-factor sign-in on the User's Google or Apple account also protects the SozAI sign-in. |
| Abuse protection | Limits on sign-up, sign-in and code requests protect accounts against automated abuse. |
| Administrative access | The database administration interface and the superuser API are not reachable from the internet. SozAI personnel reach them only over an encrypted SSH connection. |
| Personnel | Access to production systems is limited to SozAI personnel who need it to run the Service, each bound by confidentiality (Section 6). |
| Data minimisation | For a YouTube link, only the link and instructions go to the Gemini API, not audio. AI features receive transcript text and any PDF pages or photos the User adds, not audio. AI notes need the account's consent to AI features. Meetings recorded in the Meeting mode of the Mac app are transcribed on the Mac and only the text is uploaded. |
| Deletion | Users delete a recording, with everything generated from it, or the whole account, themselves in any app or on the web. When an account that used Sign in with Apple is deleted, SozAI also revokes the Apple sign-in token. Backup and Sub-processor retention is described in Section 13. |
| Sub-processor management | Sub-processors are engaged under written terms (Section 8.2), listed publicly on the Sub-processor Page and added with 14 days' notice (Section 8.3). |
| Vulnerability reports | Security problems can be reported to support@sozai.app with "Security" in the subject. SozAI usually replies within a working day. |
| Help for the controller | Self-service tools for access, export, correction and deletion (Section 11.1); published security documentation; written answers to questionnaires (Section 12.1). |
| Not offered | No SOC 2 report and no certification of SozAI's own; no single sign-on (SAML or OIDC); no team administration console, admin roles or audit logs; no customer-managed encryption keys; no HIPAA compliance and no BAA. |

## Annex III. Sub-processors

Sub-processors of Customer Personal Data on the effective date. The [Sub-processor Page](https://sozai.app/subprocessors/) is the current list and links to each company's privacy terms.

| Sub-processor | What it processes | Location |
| --- | --- | --- |
| Hetzner Online | Storage of the database and the audio files; the servers that run the Service | Germany |
| Cloudflare | All web traffic to SozAI's domains (network, TLS); storage of the encrypted database backups (R2) | Global network; backups in Cloudflare R2 |
| AssemblyAI | The audio of uploaded files and recordings, for speech recognition with speakers and timestamps | United States |
| Google (Gemini API) | The YouTube link and SozAI's instructions; no audio from Users | Google (global) |
| OpenRouter | Transcript text, chat messages, and PDF pages or photos added as sources, passed to the model providers below | United States |
| Anthropic, Google and xAI (AI models through OpenRouter) | The same text, for the tasks assigned to each provider's model | Host chosen by OpenRouter per request |
| DeepSeek (AI model through OpenRouter) | The same text, only when the main model for a task fails | Host chosen by OpenRouter per request |
| Apple and Google speech recognition | Audio a User dictates into a note or speaks in Voice Translate in the phone app | The device's system speech service |
| Google Firebase (Cloud Messaging) | The device token and the text of each push notification | Google |
| Telegram | A User's support message and email, the app version and an excerpt of the recording the User writes about, only when the User contacts support from inside the app | Telegram (global) |

The other services on the Sub-processor Page (sign-in with Google and Apple, the App Store and Google Play, RevenueCat, Firebase Analytics, Meta App Events and Apple Ads attribution) handle Account Data, for which SozAI is the controller under its Privacy Policy. The partners of the free tools on the sozai.app website are outside this DPA (Section 1.4).

Updated October 27, 2026 By [Merey Tleugazin](https://sozai.app/about/merey/)

Answers

## Frequently asked questions

Do you sign a DPA?

Yes. Our standard DPA applies automatically to organisations that use SozAI for business once the Terms are accepted. If you need a signed copy, write to support@sozai.app and we return this version countersigned and unchanged. We do not negotiate edits.

Do you use Standard Contractual Clauses?

Yes. The DPA incorporates the EU Standard Contractual Clauses of June 2021 (Module 2, and Module 3 where you are a processor), the UK Addendum version B1.0 and the Swiss adaptations. They are needed because VAST FLOW, the company behind SozAI, is in Kazakhstan and some sub-processors are in the United States.

Where is data stored?

In Germany, on servers at Hetzner. Speech recognition runs at AssemblyAI in the United States, and AI features send transcript text to OpenRouter and the model providers behind it. The full list with locations is on our sub-processors page.

Can we audit SozAI?

Yes, within limits. Information comes first: our written answers, the security questionnaire and the security page. An on-site or third-party audit is possible at most once a year when a supervisory authority requires it, after a breach that affected your data, or where the SCCs require it, with 30 days' notice, under a confidentiality agreement and at your cost.

How do you tell us about new sub-processors?

We update our sub-processors page at least 14 days before a new sub-processor starts handling your data, except urgent replacements, which we announce as soon as we can. Write to support@sozai.app to get the notice by email. You can object on reasonable data protection grounds.

Do you sign a HIPAA BAA?

No. SozAI is not designed for health data, is not HIPAA compliant and does not sign a Business Associate Agreement. Do not upload patient information to SozAI.


---
This is the markdown twin of https://sozai.app/dpa/ — the same content, without the markup.
Published by SozAI (https://sozai.app). Reuse and quotation are allowed with attribution and a link back.
Machine-readable index: https://sozai.app/llms.txt · data API: https://sozai.app/api/