Data Processing Agreement

This Data Processing Agreement forms part of the Terms of Service between Mikhail Bovt, the individual operator of Vyach based in Singapore (Processor), and the customer determining the purposes of the meeting processing (Controller). If the customer itself processes data for another controller, it acts as a processor and Vyach as a subprocessor; it must have authority for these instructions. The identity of each party is determined by its service agreement, not merely by a Discord nickname.

Processor's contractual address: 5 Lor 26 Geylang, Singapore. Data-protection contact: inbox@vyach.app.

This DPA applies where data-protection law requires a controller-processor or processor-subprocessor agreement. It takes effect with the relevant service agreement and processing instructions. For conflicts concerning that processing, mandatory law and applicable transfer clauses prevail, then this DPA, then the service terms. It does not transfer a controller’s statutory responsibilities to a Payer or waive a data subject’s rights.

Personal Data, Controller, Processor, Processing, Personal Data Breach and Supervisory Authority have the meanings given by the applicable EU GDPR, UK GDPR or equivalent law. Customer Data is personal data processed to deliver the customer’s configured meeting features. A Subprocessor is another processor engaged by Vyach to process that data.

Account authentication, our own service security, support and necessary billing administration can involve independent controller processing described in the Privacy Policy. Discord supplies its own platform and Polar, Polar Software, Inc., is the sole Merchant of Record. Their transaction or platform activities are not automatically processing under this DPA. Polar does not receive meeting recordings or transcripts through the meeting-processing workflow.

The Controller instructs the Processor to receive consenting speakers’ audio, transcribe it, generate and deliver summaries, tasks and catch-up messages, index retained meeting text, answer meeting questions, enforce configured access and usage rules, export stored records and carry out retention and erasure. The service agreement, this DPA, bot commands and dashboard configuration together form documented instructions, including disclosure to the authorised recipients and providers listed below.

The Processor shall process Customer Data only on these instructions, including for international transfers, unless applicable law requires otherwise. It shall inform the Controller of that requirement before processing unless law prohibits notice. If an instruction appears unlawful, it shall promptly explain the issue and may suspend the affected processing while seeking clarification rather than execute the instruction.

The Processor shall not use Customer Data for advertising, sale, its own model training or fine-tuning. New material purposes or provider changes must follow lawful instructions and the safeguards in this DPA. Additional instructions beyond normal service capabilities require an appropriate written arrangement; their absence does not remove mandatory obligations.

The Controller must have a lawful basis, deliver required notices, satisfy applicable recording and employment laws, obtain valid permissions, honour withdrawals and rights requests, and configure appropriate channel access, question permissions, publication and retention. Technical consent does not establish that all local legal requirements are met, including requirements for minors or special-category data.

The Controller must protect its Discord accounts, delegates, exports and downloaded copies, and ensure that instructions from authorised users are lawful. The Payer manages billing only unless they have independent permissions. The Controller must not use a consenting account or bot to relay a non-consenting person’s speech, or ask Vyach to process regulated data requiring additional safeguards without an agreed lawful arrangement.

The Processor shall restrict Customer Data access to authorised people who need it for delivery, support, security or compliance and bind them to confidentiality or an applicable legal duty. Designated instance owners have cross-server administrative permissions; they are not limited by ordinary server membership. Access grants and operator duties must be considered when assessing confidentiality.

These obligations apply to people acting for the Processor and survive cessation of access where their purpose requires. They do not authorise use of private meeting content for unrelated purposes or disclosure to community members merely because those members provide informal support.

The Processor shall maintain measures appropriate to the risks, taking account of the state of the art, implementation costs, the processing and the rights of affected people. The implemented measures and deployment limits are described in Annex 2 and the Security Policy. The Processor shall assess material changes to their effectiveness and not materially reduce protection during processing under this DPA.

Publishing this DPA is not a claim of SOC 2, ISO 27001, HIPAA certification, end-to-end encryption or universal encrypted disks. Infrastructure-dependent measures must be confirmed for the actual deployment. The parties shall cooperate in addressing a risk that cannot safely be supported by the ordinary Service.

The Controller gives general written authorisation for the service providers identified in Annex 3, subject to the applicable contracts and lawful transfer arrangements. The Processor shall impose data-protection obligations that are appropriate to the processing and no less protective than the applicable requirements of this DPA, and remains responsible for its subprocessors’ performance to the extent required by law.

