Data Processing Agreement

Overview

This Data Processing Agreement ("DPA") forms part of the agreement between Sentio Inc. ("Sentio," "we," "us") and customers who use Sentio to process voice recordings, transcripts, and related account data on behalf of their organization. It describes how we handle personal data as a processor, the categories of data and data subjects involved, and the subprocessors we rely on. It supplements, and should be read alongside, our Privacy Policy and Terms of Service.

Roles and Definitions

For customers subject to the GDPR, UK GDPR, or similar data protection laws, the customer acts as the data controller (or processor, if using Sentio on behalf of its own customers) and Sentio acts as a data processor / service provider. Sentio processes personal data only on documented instructions from the customer — as configured through the product or communicated in writing — and only for the purpose of providing, securing, and improving the Sentio service.

Subject Matter and Duration

The subject matter of processing is the provision of the Sentio voice notes, transcription, summarization, and workspace product. Processing continues for the duration of the customer's use of Sentio and ends when the customer's account and associated data are deleted, subject to any retention required by law or described in our Privacy Policy.

Categories of Data and Data Subjects

Data subjects: customer account holders and workspace members, and any individuals whose voices or names appear in recordings, transcripts, or notes a customer creates using Sentio.
Categories of data: account and profile information (name, email address), authentication data, audio recordings, generated transcripts and summaries, workspace content (notes, action items, integrations metadata), billing information, and usage/diagnostic data. Sentio does not intentionally process special categories of data and asks customers not to submit such data unless strictly necessary for their use case.

Subprocessors

Sentio uses the following subprocessors to provide the service. Each is bound by a contract requiring it to protect personal data to a standard consistent with this DPA. We'll update this list as our infrastructure changes and notify customers of material changes on request.

If a customer has enabled optional analytics (Google Analytics, PostHog, or Plausible), that provider processes limited usage data as described in the cookie consent banner and our Privacy Policy.

International Data Transfers

Sentio and its subprocessors are primarily based in the United States. Where personal data is transferred outside the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, such as Standard Contractual Clauses, with our subprocessors.

Security Measures

We use encryption in transit and at rest, workspace-level data isolation, access controls limiting who can view customer data, and monitoring for suspicious activity. We require subprocessors to maintain comparable security commitments.

Data Subject Requests and Breach Notification

We'll assist customers in responding to data subject requests (access, correction, deletion, portability) relating to data we process on their behalf, and will notify affected customers without undue delay if we become aware of a personal data breach affecting their data.

Requesting a Signed DPA

This page describes our standard data processing terms. If your organization requires a countersigned DPA (including Standard Contractual Clauses) for procurement or compliance purposes, fill out the form below and we'll send one over.

Contact Us

Questions about this DPA or how Sentio processes data on your behalf? Reach us at team@namoslabs.com.