This instance hasn’t set its operator’s details (the LEGAL_* environment variables), so the bracketed placeholders below are not filled in.
Legal
Data Processing Agreement
Version 2026-10-14, effective 14 October 2026. Part of the Terms of Service; accepted when an organization is created.
This agreement (“DPA”) sets out how [operator name — set LEGAL_ENTITY_NAME] (“Processor”) processes personal data for the organization using Asincly (“Controller”), as required by Article 28 of the GDPR. It applies to the team content described in Annex 1; data we process as a controller is covered by the Privacy Policy. If this DPA and the Terms conflict on data protection, this DPA wins.
1. Instructions
We process the personal data only on the Controller’s documented instructions: these terms, the Controller’s configuration of Asincly (teams, retention, AI drafting, integrations), and any other written instruction we agree. We tell the Controller if we think an instruction breaks data protection law. We never use the data for our own purposes, to train AI models, or for advertising.
2. Confidentiality
Everyone we authorize to access the data is bound by confidentiality and accesses it only as needed to run and support the service.
3. Security
We maintain the technical and organizational measures in Annex 2 and keep them up to date with the state of the art.
4. Subprocessors
The Controller authorizes the subprocessors on the Subprocessors page. We email organization owners at least 30 days before adding or replacing one; the Controller may object on reasonable data-protection grounds within that time, and if we can’t resolve the objection, may end the affected service with a pro-rata refund. We impose the same data-protection obligations on each subprocessor and remain responsible for them.
5. International transfers
Where subprocessors process data outside the EU/EEA, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses (Commission Decision 2021/914, module 3 between us and the subprocessor), with supplementary measures where needed.
6. Helping the Controller
- Data subject requests: the product handles export, correction, deletion and AI opt-out; for anything else we help within a reasonable time and forward requests we receive directly.
- Impact assessments: we provide the information the Controller needs for a DPIA and prior consultation, including our DPIA template.
- Personal data breaches: we notify the Controller without undue delay and at the latest within 48 hours of becoming aware, with what we know and update it as we learn more.
7. End of the service
The Controller can export its data at any time. When an organization is deleted, its data is deleted from the database and storage straight away and from backups as they roll over, unless the law requires us to keep it.
8. Audits
We make available the information needed to show compliance with this DPA and Article 28, and allow audits by the Controller or an auditor it mandates, with reasonable notice, at most once a year unless a breach or a supervisory authority requires otherwise, and under confidentiality.
Annex 1 — Processing details
| Subject matter and purpose | Running asynchronous standups for the Controller's teams: collecting, showing, transcribing and summarizing check-ins, reminders and notifications |
| Duration | For as long as the Controller uses Asincly, then until deletion as in section 7 |
| Data subjects | The Controller's staff and other people it invites (members, admins, guests) |
| Personal data | Names, work email addresses, time zones; check-in text; video and audio recordings (image and voice); transcripts, AI summaries and drafts; replies, reactions, mentions; availability (away periods); activity timestamps |
| Special categories | None intended. Recordings show a person's image and voice; the Controller should tell staff not to include sensitive data |
| Location | Hosted in [hosting region — set LEGAL_DATA_REGION]; subprocessors as listed |
Annex 2 — Technical and organizational measures
Access control
- Postgres row-level security keyed on team membership on the request path; the owner connection is limited to reviewed code paths.
- Roles per team (owner, admin, member, guest); organization owner for billing and deletion.
- Optional TOTP two-factor authentication, which organizations can require for owners and admins; enforced Google SSO per domain.
- Session list with remote sign-out; sign-in links expire after one hour and work once.
Encryption
- TLS for all traffic.
- Transcripts, summaries, AI drafts, Slack tokens and 2FA secrets encrypted with AES-256-GCM, bound to their record, with key rotation.
- Recordings in private storage, uploaded directly from the browser and played back through links that expire within minutes; uploads are size-limited by signature.
Integrity, availability, resilience
- Rate limits on sign-in, uploads, AI processing and exports; strict Content-Security-Policy and security headers.
- Daily database backups; health monitoring; dependency vulnerability scanning.
- Audit log of administrative actions (role changes, exports, deletions, settings).
Data minimization and deletion
- Per-team recording retention; nightly purge of expired recordings and orphaned files; notifications kept 90 days.
- Personal data is kept out of application logs.
- AI processing can be switched off per team and per person.
Annex 3 — Subprocessors
As listed on Subprocessors, as amended under section 4.