Data Processing Agreement

Version: 2026-10-13
Applies to: HiText Business (monthly and yearly plans and the free recording with speakers)

This is a translation. In case of any discrepancy, the Spanish version prevails: read the Spanish version.

This agreement governs how we process, on behalf of the customer, the personal data contained in the recordings the customer uploads to HiText Business, in accordance with article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (Spanish Organic Law on Personal Data Protection and Guarantee of Digital Rights, “LOPDGDD”).

1. Parties

• Controller (the “Customer”): the natural or legal person who holds the HiText Business account, with the details provided when registering and paying.
• Processor (the “Processor”): Roberto Díaz Badra, a self-employed professional trading under the business name Disruptive Normality, established in Spain, contact: disruptivenormality@gmail.com.

2. Acceptance and version

The Customer accepts this agreement by ticking the corresponding box before uploading the free recording with speakers or before paying for the subscription, whichever comes first. We keep the accepted version, the date and a pseudonymous identifier of the connection from which it was accepted. This agreement forms part of the terms of service and prevails over them in matters of data protection.

3. Subject matter

The Processor provides the Customer with an online service that, based on audio or video recordings uploaded by the Customer:

• transcribes the recording and separates the turns by speaker (an option on by default, which the Customer can turn off to use standard transcription without speakers);
• generates documents using templates (interview by speaker, synthesis of several interviews, meeting minutes or the Customer's own format);
• stores the Customer's transcripts, documents, projects, speaker names, glossary and templates so that the Customer can view, edit and export them;
• notifies the Customer by email when a transcription is ready.

The Processor processes the data only to provide this service, following the Customer's documented instructions. Documented instructions are this agreement, the Customer's use of the service (uploading, processing, editing, exporting and deleting) and its configuration.

4. Duration

This agreement lasts as long as the Customer's relationship with HiText Business, including the free recording with speakers, and continues to apply while the Processor retains Customer data in accordance with section 12.

5. Data and data subjects

Types of personal data:

• the voices of the people who appear in the recordings and the content of what they say;
• data mentioned in the conversation: names, positions, contact or professional details, opinions and experiences;
• the names the Customer assigns to speakers, the names of files and projects, the glossary and the templates;
• the transcripts and the documents generated.

Data subjects: interviewees and interviewers, attendees and participants in meetings, and third parties mentioned in the recordings.

Excluded data. HiText Business is not designed to process special categories of data (article 9 GDPR: health data, ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, and data concerning sex life or sexual orientation) or data relating to criminal convictions and offences (article 10 GDPR). The Customer undertakes not to use the service for recordings whose purpose is to process such data, such as medical consultations, therapy sessions or criminal matters. If such data nevertheless appears incidentally in a recording, the Customer is solely responsible for having a valid legal basis to process it.

Speaker separation, not identification. The service distinguishes voices within each recording in order to attribute the turns. It does not create voice templates or compare voices across recordings to identify people: speaker names are assigned by the Customer.

6. Customer obligations

The Customer, as controller:

• decides what to record and upload, and warrants that it has a legal basis to do so;
• informs the people recorded and, where the law requires it, obtains their consent;
• handles data subjects' requests to exercise their rights, with the Processor's assistance provided for in section 10;
• does not upload data excluded under section 5;
• keeps its account secure (password and access to its email).

7. Processor obligations

The Processor undertakes to:

1. Process the data only on the Customer's documented instructions, including with regard to international transfers, unless required to do so by Union or Member State law. In that case, it will inform the Customer before processing the data, unless that law prohibits it.
2. Immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection rules.
3. Ensure that persons authorized to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
4. Implement the security measures in section 9.
5. Respect the conditions in section 8 for engaging other processors (sub-processors).
6. Assist the Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights.
7. Assist the Customer in complying with the obligations in articles 32 to 36 GDPR (security, notification of personal data breaches, impact assessments and prior consultation), taking into account the nature of processing and the information available to it.
8. Delete or return the data at the end of the service, in accordance with section 12.
9. Make available to the Customer the information necessary to demonstrate compliance with this agreement and allow for audits, in accordance with section 13.
10. Maintain the record of processing activities carried out on behalf of others required by article 30.2 GDPR.
11. Not use the Customer's data for its own purposes, not sell or disclose it, and not use it to train artificial intelligence models, nor allow its sub-processors to do so.

The Processor may process technical and usage data, aggregated or linked to the account (for example, file durations, the number of documents or service errors), in order to bill, manage the quota, prevent abuse and keep the service secure, without accessing the content of the recordings for that purpose.

