Data processing agreement

What the agreement covers

Purposes and instructions. Delivering sessions, attendance, security of secure sessions (attestation, the forensic mark, leak cases), recordings and replays, notifications, billing. No other purpose without written instruction.
Children's data. Guardian consent for children, recorded by the organization using guardian identities it already holds; no behavioural profiling, tracking or advertising; a child's records erased within 48 hours of a withdrawal.
Retention and erasure. Purpose-bound retention; recordings kept for the organization's chosen period with a 48-hour notice before erasure; erasure certificates on request; erasure on termination.
Security measures. Per-session keys, attested joins, access logging, encryption in transit and at rest, a published security page with honest limits.
Breach notification. Supermeet informs the organization without undue delay and supports the organization's notifications and the 72-hour Board report.
Sub-processors. Infrastructure, storage, delivery and notification providers, named in the agreement, with notice before a change.
Audits and assistance. Records of processing, assistance with data-subject requests and grievances, audit rights on reasonable notice.
Data location. Application and database servers in India; recordings in object storage whose location is not limited to India; media delivered worldwide through a content network.

Organizations get the full template from privacy@supermeet.io and return a signed copy; changes are negotiated the same way.