The Processor shall notify the Controller in writing of a proposed addition or replacement, ordinarily at least 30 days before new processing begins, using an agreed contact or service notice channel. The Controller may object within that period on reasonable data-protection grounds. The parties shall seek an alternative or additional safeguards; if they cannot resolve the issue, the Controller may terminate the affected processing before the change takes effect, with any required contractual or statutory financial remedy.

An emergency substitution required to prevent a serious outage or security threat must be communicated as early as practicable and does not remove the opportunity to object or mandatory transfer requirements. A generic cloud brand, model name or code configuration alone does not establish an executed subprocessor contract.

The Processor shall transfer Customer Data outside the EEA or UK only on lawful documented instructions and with a permitted transfer basis. Where required, the parties must complete the appropriate EU standard contractual clauses, including the applicable controller-to-processor or processor-to-processor module, and any required UK Addendum or IDTA, with accurate party details, annexes, assessments and supplementary measures.

The Processor shall make relevant transfer information available on request, subject to legitimate confidentiality redactions, and address lawful government-access requests as required by applicable safeguards. Notice will be given where legally permitted. No clause treats use of the Service as blanket transfer consent.

Our application and self-hosted speech processing are hosted in Beauharnois, Quebec, Canada. Cloudflare's global proxy and email network, the international DashScope service and OpenAI introduce separate recipient and onward-transfer assessments. Hosting in Canada does not make every recipient or processing activity subject to an adequacy decision.

The EU transfer clauses are the unmodified clauses in Commission Implementing Decision (EU) 2021/914. Where that decision applies, Module Two is used for a controller exporter and processor importer; Module Three is used for a processor exporter and subprocessor importer. The parties must first verify that the particular importer and processing fall within the decision's scope, including whether the importer is already subject to the GDPR for that processing. A module cannot be selected solely from the customer's or server's location.

For a transfer within that decision's scope, the following schedule is offered for incorporation into the parties' transfer agreement. It becomes effective when both parties agree to it in a signed or otherwise valid electronic agreement identifying the customer, its postal address, contact, legal role, authorised representative and acceptance date. Installing the bot alone does not complete that agreement. Request execution and the transfer assessment at inbox@vyach.app.

• Parties: the customer identified in that agreement is the exporter. The importer is Mikhail Bovt; the importer's address and contact are set out in the Parties section above.
• Module: Two for a controller customer, or Three for a processor customer authorised by its controller.
• Options: Clause 7 does not apply. Clause 9 uses general authorisation with 30 days' advance notice. The optional dispute-resolution language in Clause 11 does not apply.
• Law and courts: Clause 17 uses Option 1 and Irish law; Clause 18 specifies the courts of Ireland, preserving the clauses' rights for data subjects.
• Annexes: the party details in that agreement and Annex 1 below supply Annex I.A–B; the authority for Annex I.C follows Clause 13 and the exporter's applicable establishment or representative. Annex 2 below supplies Annex II. Annex 3 identifies authorised recipients; specific authorisation under Clause 9 is not selected.

The assessment must cover the actual destinations, government-access risks and supplementary measures before the transfer begins. Separate UK Addendum or IDTA arrangements and Swiss adaptations are agreed when required; this EU schedule alone does not claim to complete them. Mandatory SCC protections prevail over conflicting service terms.

Singapore's PDPA also requires appropriate protection for overseas transfers. The Processor shall assess the recipients' legally enforceable duties and other permitted safeguards; a customer's general acceptance of the Service does not replace that assessment.

Taking account of the nature of processing, the Processor shall provide appropriate technical and organisational assistance for access, correction, erasure, restriction, portability, objection and other applicable rights. It shall promptly tell the Controller about a request relating to Customer Data unless prohibited by law and shall not make unrelated disclosures on the Controller’s behalf without authority.

The customer authorises the built-in personal-erasure mechanism to act on a verified user’s request for data attributed to that user ID in the current server. Consent withdrawal and personal erasure do not require Payer approval. Whole-server exports require owner-level access and must not be given indiscriminately to an individual requesting only their own data. Further manual assistance remains available where a command does not cover the request.

The Controller retains responsibility for appropriate responses, legal deadlines and the rights of other participants. The Processor shall not rely on an automated queue or inability to match a name by user ID to extinguish a statutory right.

After becoming aware of a Personal Data Breach affecting Customer Data, the Processor shall notify the Controller without undue delay. The initial notice need not wait for a complete investigation. Available details will include the breach’s nature, affected categories and approximate numbers where known, a contact point, likely consequences, containment measures and proposed mitigation; further information will follow as available.