8. Sub-processors

The Customer gives the Processor general authorization to engage sub-processors. Those involved as of the date of this version are:

• Google Cloud and Firebase (Google Ireland Limited and Google LLC): authentication, database and file storage, hosted in the European Union, and server functions that process files and requests, which run in the United States.
• Google Vertex AI (Google Ireland Limited and Google LLC): transcription with speaker separation using Gemini models, in the European Union multi-region location.
• Deepgram (Deepgram, Inc.): backup transcription when the main service fails and for files longer than 60 minutes, through its European Union endpoint and with the option of not using the data to improve its models.
• Replicate (Replicate, Inc.): standard transcription (without speakers) with the Whisper model, when the Customer turns off speaker separation or transcribes a video link. United States.
• Firecrawl: retrieval of the audio track when the Customer transcribes a video link. United States.
• OpenAI (API service for businesses): drafting the documents from the transcript and, in standard transcription, language detection, translation and summarization. May process data in the United States.
• Resend (Plus Five Five, Inc.): sending email notifications. Receives the Customer's email address and the file name, never the text of the transcript. United States.
• Stripe (Stripe Payments Europe, Limited): subscription billing and invoices. Processes the Customer's billing data, not the content of the recordings.
• RevenueCat (RevenueCat, Inc.): subscription status to unlock the plan on the web and in the app. Receives an account identifier and the subscription data, not the content of the recordings. United States.

The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, and remains liable to the Customer for their compliance.

Changes. The Processor will notify the Customer at least 15 days in advance, by email or with a notice in the service, before adding or replacing a sub-processor. If the Customer objects on reasonable data protection grounds, it may cancel the subscription before the change applies and request the deletion of its data.

9. Security measures

The Processor applies, at a minimum, the following measures, taking into account the state of the art, the cost and the risks of the processing:

• encryption of communications (HTTPS/TLS) and the encryption of stored data provided by Google Cloud;
• access to each account's data restricted to its holder through per-user security rules, and server access through service accounts with least privilege;
• signed requests between the Processor's services;
• automatic deletion of recordings in accordance with section 11;
• access to systems restricted to the Processor's personnel who need it;
• review of the measures when the service changes or an incident is detected.

10. Data subjects' rights

If a data subject contacts the Processor to exercise their rights of access, rectification, erasure, objection, restriction of processing or portability over data it processes on behalf of the Customer, the Processor will pass this on to the Customer without undue delay and, at the latest, within 5 business days, without responding to the request itself unless instructed by the Customer. The service allows the Customer to view, export, correct and delete its files and documents by itself.

11. Retention and deletion of recordings

• Original audio or video file: deleted when the transcription finishes. If the process fails, an automatic rule removes it at the latest 7 days after it was uploaded.
• Transcripts, documents, projects and templates: kept in the Customer's account until the Customer deletes them. The Customer can delete each file, with its documents, or all its data from the account settings.
• Sub-processor copies: the transcription and drafting providers process the content only during processing and may retain it temporarily under their business terms, for example to prevent abuse, without using it to train models.

12. End of service: return and deletion

When the subscription ends, or after using the free recording, the Customer can continue to sign in to its account to view and export its documents, and delete them whenever it wishes. If the Customer requests it in writing, the Processor will delete all its data within a maximum of 30 days. If no such request is made, the Processor will delete the account data after 12 months without activity. This excludes data that the Processor must retain by law, such as billing data, which is kept blocked for the statutory periods.

13. Information and audits

The Processor will make available to the Customer, upon request, the information necessary to demonstrate compliance with this agreement, primarily through documentation and written answers. If that is not sufficient, the Customer may carry out an audit, at most once a year, with 30 days' notice, at its own expense, without access to other customers' data and with the auditor's commitment to confidentiality.

14. Personal data breaches

If the Processor becomes aware of a security breach affecting Customer data, it will notify the Customer without undue delay and, in any event, within a maximum of 48 hours, by email to the account's address. The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point.

15. International transfers

Some sub-processors process data outside the European Economic Area (in particular, in the United States), as indicated in section 8. Those transfers are made with appropriate safeguards under Chapter V GDPR: the provider's participation in the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), with any appropriate supplementary measures. The Customer may request more information about these safeguards.

16. Liability

Each party is liable for its obligations in accordance with article 82 GDPR. If the Processor processes the data for its own purposes or breaches this agreement, it will be considered a controller in respect of that processing.

17. Changes to this agreement

The Processor may update this agreement to adapt it to legal changes or changes to the service. It will publish each version with its date on this page and will notify the Customer by email at least 15 days in advance if the changes are significant. If the Customer does not agree, it may cancel the subscription before they take effect.

18. Governing law and jurisdiction

This agreement is governed by Spanish law and by the GDPR. For any dispute, the parties submit to the courts of Las Palmas de Gran Canaria, unless the law provides for another mandatory venue.

19. Contact

For any question about this agreement or about data protection: disruptivenormality@gmail.com.