Data Processing Agreement

Scope

This agreement applies to business customers who process the personal data of other people (their employees, clients or call participants) through SubLive. For those customers we act as processor and they act as controller.

It does not apply to consumers using SubLive for their own purposes. In that case we are the controller and the Privacy Policy governs, not this document.

Subject matter and duration

Subject matter: real-time speech transcription and translation. Duration: the term of the customer agreement.

Nature and purpose: processing audio in memory to produce transcripts and translations, and storing transcripts where the Controller has enabled that.

Categories of data subjects: the Controller's users and anyone whose speech is processed through the service.

Categories of personal data: audio (transient), transcripts and translations (where enabled), account and usage metadata.

Records created inside the Controller account

Transcripts of conversations recorded inside the Controller account belong to the Controller, not to the individual member of staff who spoke. We hold them as processor and act on the Controller instruction.

If a member of staff deletes their SubLive account, we delete their personal data and their own private transcripts, and we anonymise their user record. Conversations recorded inside the Controller account are not deleted: deciding their fate is the Controller decision, not ours. The same applies when a member leaves or is removed from the Controller account.

A request from a data subject to erase such a conversation is therefore addressed to the Controller. We assist the Controller in answering it, and we delete the conversation on the Controller instruction or when the retention period set by the Controller expires, whichever comes first.

AI models the Controller connects (MCP access)

The Controller may connect its own AI model or agent to SubLive over the Model Context Protocol (MCP), using an API key issued to the Controller. When the Controller enables this, our tools return conversation metadata and, on an explicit request, the verbatim text of conversations, including the speech of the people the Controller's staff talk to.

The recipient of that data is the model the Controller chooses and connects. The Controller is the controller for that processing and answers for it. That model provider is the Controller's subprocessor, not ours: the Controller selects it, connects it to its own infrastructure and governs its terms. We are not a party to that arrangement and do not list the Controller's model on our Subprocessors page.

Every MCP call is made in the name of a specific person and is limited to the conversations that person may already see in the app; a member cannot reach a colleague's conversation over MCP that they could not open directly. Every read of conversation text over MCP is written to the audit log.

Each MCP response about a conversation carries its retention date. When a conversation reaches that date we delete it; a copy the Controller's model or agent has already kept, in a cache, a log or a store outside SubLive, is beyond our reach and is the Controller's to manage.

Tool descriptions mark conversation content as data, not as instructions to the model. We cannot stop a connected model from treating words spoken in a conversation as commands; guarding against that is a property of the Controller's own model and agent setup.

Processor obligations

• Process personal data only on documented instructions from the Controller.
• Ensure personnel with access are bound by confidentiality.
• Implement the technical and organisational measures described on the Security page.
• Engage subprocessors only as listed on the Subprocessors page, with 30 days notice of changes and a right to object.
• Assist the Controller with data subject requests, DPIAs and breach notification.
• Where the Controller connects its own AI model over MCP, serve each call only within the access rights of the individual making it, and log every read of conversation text.
• Retain transcripts created inside the Controller account for the Controller, and delete them on the Controller instruction or when the retention period the Controller has set expires.
• Delete or return personal data at the end of the agreement, except where retention is legally required.
• Make available the information necessary to demonstrate compliance and allow audits.

International transfers

Where a subprocessor processes data outside the EEA, transfers are governed by Standard Contractual Clauses (Commission Implementing Decision 2021/914), which are incorporated by reference.

Breach notification

We will notify the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting their data.