The Processor shall take proportionate containment and remediation steps and cooperate with the Controller concerning investigation, authority notifications and communications to affected people. A notification is not an admission of fault. The Controller remains responsible for its own legal duties, including any applicable 72-hour authority notification; that period is not permission for a processor to delay notice.

Send incident notices to inbox@vyach.app and use an agreed secure channel for incident evidence containing Customer Data.

The Processor shall provide reasonable assistance for security, breach obligations, data-protection impact assessments and prior consultation, taking account of the information available and the processing involved. It shall make information necessary to demonstrate compliance available and allow or contribute to legally required audits, including inspections by the Controller or an appropriate independent auditor.

Audits should normally be coordinated in advance, scoped to relevant processing, protect other customers and trade secrets, and avoid unnecessary service disruption. Reports and documentary evidence may be used first where adequate. Reasonable confidentiality, scheduling and cost arrangements may apply, but cannot prevent an authority’s powers, a legally required audit or urgent investigation of a material incident. Assistance required because of our breach will not be conditioned on an unreasonable fee.

The Controller may request return through the authenticated export workflow or instruct erasure. Ready archives expire after 24 hours and require valid tokens and current authorisation. On ending the relevant processing, the Processor shall delete or return Customer Data at the Controller’s choice and delete existing copies unless a lawful retention requirement applies; retained information must be isolated and used only for that requirement.

Removing the bot alone does not immediately erase data. In the ordinary workflow, removed-server deletion follows the configured inactivity period and any downgrade grace. An explicit full-server deletion requires cancellation of an ongoing subscription or checkout before service records are erased. Existing work and failed cleanup can cause retries; these mechanics do not expand lawful retention or remove the parties’ duties to address an overdue legal request.

Stored summaries, transcripts, digests, search indexes, participant and consent metadata are included in meeting erasure. A personal erasure preserves a minimal declined preference and independently necessary administration, rebuilds remaining transcript files and indexes, and invalidates affected private summaries and exports. Published Discord messages and other recipients’ downloaded copies are separate copies: the parties must assist with valid requests concerning them rather than treat them as exempt merely because they are server content.

Where the optional backup system operates, an erasure revision invalidates older archives; restoration checks that revision. Raw WAVs and generated exports are excluded from database backups. Backup purge depends on the worker running; pending requests and incompatible archives must not be bypassed to restore erased data.

Where Customer Data is covered by the CCPA/CPRA and the Processor acts as a service provider or contractor, the agreed specific business purposes are the meeting operations in Annex 1. The Processor shall not sell or share that data, retain/use/disclose it outside those purposes or the direct business relationship except as permitted by law, or combine it with data from unrelated sources except as legally permitted.

The Processor shall provide the required level of privacy protection, notify the Controller if it can no longer meet applicable obligations, and allow reasonable steps to monitor compliance and stop or remediate unauthorised use. The parties shall cooperate with applicable consumer requests. These contractual restrictions do not assert that every user or deployment automatically falls within that statute.

The DPA lasts for the processing governed by it. Obligations concerning confidentiality, lawful residual retention, rights assistance and applicable liability continue for as long as their purpose or mandatory law requires. The service terms govern contractual liability only to the extent consistent with this DPA and mandatory law; data-subject compensation rights and non-excludable controller/processor responsibility are not restricted.

Send instructions, audit requests and notices to inbox@vyach.app or the agreed secure contact. Our support server can help arrange that channel. The Controller must maintain a reliable contact for material data-protection communications. Changes to this DPA cannot retrospectively legalise processing or reduce mandatory rights.

• Subject matter: Discord voice-meeting assistance, configured text search, delivery and related service administration on customer instructions.
• Nature: receiving audio and metadata; transcription; text inference and embedding; storage, retrieval and indexing; authorised disclosure/publication; export; deletion and rebuilding of remaining records.
• Purposes: record consenting speakers, produce summaries and tasks, inform late joiners, answer meeting questions, enforce requested controls and fulfil retention and rights instructions.
• Data subjects: meeting participants, speakers, questioners, people mentioned by them and customer representatives, administrators and delegates whose information is included in Customer Data.
• Data types:Discord IDs and display names; server/channel/role/message references; participation and consent events; temporary audio; transcripts and timing; meeting titles/tags; summaries, tasks, digests, text/vector indexes, question-processing inputs and configured prompts. Request metadata contains user/server ID, time and status; question and answer texts are not persisted as a Vyach Q&A history.
• Sensitive information: not a required input. Incidental meeting disclosures can reveal protected information; the customer must have a lawful basis and must not instruct regulated processing requiring unsupported safeguards.
• Frequency: recurring transfers while authorised meeting, indexing and question features are used.
• Duration: while the requested features operate, until erasure or applicable inactivity/capacity cleanup. Inactivity choices are 7–360 days, default 30, and can restart with service activity. Raw untranscribed audio has a 24-hour cleanup target; identified question-request records have a 30-day lifetime; non-attributed usage amounts and event timestamps may remain with server administration records; downgrade grace is 30 days. These are separate rules, not a single maximum record age.
• Controller contact: the customer’s authorised representative identified in the service agreement. The Processor is Mikhail Bovt; private notices use the contact in the Terms.

