Data processing agreement
Last updated
Scope and roles
This agreement forms part of the terms of service between [ENTITY] ("WeekScribe") and the customer. It applies when WeekScribe processes personal data on the customer's behalf.
The customer is the controller (or data fiduciary under India's DPDP Act). WeekScribe is the processor and acts only on the customer's documented instructions, which include using the service as designed.
Processing details
| Subject matter | Providing the WeekScribe service under the terms of service. |
|---|---|
| Duration | For as long as the customer has an account, plus the deletion period below. |
| Nature and purpose | Syncing project activity, drafting, storing and delivering reports, billing and support. |
| Categories of data | Names, email addresses, job roles, and personal data contained in project activity such as comments and assignees. |
| Data subjects | The customer's users, its team members named in connected tools, and its clients' report recipients. |
Our obligations
- Process personal data only to provide the service and as the customer instructs.
- Ensure staff with access are bound by confidentiality.
- Keep appropriate technical and organisational measures in place, as described on our security page.
- Help the customer respond to data subject requests and, where needed, with impact assessments.
- Tell the customer if we believe an instruction breaks data protection law.
Sub-processors
The customer authorises WeekScribe to use the sub-processors below. We hold each to data protection terms at least as protective as this agreement. We will email account owners at least 30 days before adding or replacing one, and the customer may object on reasonable grounds.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Application database and file storage | [SUPABASE_REGION] |
| Redis hosting | Job queue and short-lived cache | [REDIS_PROVIDER], [REDIS_REGION] |
| Application hosting | Runs the API, background workers and report renderer | [API_HOST], [API_REGION] |
| Google (Gemini) | Drafting report text from project activity | United States |
| OpenAI | Drafting report text from project activity | United States |
| Anthropic | Drafting report text from project activity | United States |
| OpenRouter | Routing report drafting to language models | United States |
| Brevo | Sign-in codes and report delivery emails | European Union |
| Dodo Payments | Subscription billing and invoicing | [DODO_REGION] |
| Vercel | Hosting this website and, with consent, page-view analytics | United States |
International transfers
Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses (or the UK addendum), which are incorporated by reference.
Breach notification
WeekScribe will notify the customer without undue delay, and aims to do so within 72 hours, after becoming aware of a personal data breach affecting the customer's data, with the information the customer needs to meet its own obligations.
Deletion and return
The customer can export its reports while the account is open. When the account is closed, WeekScribe deletes the customer's personal data within [RETENTION_PERIOD], unless the law requires us to keep it.
Audits
On reasonable written request, and no more than once a year unless a breach has occurred, WeekScribe will provide the information needed to show compliance with this agreement.
Getting a signed copy
This agreement applies automatically when you accept the terms of service. If you need a countersigned copy for your records, email contact@weekscribe.in.