Data Processing Addendum

1. Roles and instructions

This DPA forms part of the Terms. Customer is controller/business and Devoted Action is processor/service provider for personal data contained in service content. We process that data only on documented instructions in the Terms, selected configuration, support requests, and applicable law.

2. Processing details

• Subject matter: live speech recognition, translation, synthetic audio, listener delivery, storage, support, security, and deletion.
• Duration: the account term plus the documented retention/deletion period.
• Data subjects: speakers, listeners, Customer staff, guests, and individuals mentioned in content.
• Data: audio, voice models, transcripts, translations, identifiers, contact details, connection metadata, and Customer-selected content.
• Purpose: provide the service and Customer-configured outputs; not advertising or sale of personal information.

3. Processor obligations

• Maintain confidentiality and appropriate technical and organizational safeguards.
• Use subprocessors under written data-protection obligations and remain responsible for their contracted processing.
• Assist reasonably with data-subject requests, security incidents, impact assessments, and regulator inquiries.
• Notify Customer without undue delay after confirming a personal-data breach affecting Customer data.
• Delete or return data at termination on request, subject to backups, legal obligations, and the retention schedule.
• Make information reasonably available to demonstrate compliance and support proportionate audits subject to confidentiality and security restrictions.

4. Restricted uses and US state privacy laws

We will not sell or share Customer personal data for behavioral advertising, retain/use/disclose it outside the business purposes in this DPA, or combine it with unrelated personal data except as permitted by applicable law to provide or secure the service. We will notify Customer if we can no longer meet an applicable service-provider obligation and allow reasonable steps to stop and remediate unauthorized use.

5. International transfers and precedence

Where required, the parties incorporate applicable standard contractual clauses and supplementary measures. If this DPA conflicts with the Terms on processing Customer personal data, this DPA controls. Customer remains responsible for lawful collection, notices, consent, and instructions.

6. Execution

This online DPA is accepted with the Terms. Customers needing a countersigned copy or transfer annex may contact info@churchaudioai.com.