Data Processing Agreement

Last updated: 15 October 2026

This agreement ("DPA") forms part of the agreement for EchoVerb (the "Service") between the business customer ("Customer", the controller) and Leading Edge AI, company number [NUMBER], 1 Hutton Close, South Church Enterprise Park, Bishop Auckland, County Durham, DL14 6XG ("Processor", "we"). It applies whenever we process personal data on the Customer's behalf. It meets Article 28 of the UK GDPR (and the EU GDPR where it applies).

1. Definitions

"UK GDPR", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have their meanings in the UK GDPR and the Data Protection Act 2018. "Customer Data" means personal data processed by us for the Customer through the Service.

2. What we process


Subject matter and duration	Providing the Service, for as long as the Customer uses it, plus the deletion period in section 10
Nature and purpose	Joining the Customer's online meetings with an AI bot to interpret, record, transcribe and summarise them; reading connected calendars to join meetings and coach organisers; storing and sharing meetings as the Customer's users direct
Types of personal data	Names, email addresses and organisation identifiers of the Customer's users; meeting participants' names, voices, images (when recording), what they say (transcripts, translations, notes); calendar meeting details (titles, times, invitees, replies, invitation text); sharing recipients' email addresses
Special category data	Not intended. The Service is not designed for it, but meeting content may include it if participants mention it; the Customer decides whether to use the Service in such meetings
Data subjects	The Customer's users; participants in the Customer's meetings (including the Customer's clients and partners); people invited to the Customer's calendar meetings; people meetings are shared with

3. Our obligations

We will:

Instructions: process Customer Data only on the Customer's documented instructions. These terms and the Customer's use and configuration of the Service are its instructions. We will tell the Customer if we believe an instruction breaks data protection law.
Confidentiality: ensure everyone authorised to process Customer Data is bound by confidentiality.
Security: apply the measures in Annex 1, and keep them up to date.
Sub-processors: use only the sub-processors listed at our sub-processor list and in section 5.
Data subject requests: help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects. If we receive a request directly, we will pass it to the Customer without undue delay and not respond ourselves unless instructed.
Compliance support: help the Customer with its security, breach-notification, impact-assessment and prior-consultation obligations, taking into account the information available to us.
Breaches: notify the Customer without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting Customer Data. We will give the information the Customer needs to meet its own obligations, and update it as we learn more.
End of service: delete Customer Data at the end of the Service as set out in section 10.
Audits: make available the information needed to demonstrate compliance, and allow and contribute to audits (section 9).
No AI training: not use Customer Data to train AI models, nor allow our sub-processors to.

4. The Customer's obligations

The Customer:

confirms it has a lawful basis for the processing it instructs;
will inform meeting participants that an AI is interpreting, recording or transcribing, as the Service's spoken announcement does unless the Customer switches it off;
will obtain consent where the law requires it;
is responsible for the accuracy of Customer Data and for its users' configuration choices: retention period, sharing, external webhooks and own storage.

5. Sub-processors

Approval: the Customer gives general authorisation for the sub-processors listed at our sub-processor list. We impose data protection obligations on each that are no less protective than this DPA, and we remain liable for their performance.
Changes: we will give at least 30 days' notice of a new or replacement sub-processor. The Customer may object on reasonable data protection grounds within that period. We will then work in good faith to resolve it; if we cannot, the Customer may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

6. International transfers

We may transfer Customer Data outside the UK/EEA only to the sub-processors listed, under appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified, with supplementary measures where needed.

7. Customer configuration that changes where data goes

The following are the Customer's choices and instructions, not our sub-processing:

Own storage: the Customer directs its recordings, transcripts and notes to its own storage bucket; in "exclusive" mode we then remove our copies.
Webhooks: the Customer sends finished notes to its own systems.
Sharing: the Customer's users share meetings by email or public link.
Premium voices: the Customer switches on premium voices (ElevenLabs).

8. Retention

Customer-set retention: recordings, transcripts, translations, notes and meeting preview pictures are deleted at the end of the Customer's retention period (default 30 days; 1–365 days, set by the Customer's owners).
Calendar meetings: deleted 2 days after each meeting.
Meeting records and usage: kept for the life of the account for usage and billing (names, dates, lengths, participant names).

9. Audits

Our evidence: we will answer reasonable security questionnaires and provide our security documentation.
On-site audit: where that is not enough to demonstrate compliance, the Customer (or an independent auditor bound by confidentiality) may audit us once a year on 30 days' notice, during business hours. The Customer bears its own costs.

10. Deletion and return

Return: within 30 days of the end of the Service, the Customer may export its data. We provide a full export on request.
Deletion: after that, we delete Customer Data, including from our sub-processors, within a further 30 days. Exceptions are anything we must keep by law, and backups, which are overwritten in their normal cycle.
Certificate: we will confirm deletion in writing on request.

11. Liability and precedence

Liability: liability under this DPA is subject to the limits in the main agreement, except where the law does not allow them.
Precedence: if this DPA conflicts with the main agreement on data protection, this DPA prevails.
Law: this DPA is governed by the law of England and Wales.

Annex 1: Security measures

Access and isolation

Each customer's data is separated by row-level security in the database as well as by the application. A query that omits a customer filter returns nothing; automated tests check this on every release.
Staff access is limited to named people, requires Microsoft sign-in, and every staff action on a customer account is recorded in an audit log.
Staff tools do not show meeting content.
Users sign in with Microsoft (including the Customer's single sign-on, which owners can make mandatory) or a one-time email code. There are no passwords to leak.
Owner and member roles; members see only their own meetings and those shared with them.

Encryption

TLS for all connections.
Encryption at rest for the database and storage.
Microsoft calendar refresh tokens are additionally encrypted with AES-256-GCM.

Data minimisation

Live interpreting audio is processed in memory and not stored unless recording is switched on.
Calendar data covers the next 24 hours only, and only online meetings.
Card data is held by Stripe only.

Sharing controls

Shared links are random, can be withdrawn, and can be switched off company-wide.
Email shares are one per recipient. Their tokens are stored only as hashes.

Retention

Automatic deletion at the end of the Customer's retention period.

Operations

Servers are in the UK (London) and the meeting bot runs in the EU (Frankfurt).
Security patching.

Annex 2: Sub-processors

As listed at our sub-processor list on the date of signature.

EchoVerb is a Leading Edge AI product · Leading Edge AI, 1 Hutton Close, South Church Enterprise Park, Bishop Auckland, County Durham, DL14 6XG