Data Processing Agreement

When you use Capturly to record, store, or process personal data (for example, your guests’ audio and video), you act as the controller and Capturly acts as the processor. For our own account, billing, and marketing data, Capturly is the controller — see our Privacy Policy.

We process personal data only to provide the service and only on your documented instructions (including as set out in our Terms and this DPA).

• Subject & duration: for the term of your use of Capturly and until deletion or return as described below.
• Nature & purpose: hosting, storage, transmission, backup, and processing of recordings and session data to deliver the recording, cloud-backup, and multi-participant features.
• Data subjects: your hosts, guests, and other participants.
• Categories of data: identifiers (name, email), audio/video recordings and transcripts, and session/technical metadata.

• Process personal data only on your documented instructions.
• Ensure personnel authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (encryption in transit and at rest, access controls, and least-privilege access).
• Assist you, taking into account the nature of processing, in responding to data subject requests and in meeting your security, breach-notification, and data-protection-impact-assessment obligations.
• Not use the data to train machine-learning models or for advertising.

You authorize us to engage the subprocessors listed on our Subprocessors page. Each is bound by data-protection obligations no less protective than this DPA. We will provide a means to receive notice of new subprocessors and a reasonable opportunity to object.

We provide functionality and reasonable assistance to help you fulfill data subject requests — access, correction, deletion, restriction, and portability — including the in-product and public account-deletion paths described in our Privacy Policy.

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.

Where processing involves transferring personal data outside the EEA, UK, or Switzerland, we rely on appropriate safeguards — including the European Commission’s Standard Contractual Clauses and the UK Addendum — as further described in our Privacy Policy.

On termination, we delete or return your personal data (at your choice), except where retention is required by law or by short-lived backup cycles that overwrite within a reasonable period. We make available information reasonably necessary to demonstrate compliance and will contribute to audits within agreed, reasonable bounds.

If your organization requires a countersigned DPA, email legal@capturly.app with your company name and we will execute one with you. Absent a separately signed agreement, this DPA applies to your use of Capturly to the extent you are subject to the GDPR, UK GDPR, or similar laws.