Voice Capture

    Data Processing Agreement

    Last updated: October 9, 2026

    1. Parties

    This Data Processing Agreement ("DPA") is entered into between:

    • Processor: Genius Labs S.A.S., Bogota, Colombia ("Voice Capture", "we", "us")
    • Controller: The entity or individual that has accepted the Voice Capture Terms of Service ("Customer", "you")

    2. Scope and Purpose

    This DPA governs the processing of personal data by Voice Capture on behalf of the Customer in connection with the Voice Capture survey transcription service. Personal data processed includes survey respondent transcription text and associated metadata (session IDs, timestamps, question identifiers).

    Important: Audio recordings are processed in memory in real time by a speech-to-text provider (Groq whisper-large-v3-turbo as primary, OpenAI gpt-4o-mini-transcribe as fallback) and are NOT stored by Voice Capture. Only the resulting text transcriptions are retained. No biometric data is stored.

    3. Data Processing Principles

    • Purpose limitation: Data is processed solely to provide transcription and analysis services as instructed by the Customer.
    • Data minimization: Only data necessary for transcription is collected. Audio is discarded after processing.
    • Storage limitation: Transcriptions are retained until the Customer deletes the project or account. Upon account termination, data is deleted within 30 days.
    • Integrity and confidentiality: Data is encrypted in transit (TLS 1.2+) and at rest. Access is restricted via Row-Level Security policies.

    4. Sub-processors

    Voice Capture uses the following sub-processors to deliver the service. The Customer consents to the use of these sub-processors:

    Sub-processorLocationPurposeData Processed
    SupabaseEU (Frankfurt, Germany — AWS eu-central-1)Database & AuthenticationUser accounts, transcriptions, project data
    Groq—Speech-to-text, primary (whisper-large-v3-turbo)Audio stream (in-memory only, NOT stored)
    OpenAIUSSpeech-to-text, fallback (gpt-4o-mini-transcribe)Audio stream (in-memory only, NOT stored)
    StripeUSPayment processingBilling data (no survey data)
    RailwayUSAPI hostingTransient request data
    Google AnalyticsUSWebsite analytics (optional)Anonymized usage data, consent-based

    5. Data Subject Rights

    Voice Capture supports the Customer in fulfilling data subject requests under GDPR Articles 15-22:

    • Right of access: Customers can export all data via Settings > Download my data.
    • Right to erasure: Customers can delete their account and all data via Settings > Delete account.
    • Right to data portability: Full data export in JSON/XLSX format is available.
    • Right to rectification: Transcriptions can be edited or retranscribed from the dashboard.

    6. Security Measures

    • TLS 1.2+ encryption for all data in transit
    • AES-256 encryption at rest (Supabase managed)
    • Row-Level Security (RLS) policies on all database tables
    • JWT-based authentication with short-lived tokens
    • Rate limiting on all API endpoints
    • Stripe webhook signature verification
    • CORS restrictions with allowlisted domains
    • Regular security audits of database permissions

    7. Data Breach Notification

    Voice Capture will notify the Customer of any personal data breach without undue delay and in any event within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and remedial measures taken.

    8. International Data Transfers

    Where personal data is transferred outside the European Economic Area (EEA), Voice Capture ensures appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) with sub-processors located in the United States (OpenAI, Stripe, Railway). Supabase database hosting is located in the EU (Frankfurt, Germany).

    Insight Genius LLC and Railway Corporation (API hosting) have a Data Processing Addendum signed by both parties, effective 9 October 2026. It incorporates the EU Standard Contractual Clauses, a UK Addendum and provisions for Switzerland.

    9. Term and Termination

    This DPA remains in effect for the duration of the Customer's use of Voice Capture services. Upon termination, Voice Capture will delete all Customer data within 30 days unless legal retention obligations apply (e.g., billing records retained for 7 years).

    10. Governing Law

    This DPA is governed by the laws of Colombia, supplemented by the EU General Data Protection Regulation (GDPR) where applicable to the processing of personal data of EU data subjects.

    11. Contact

    For questions about this DPA or to exercise data protection rights:
    Email: hello@insightgenius.io
    Entity: Genius Labs S.A.S., Bogota, Colombia