Data Processing Agreement

Last updated: March 31, 2026

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Processor: Genius Labs S.A.S., Bogota, Colombia ("Voice Capture", "we", "us")
• Controller: The entity or individual that has accepted the Voice Capture Terms of Service ("Customer", "you")

2. Scope and Purpose

This DPA governs the processing of personal data by Voice Capture on behalf of the Customer in connection with the Voice Capture survey transcription service. Personal data processed includes survey respondent transcription text and associated metadata (session IDs, timestamps, question identifiers).

Important: Audio recordings are processed in real-time via the OpenAI Whisper API and are NOT stored by Voice Capture. Only the resulting text transcriptions are retained. No biometric data is stored.

3. Data Processing Principles

• Purpose limitation: Data is processed solely to provide transcription and analysis services as instructed by the Customer.
• Data minimization: Only data necessary for transcription is collected. Audio is discarded after processing.
• Storage limitation: Transcriptions are retained until the Customer deletes the project or account. Upon account termination, data is deleted within 30 days.
• Integrity and confidentiality: Data is encrypted in transit (TLS 1.2+) and at rest. Access is restricted via Row-Level Security policies.

4. Sub-processors

Voice Capture uses the following sub-processors to deliver the service. The Customer consents to the use of these sub-processors:

5. Data Subject Rights

Voice Capture supports the Customer in fulfilling data subject requests under GDPR Articles 15-22:

• Right of access: Customers can export all data via Settings > Download my data.
• Right to erasure: Customers can delete their account and all data via Settings > Delete account.
• Right to data portability: Full data export in JSON/XLSX format is available.
• Right to rectification: Transcriptions can be edited or retranscribed from the dashboard.

6. Security Measures

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption at rest (Supabase managed)
• Row-Level Security (RLS) policies on all database tables
• JWT-based authentication with short-lived tokens
• Rate limiting on all API endpoints
• Stripe webhook signature verification
• CORS restrictions with allowlisted domains
• Regular security audits of database permissions

7. Data Breach Notification

Voice Capture will notify the Customer of any personal data breach without undue delay and in any event within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and remedial measures taken.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), Voice Capture ensures appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) with sub-processors located in the United States (OpenAI, Stripe, Railway). Supabase database hosting is located in the EU (Ireland).

9. Term and Termination

This DPA remains in effect for the duration of the Customer's use of Voice Capture services. Upon termination, Voice Capture will delete all Customer data within 30 days unless legal retention obligations apply (e.g., billing records retained for 7 years).

10. Governing Law

This DPA is governed by the laws of Colombia, supplemented by the EU General Data Protection Regulation (GDPR) where applicable to the processing of personal data of EU data subjects.

11. Contact

For questions about this DPA or to exercise data protection rights:
Email: hello@insightgenius.io
Entity: Genius Labs S.A.S., Bogota, Colombia