Legal
Data processing agreement
The Article 28 terms that apply when we process personal data on your instructions. They are in force whether or not anyone signs them.
No signature required
These terms apply to every customer automatically. Ask if you need a countersigned copy for your file.
Contents
- Scope and roles
- What we process, and for whom
- Our obligations as processor
- Sub-processors
- International transfers
- Security measures
- Assisting you
- Breach notification
- Deletion and return
- Audit
- Signing this
Last updated
Scope and roles
This agreement supplements the terms of service and applies whenever NeurTask processes personal data on your behalf. You are the controller. We, NeurTask, part of Gaddr AB, are the processor. Where the terms of service and this agreement conflict on data protection, this agreement wins.
What we process, and for whom
| Item | Detail |
|---|---|
| Subject matter | Recording, transcription and summarisation of meetings, and agent actions on the result |
| Duration | For as long as your account exists, plus the deletion window below |
| Categories of data subject | Your personnel, and anyone who speaks in a meeting you record |
| Categories of personal data | Names, email addresses, voice recordings, transcripts, summaries, calendar metadata |
| Special categories | None requested or required. Meeting speech may contain them incidentally, which is a reason to control what you record |
Our obligations as processor
- We process personal data only on your documented instructions, which the service settings form.
- We do not use your meeting content to train models, ours or anyone else’s.
- Everyone with access is bound by confidentiality obligations.
- We tell you if we believe an instruction breaches GDPR rather than following it quietly.
Sub-processors
You give general authorisation for the sub-processors listed on the sub-processors page. We give 30 days’ notice by email before adding one that touches meeting content. If you object on reasonable data protection grounds within those 30 days, you may terminate the affected part of the service and we refund the unused term.
International transfers
Speech-to-text and summarisation are performed in the United States. Those transfers rely on the European Commission’s standard contractual clauses, module two (controller to processor), which are incorporated here by reference. Enterprise deployments can be configured so that no meeting content leaves your infrastructure, which removes the transfer entirely.
Security measures
- Encryption in transit (TLS) and at rest for recordings, transcripts and summaries.
- Tenant isolation: meeting content is scoped to one workspace and not readable across them.
- Least-privilege access to production data, granted to named engineers rather than by default.
- Meeting content is never written to application logs.
- Secrets held outside source control, with rotation on personnel change.
We do not currently hold SOC 2 or ISO 27001 certification, and we do not claim measures we have not implemented. The security page lists the gaps.
Assisting you
We help you respond to data subject requests, and to carry out data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us. Requests reach us at privacy@neurtask.com.
Breach notification
We notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know at the time and what we are doing about it. We do not wait for a complete picture before telling you.
Deletion and return
On termination we delete your personal data within 30 days, except where law requires us to keep it. Before then you can export transcripts and summaries as text and recordings as audio. Ask if you need a bulk export and we will produce one.
Audit
We make available the information needed to demonstrate compliance with Article 28 and will answer security questionnaires. For an on-site audit, ask, and we will agree scope and timing. For Enterprise deployments an annual audit right can be written into the order form.
Signing this
These terms apply automatically. If your process needs a signed copy, email privacy@neurtask.com with your entity details and we will send one back countersigned within two working days.
Questions about this document: privacy@neurtask.com. All documents are listed on the legal index.