Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between the customer and Byki.ai for the BYKI Stenografen service, and governs the processing of personal data carried out by Byki.ai on the customer's behalf under Article 28 of the EU General Data Protection Regulation (GDPR).

1. Parties and roles

The customer (the account owner) is the data controller. Byki.ai, the provider of BYKI Stenografen, is the data processor. The service is provided by Byki.ai. Contact details are available at byki.ai. Contact: the contact form.

2. Subject matter, duration, nature and purpose

The processing consists of a meeting bot joining the customer's online meetings after being admitted (and with consent), recording the meetings, transcribing them, generating meeting notes with a language model, and delivering the notes to the channels the customer has configured. The processing lasts for the duration of the service agreement, plus the retention and deletion periods in section 9. The purpose is solely to provide the BYKI Stenografen service to the customer.

3. Categories of data subjects and personal data

• Data subjects: the account owner and the participants in recorded meetings.
• Personal data: meeting audio (and video on plans that include video recording), transcripts and speaker labels, generated meeting notes, participant names and email addresses, and notes or comments added by the user.
• Billing identifier: organisation number — for a sole proprietorship a personal identity number — is stored with the payment provider Stripe and used only for invoicing and VAT.

4. Documented instructions

Byki.ai processes personal data only on the customer's documented instructions — as expressed in the service agreement and the customer's configuration in the app — unless processing is required by EU or Member State law, in which case Byki.ai informs the customer of that legal requirement before processing, unless the law prohibits it.

5. Confidentiality

Byki.ai ensures that every person authorised to process the personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

6. Security measures

Byki.ai implements appropriate technical and organisational measures, including: hosting in EU regions (see section 12), encryption in transit (TLS), access control, tenant isolation and an immutable audit log. OAuth tokens and integration secrets are encrypted in the database, and backups are encrypted.

7. Sub-processors

The customer grants a general authorisation for the sub-processors listed in Annex 1 to this DPA. The annex is the complete, named list; it is provided to the account owner on request and kept up to date. The public Sub-processors page shows the categories. Before Byki.ai starts using a new sub-processor, or replaces one, Byki.ai notifies the account owner actively by email a reasonable time in advance, giving the customer the opportunity to object. Byki.ai imposes the same data-protection obligations on each sub-processor and remains fully liable for their performance.

8. No use of data for AI or model training

Byki.ai never uses the customer's data to train AI or machine-learning models, and Byki.ai's own models learn nothing from the customer's data. For one of our speech-to-text and language-model providers, the provider's terms state that it has no knowledge of inputs and outputs and does not reuse them in any way; that statement does not apply to all of the provider's services (for example not to batch services). For other providers, their own terms apply.

9. Retention and deletion

Meeting notes and transcripts are retained for the text retention period of the plan the meeting was created on, and recordings (video and audio) for that plan's own — sometimes shorter — media retention period; the two periods are not always the same length. Currently: text 30 days on Starter, 90 days on Standard, 1 year on Plus, Business and Business Pro (Enterprise: as agreed); media 30 days on Starter, Standard and Business, 180 days on Plus and Business Pro (Enterprise: as agreed). The trial follows Starter's periods. Each meeting keeps the retention period that applied when it was created: after an upgrade the longer of that period and the new plan's applies, and a downgrade never shortens the retention of existing meetings. No plan retains meeting data longer than 1 year, and deletion happens automatically when the relevant period expires. On termination of the agreement or deletion of the account, Byki.ai deletes all personal data processed on the customer's behalf, unless EU or Member State law requires further storage.

10. Assistance with data-subject rights

Taking into account the nature of the processing, Byki.ai assists the customer with appropriate technical and organisational measures in fulfilling the customer's obligation to respond to data-subject requests (access, rectification, erasure, restriction, data portability, objection), and assists the customer in ensuring compliance with the obligations under Articles 32–36 GDPR, including notifying the customer without undue delay after becoming aware of a personal data breach.

11. Audit and information rights

Byki.ai makes available to the customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the customer or an auditor mandated by the customer, subject to reasonable prior notice.

12. Processing location

Byki.ai stores and runs the processing under this DPA in EU regions: hosting and database, backups, and speech-to-text and language models. The region of each other sub-processor is stated in Annex 1.

The region is not the only factor. Sub-processors' data processing agreements may allow the sub-processor and its authorised sub-processors to process content remotely where needed for security and service maintenance, and may provide for transfers within the sub-processor's group under the EU Standard Contractual Clauses. Sub-processors that belong to groups with a US parent company (for example Google and Microsoft, where the customer chooses those integrations, and Stripe for payments) process data under their own terms and the transfer mechanisms that apply to them. The regions above state where the processing is stored and run; they are not a guarantee that data is never accessed from elsewhere in the cases described here.

Annex 1 — Sub-processors

These are the sub-processors under section 7, by category. The named list — company name, address, function, categories of personal data and processing location — is provided to the account owner on request and kept up to date. Changes are notified actively by email under section 7.

← Back to start