• Production VPS and databases in Beauharnois, Canada; service ports restricted to loopback and the container network; host firewall; SSH key access; Cloudflare proxy with HTTPS to the Caddy origin. Filesystem-level disk encryption is not configured on the VPS.
• Discord-backed sign-in; encrypted OAuth tokens using AES-256-GCM and session-bound authenticated encryption; hashed opaque session tokens and expiring one-use handoff/confirmation states.
• HTTPS-origin requirements for non-local authenticated deployments; HttpOnly, SameSite cookies with Secure on HTTPS; origin and CSRF verification for authenticated mutations; restricted export downloads.
• Server-scoped database queries and search indexes; action-time Discord membership/permission checks; capability grants; owner-only deletion/export and separate Payer billing authority; instance-owner-only analytics.
• Human-speaker consent gating, withdrawal controls and exclusion of bot/unknown accounts; transcription receipt/lease handling; deletion queues, index rebuilding and export invalidation.
• Allowlisted technical application logging; exclusion of meeting bodies, question/answer text, credentials and raw request/error payloads; bounded processing and rate limits.
• Authenticated AES-256-GCM application backup archives, restrictive key/file handling, default daily schedule and seven-day rotation, configurable 1–30-day retention, privacy-revision checks and exclusion of WAVs and export archives. Separately, OVHcloud's daily disk backup can contain all disk data; the application revision guard does not purge the provider's restore points.

Deployment must independently provide appropriate host access controls, storage protection and network isolation. Internal container connections are not all TLS-encrypted by default, and full-disk encryption is not created by application code. The Processor must document the actual infrastructure safeguards; this annex does not invent them.

• Alibaba Cloud Model Studio / DashScope: Qwen text inference for summaries, digests, tasks and answers; processes the corresponding text and prompt context. The international endpoint is associated with Singapore; processing and support can involve other provider facilities. The published Membership Agreement names Alibaba Cloud (Singapore) Private Limited for Singapore accounts. The provider's DPA forms part of its service agreement for covered processing and incorporates applicable transfer clauses.
• OpenAI API: text embeddings for retained meeting content and retrieval queries, which can include questions and display-name aliases. The published terms name OpenAI OpCo, LLC (United States) for Singapore-based customers. Its DPA directs EEA and Swiss data to OpenAI Ireland Limited regardless of the contracting entity, with safeguards for onward transfers; it separately incorporates UK transfer terms. The standard API does not guarantee that all processing or support stays in one region.
• Hebergement OVH Inc. (OVHcloud Canada): VPS hosting, storage and provider disk backups in Beauharnois, Quebec, Canada, including bot, self-hosted STT, databases and website. The published Canadian Personal Information Protection Agreement describes provider processing; this reference is not a representation that a separate EU SCC has been signed.
• Cloudflare, Inc.: global HTTPS reverse proxy, delivery and DDoS/security protection for website and dashboard traffic, including contents sent through proxied routes. Cloudflare's Self-Serve Subscription Agreement incorporates its DPA for covered processing, including applicable transfer clauses. This does not establish Canada-only or EEA-only processing.

Cloudflare Email Routing and Google Gmail handle support correspondence as independent service-administration processing described in the Privacy Policy. They are not authorised meeting-content subprocessors merely because a support message can reach that mailbox. Consumer Gmail has no Google processor DPA; do not submit Customer Data requiring processor safeguards through that channel. A later Workspace or other processor-mailbox arrangement must be assessed and documented separately.

Discord’s platform and Polar’s payment/reseller activity have separate legal roles as described in the Privacy Policy. Self-hosted NeMo/Nemotron inference, PostgreSQL and Umami are software components, not by themselves additional companies authorised to receive meeting content. If another operator is engaged to run them, identify that operator here.