Palyro Data Processing Agreement

Effective date: 14 July 2026

This Data Processing Agreement (“DPA”) is for account holders who use Palyro for business. It sets out, in the structure Article 28 GDPR requires, how Novotrio OÜ processes meeting content on your behalf. Like everything else we publish, it’s written to be read.

If you use Palyro as a private individual (a consumer), this document doesn’t apply to you in the same way — but it still describes accurately how we handle meeting content, and the Privacy Policy is your primary document.

1. Who this is between, and what it covers

• You — the business account holder. For meeting content (what people say in your meetings), you are the controller: you decide why Palyro is in the meeting and what happens with the results.
• We — Novotrio OÜ, registry code 17503604, Pärnu mnt 388b, Nõmme linnaosa, 11612 Tallinn, Estonia (support@palyro.com). For meeting content, we are your processor: we process it only to provide the service you configured.

This DPA forms part of your contract with us (the Terms of Service) and applies whenever Palyro processes meeting content for your account. For your account and billing data we are the controller in our own right — that is covered by the Privacy Policy, not this DPA.

2. Subject matter, duration, nature and purpose

3. What data, and whose

• Categories of data: meeting audio and (bot-visible) video; live transcripts in source and target language; translations; synthesized voice output; AI-written meeting notes; coach output and any briefing/context you give the Meeting Coach; participant names as they appear in the meeting; meeting metadata (mode, language pair, timing). Meeting content is conversational — it can incidentally contain any kind of personal data participants choose to speak about, including special categories (e.g. health topics in a medical meeting). It is your responsibility as controller to ensure a legal basis for such content (Terms § 7 and § 9).
• Data subjects: you, your staff, and the other participants in your meetings.

4. Your instructions

We process meeting content only on your documented instructions. Your instructions are: these Terms and this DPA, the meeting mode and settings you select for each meeting, and the actions you take in the dashboard (start, end, delete, download). We won’t process meeting content for our own purposes — in particular, we do not use your meeting content to train AI models (Terms § 10).

If we believe an instruction violates data-protection law, we’ll tell you before acting on it. If EU or member-state law requires us to process beyond your instructions, we’ll inform you first unless that law forbids it.

5. Confidentiality

Everyone we authorize to access meeting content is bound by confidentiality (contractual or statutory). Access is limited to what operating and supporting the service requires.

6. Security (summary of technical and organizational measures)

• Meeting content is encrypted in transit (TLS) between your meeting, our engine, and each processor.
• Recordings, transcripts and notes are stored on EU-located infrastructure (see §§ 6–7 of the Privacy Policy for the storage and transfer picture).
• Access to production systems is restricted to authorized personnel and used only for operating and maintaining the service.
• Account data is segregated per account; meeting artifacts are accessible only to the account that created them.
• Retention is bounded by design: meeting content auto-deletes 90 days after the meeting (§ 9).
• A detailed TOM annex is being prepared with counsel and will replace this summary; the summary states what we do today, not an aspiration.

7. Sub-processors

You give us general authorization to engage the sub-processors listed in the processor table of the Privacy Policy — that table (provider, what it does, what data it receives, location and transfer safeguard) is the authoritative, current sub-processor list for meeting content.

• Changes: we announce the addition or replacement of a sub-processor before it takes effect — by updating the Privacy Policy table and notifying account holders by email. If you object on reasonable data-protection grounds, you may close your account before the change takes effect and we refund unused purchased balance (Terms § 11 mechanics apply).
• Flow-down: each sub-processor is bound by a data-processing agreement imposing obligations materially equivalent to this DPA.

8. International transfers

Storage of meeting content is EU-based, but delivering the service involves transfers outside the EU/EEA, exactly as described in § 7 of the Privacy Policy:

• Transfers to US-based sub-processors rely on the EU Standard Contractual Clauses or, where the provider is certified, the EU–US Data Privacy Framework.
• Our development and operations processor, Apsara Turizm Seyahat Medya Danışmanlık Ticaret İthalat İhracat LTD. ŞTİ. (Fethiye, Türkiye), may access personal data remotely from Türkiye — a country without an EU adequacy decision. This access is governed by an Art. 28 agreement incorporating the EU Standard Contractual Clauses with supplementary measures, and is limited to what operating the service requires. The clauses are hereby incorporated into the processing chain this DPA governs; you can request information about these safeguards at support@palyro.com.

9. Deletion and return

• During the contract: you can delete any meeting’s content from the dashboard at any time, and download recordings, transcripts and notes from your library whenever you want — that is the “return” mechanism, self-serve.
• Automatic: meeting content deletes itself 90 days after the meeting.
• At the end: when you close your account, remaining meeting content is deleted with it (account deletion within 30 days; only records tax law makes us keep are retained, access-restricted — Terms § 10).

10. Assistance

• Data-subject rights: if a meeting participant addresses a request (access, erasure, objection…) to us that concerns your meetings, we forward it to you and assist you in answering it, taking into account the nature of the processing. The self-serve tools (transcript download, per-meeting deletion) are the primary assistance mechanism.
• Security, breach and DPIA support: we assist you with your obligations under Articles 32–36 GDPR. If we become aware of a personal-data breach affecting your meeting content, we notify you without undue delay with the information Article 33(3) requires, as we have it.

11. Audit

We make available the information necessary to demonstrate compliance with this DPA — start with support@palyro.com; most questions are answered by documentation (this DPA, the Privacy Policy, the sub-processor DPAs). Where an audit is genuinely required, you (or an independent auditor you mandate, bound to confidentiality) may audit at most once per year, on at least 30 days’ notice, during business hours, in a scope proportionate to the processing, and without access to other customers’ data. Each side bears its own costs.

12. The boring but necessary

• This DPA prevails over the Terms for meeting-content processing conflicts; statutory data-protection law prevails over both.
• Liability follows the Terms (§ 13), within the limits Article 82 GDPR sets for processors.
• Governing law follows the Terms (§ 14): Estonian law.

Questions: support@palyro.com.