DATA PROCESSING AGREEMENT
Na Data Processing Agreement, ena wiliki rawarawa.
v1.2.1 · Tekivu mai na siga ni tabaki
Volai me rawa ni vakadonuya na nomu DPO ena dabe duadua. Na tikina kece, sub-processor, kei na taqomaki volai vakamatailalai. Na PDF sainitaki e taukena na ka tautauvata.
YALAYALA & ITAVI
O cei e cakava na cava, ena itukutuku i cei.
Ena ruku ni DPA qo, na Itaukei ni Veivoli e dauvakatulewa ni itukutuku ka qarava na Sageio me processor ena vuku ni Itaukei ni Veivoli. Na Sageio e qarava na itukutuku ni tamata wale ga me solia na qaravi e isema kina — veivakadewa ni soqoni ena gauna dina, veisautaki ni vosa ki na vola, kei na vakaraitaki — ka ena ruku ga ni ivakaro volai ni Itaukei ni Veivoli. Na DPA qo e tiki ni Subscription Agreement ena maliwa i rau na Sageio kei na Itaukei ni Veivoli; ke veicalati, na DPA e liu ena veika ni qaravi ni itukutuku ni tamata. E baleta na cakacaka kece ni qaravi e caka me baleta na platform ni Sageio.
ITUKUTUKU E QARAVI
Na ka keimami qarava, kei na vuna keimami rawa kina.
| Mataqali ni itukutuku | Inaki ni qaravi | Yavu ni lawa (GDPR Art. 6) | Maroroi |
|---|---|---|---|
| Rorogo ni soqoni | Veisautaki ni vosa ki na vola kei na veivakadewa ena gauna ni soqoni. | Art. 6(1)(b) — qaravi ni isema. | Veitalia me baleta na veisautaki ni vosa ki na vola ena gauna dina ka qaravi ena memory ga; sega ni volai ki na maroroi. Sega ni vakayagataki me vakavulici kina na model. |
| Volavola & veivakadewa ni soqoni | Maroroi kei na rawai mai vei ira na lewe ni vanua ni cakacaka ni Itaukei ni Veivoli. | Art. 6(1)(b) — qaravi ni isema. | Maroroi me yacova ni bokoci na Itaukei ni Veivoli se bokoci na account. |
| Ivakaraitaki & ka me caka | Vua ni soqoni buli mai na AI mai na volavola. | Art. 6(1)(b) — qaravi ni isema. | Muria na maroroi ni volavola. |
| Vakatakilakila ni account (yaca, email, itavi) | Vakadeitaki, curu ki na vanua ni cakacaka, kei na volai ni audit. | Art. 6(1)(b) — qaravi ni isema. | Gauna ni account kei na 30 na siga ni oti na sogo. |
| Itukutuku ni vanua ni cakacaka & vakayagataki | Qaravi ni iyaya, vakadodonu ni saumi, kei na tarovi ni veivakacacani. | Art. 6(1)(b) kei na Art. 6(1)(f) — inaki dodonu ena dei ni iyaya. | 12 na vula mai na kena buli. |
| Volavola ni audit | Vakadikevi ni taqomaki kei na vakaraici ni curu ni Itaukei ni Veivoli. | Art. 6(1)(f) — inaki dodonu ena taqomaki. | 12 na vula mai na kena buli. |
| Vakatakilakila ni saumi | Liutaki ni subscription. Na itukutuku ni payment card e qaravi mai na LemonSqueezy me Merchant of Record ka sega ni maroroi mai na Sageio. | Art. 6(1)(b) — qaravi ni isema. | Gauna ni account kei na 7 na yabaki me baleta na volavola ni vakacavacava. |
SUB-PROCESSORS
Na isemaisema taucoko ni qaravi.
