# Saylark Data Processing Addendum (DPA)

**Last updated:** 2026-04-07

This Data Processing Addendum ("DPA") supplements the Saylark Terms of Service between **Logic Fusion, LLC**, a Delaware limited liability company ("Logic Fusion", "Processor"), and the enterprise customer ("Controller") that accepts it. It applies whenever Processor processes Personal Data on Controller's behalf.

## 1. Definitions

Terms such as "Personal Data", "Processing", "Data Subject", "Controller", "Processor", and "Supervisory Authority" have the meanings set out in the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"). "Applicable Data Protection Law" means the GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as amended ("CCPA/CPRA"), and any other data-protection laws applicable to the Processing.

## 2. Subject Matter and Duration

Processor will Process Personal Data to provide the Saylark service. Processing continues for the term of the underlying agreement and ends within 30 days of termination, subject to Section 8.

## 3. Nature and Purpose of Processing

Voice dictation, transcription, meeting recording and analysis, team collaboration, authentication, billing, and support. Processing is limited to what is necessary to deliver these features.

## 4. Categories of Data Subjects and Personal Data

- **Data subjects:** Controller's authorized users and meeting participants.
- **Personal data:** account identifiers (email, display name), usage data, transcribed text, shared task/item content, optional voice embeddings, billing metadata.
- **Special categories:** Voice recordings MAY contain sensitive personal data depending on Controller's use. Controller is responsible for obtaining any required explicit consent.

## 5. Controller and Processor Obligations

- Controller is responsible for the lawfulness of the Personal Data it submits and for obtaining all necessary consents, including meeting-recording consents.
- Processor will Process Personal Data only on documented instructions from Controller, which include the Terms of Service, this DPA, and the in-app configuration chosen by Controller.
- Processor will ensure that personnel authorized to Process Personal Data are bound by confidentiality obligations.
- Processor will assist Controller in responding to Data Subject requests and in meeting its obligations under Articles 32–36 of the GDPR, taking into account the nature of Processing.

## 6. Sub-processors

Controller provides a general authorization for Processor to engage the sub-processors listed in `SUBPROCESSORS.md`. Processor will:

1. Impose data-protection terms on each sub-processor that are no less protective than this DPA.
2. Remain liable for the acts and omissions of sub-processors.
3. Notify Controller in-app at least 30 days before adding or replacing a sub-processor. Controller may object on reasonable data-protection grounds; the parties will work in good faith to resolve the objection or terminate the affected portion of the Service.

Current sub-processors: OpenAI, Supabase, Apple, Stripe. See `SUBPROCESSORS.md`.

## 7. International Transfers

Where Personal Data originating in the EEA, UK, or Switzerland is transferred to a country not deemed adequate, the parties incorporate by reference the **Standard Contractual Clauses** adopted by the European Commission on 4 June 2021 (Module Two — Controller to Processor), the UK International Data Transfer Addendum, and equivalent Swiss mechanisms. Processor acts as the "data importer"; Controller acts as the "data exporter".

## 8. Security Measures

Processor implements appropriate technical and organizational measures, including:

- TLS 1.2+ encryption in transit;
- Encryption at rest for database and object storage;
- Row-level security and least-privilege access controls;
- Secrets management and regular credential rotation;
- Vendor security review for sub-processors;
- Logging, monitoring, and incident-response processes;
- Regular backups with defined retention;
- Employee confidentiality and security training.

Controller acknowledges that audio captured by Saylark is stored locally on the end user's device by default.

## 9. Data Subject Requests

Processor will, without undue delay, inform Controller of any Data Subject request it receives relating to Controller's Personal Data and will assist Controller in fulfilling the request using the in-app export and deletion tools.

## 10. Personal Data Breach

Processor will notify Controller without undue delay, and in any event within **72 hours**, after becoming aware of a Personal Data breach affecting Controller's Personal Data, and will provide information reasonably necessary for Controller to meet its own notification obligations.

## 11. Return and Deletion

Upon termination of the Service or on Controller's written request, Processor will delete or return all Personal Data within 30 days, except where retention is required by law. Controller may export data at any time via the in-app Export function.

## 12. Audit

Processor will make available to Controller all information reasonably necessary to demonstrate compliance with this DPA, including third-party certifications and summary reports. On-site audits are permitted once per year, on 30 days' notice, during business hours, at Controller's cost, subject to reasonable confidentiality and security requirements.

## 13. CCPA Terms

Where Processor Processes Personal Information of California residents on behalf of Controller, Processor is a "service provider" under the CCPA/CPRA. Processor:

- Will not sell or share Personal Information;
- Will not retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the Terms of Service;
- Will not combine Personal Information received from Controller with Personal Information from another source except as permitted by the CCPA;
- Certifies that it understands and will comply with these restrictions.

## 14. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service.

## 15. Order of Precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA controls as to the subject matter of data protection. The Standard Contractual Clauses prevail over this DPA where they conflict.

## 16. Contact

- Data protection: **voice@logicfusion.net**
- Security: **voice@logicfusion.net**