| Sub-processor | Inaki | Vanua ni qaravi |
|---|---|---|
| Amazon Web Services | Maroroi ena cloud, maroroi ni object, liutaki ni ki ni vunitaki. | Yasayasa e digitaki na Itaukei ni Veivoli (ivakarau: Singapore, Asia-Pacific). EU kei na US ena ituvatuva Enterprise. |
| Neon | Database PostgreSQL liutaki me baleta na itukutuku ni app. | Yasayasa e salavata kei na yasayasa AWS taumada ni Itaukei ni Veivoli. |
| Vercel | Maroroi me baleta na website ni marisi kei na app ni web ki vei ira na itaukei ni veivoli. | Network edge vuravura. Vu: yasayasa e digitaki na itaukei ni veivoli. |
| Clerk | Vakadeitaki, single sign-on, kei na liutaki ni identity. | United States. |
| Deepgram | Veisautaki ni vosa ni soqoni ki na vola. | United States. |
| OpenAI | Veisautaki ni vosa ki na vola ena gauna dina ni rorogo ni soqoni (misini ivakarau me baleta na vanua ni cakacaka vou) kei na veisautaki ki na vola ni faili ni rorogo vakauti. | United States. |
| DeepL | Veivakadewa ni tiki ni volavola se vakarau kei na veivakadewa taumada me baleta na vosa e digitaki. | Germany (EU). |
| Google (Gemini API) | Vakavinakataki ni veivakadewa ni tiki ni volavola sa vakaoti; ivakaraitaki kei na ka me caka buli mai na AI. | United States. Data not used to train Google models per paid-tier Gemini API terms. |
| Resend | Vakauti ni email ni isema (tukutuku ni account kei na qaravi; email ni ivakaraitaki ni soqoni vakauti ena kerekere ni dautokai). | United States. |
Lemon Squeezy (a Stripe company) is not a sub-processor: as Merchant of Record it determines its own purposes for payment, tax, and invoicing, and acts as an independent data controller under its own privacy policy.
Plausible (cookieless website analytics) operates only on our marketing site and does not process platform personal data under this DPA; it is disclosed in the Privacy Policy.
IVAKABAUTA NI PROCESSOR
Article 28, volai ki na isema.
These commitments form part of the DPA. The English text is the authoritative version; localized translations will follow the signed-off text.
- Veisau ni sub-processor
- Sageio maintains the current sub-processor list at sageio.net/subprocessors. Sageio will give Customer at least 30 days' notice (by email or in-app notice) before adding or replacing a sub-processor. Customer may object on reasonable data-protection grounds within the notice period; if the parties cannot resolve the objection, Customer may terminate the affected services and receive a pro-rata refund of prepaid fees for the unused period. Sageio imposes data-protection obligations equivalent to this DPA on each sub-processor and remains liable for their performance.
- Tukutuku ni vakaleqai ni itukutuku ni tamata
- Sageio will notify Customer without undue delay, and in any event within 24 hours of confirming a personal-data breach affecting Customer personal data, and will provide the information reasonably required for Customer's obligations under Articles 33–34 GDPR, with updates as the investigation proceeds.
- Bokoci kei na lesi
- Upon termination or expiry of the services, Sageio will, at Customer's choice, delete or return all Customer personal data within 30 days, and delete remaining copies, except where applicable law requires retention. Personal data in encrypted backups is purged on the standard 30-day backup rotation cycle.
- Veivuke kei na audit
- Taking into account the nature of the processing, Sageio will assist Customer with appropriate technical and organizational measures in responding to data-subject requests, and with Customer's obligations under Articles 32–36 GDPR, including data-protection impact assessments and prior consultations. Sageio will make available information reasonably necessary to demonstrate compliance with Article 28 — including summaries of penetration tests and, when available, audit reports — and will allow audits, including inspections, by Customer or its mandated auditor, no more than once per twelve months, on 30 days' notice, at Customer's expense and subject to confidentiality.
- Vakavuni kei na ivakaro
- Sageio ensures that persons authorized to process personal data are committed to confidentiality. Sageio will inform Customer without undue delay if, in its opinion, an instruction infringes applicable data-protection law.
- Vakadeitaki ni Itaukei ni Veivoli
- Customer warrants that it has established a lawful basis for the processing it instructs under this DPA, including any notices to and consents from meeting participants required by applicable law and — where meeting content incidentally contains special categories of personal data — a condition under Article 9(2) GDPR. Sageio does not use meeting content to identify any person by voice and creates no biometric templates.
- Gauna, lawa ni liutaki, kei na itavi
- This DPA takes effect with, and lasts for the duration of, the Subscription Agreement; it is governed by the same law, and the limitations of liability in the Terms of Service apply to it, except where mandatory data-protection law provides otherwise.
IVAKATAGEDEGEDE NI TAQOMAKI
E sota na engineering kei na ivakabauta.
Sageio implements technical and organizational measures appropriate to the risk of processing, including encryption in transit (TLS 1.3) and at rest (AES-256-GCM), role-based access control, audit logging, regular penetration testing, and a documented incident response process. Production access requires explicit business justification, is time-bound, and is logged. The complete catalog of measures, including current compliance program status, is published on the Security page and updated as the program evolves.
VEISAUTAKI VAKAVURAVURA
Itukutuku veiyasayasa, toso vakalawa.
Where personal data is transferred outside the European Economic Area, the United Kingdom, or other jurisdictions with equivalent restrictions, Sageio relies on the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and, where applicable, the UK International Data Transfer Addendum. For transfers to jurisdictions covered by an adequacy decision, Sageio relies on that decision. Sub-processors are bound to equivalent obligations through contractual flow-down. Transfer impact assessments are conducted for each sub-processor processing personal data outside the data exporter's jurisdiction.
The SCCs (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum are incorporated into this DPA by reference. Annex I (parties; description of processing) is constituted by the parties' details and the "Data processed" table above, which may incidentally include special categories of data contained in meeting content; Annex II (technical and organizational measures) by the "Security measures" section; Annex III (authorized sub-processors) by the "Sub-processors" table. In case of conflict, the SCCs prevail.
DODONU NI DATA SUBJECT
Na dodonu ni nomu dautokai, na neimami itavi.
- Right of access — confirmation and a copy of personal data processed.
- Right to rectification — correction of inaccurate or incomplete data.
- Right to erasure — deletion within 30 days of a valid request, subject to legal retention requirements.
- Right to restriction — limitation of processing in defined circumstances.
- Right to data portability — export in a structured, machine-readable format.
- Right to object — including to processing based on legitimate interest.
- Right to lodge a complaint with the relevant supervisory authority.
VEIVOSAKI
Tamata dina, inbox vakayacani.
- Privacy: privacy@sageio.net
- Security: security@sageio.net
Sageio is operated by 好客網路股份有限公司 (Unified Business No. 29041135), a company registered in Taiwan. Registered address: No. 205, Hulin Street, Xinyi District, Taipei City, Taiwan (臺北市信義區虎林街205號). Privacy contact: privacy@sageio.net.
Itukutuku ni version
- v1.2.1June 14, 2026Gemini paid-tier confirmation completed (interim note removed); sub-processor commitment now points to the live /subprocessors page; Traditional Chinese translation of the processor commitments and SCC incorporation added.
- v1.2June 13, 2026Sub-processor table correction: OpenAI added (real-time speech-to-text, default engine for new workspaces); DeepL purpose extended to final translation for selected languages; Resend purpose includes meeting-summary emails; Gemini terms basis corrected to paid-tier API (confirmation in progress). Configurable-retention-window statements removed to match current system behavior.
- v1.1June 13, 2026Article 28 processor commitments added; sub-processor table expanded (DeepL, Resend); retention entries corrected to match system behavior; SCCs and UK Addendum incorporated with Annex mapping.
- v1.0Effective from publicationInitial publication.