Data Processing Addendum

Effective date: 2026-06-10 (draft — not yet in force; pending attorney review)

1. Parties and roles

This Data Processing Addendum ("DPA") is offered by OwnTongue LLC [REVIEW: exact registered name + state TBD] ("OwnTongue", the "processor") to customers who use OwnTongue for their organization (the "customer", acting as "controller" of the personal data processed through the service). It supplements our Terms of Service for customers who need a written data-processing commitment — for example, schools, civic bodies, and organizations with their own privacy obligations.

2. Scope and purpose of processing

1. Subject matter: live transcription and translation of speech into captions displayed to the customer's audience, plus operation of the customer's account.
2. Duration: the term of the customer's subscription.
3. Nature and purpose: real-time, in-memory processing of audio and caption text to deliver live captions; storage of account and usage records to operate the subscription.
4. Categories of data: spoken words during sessions (audio, processed in real time and never stored; caption text, in memory only and not retained after the session); presenter account data (user ID, email, plan state, usage counters).
5. Data subjects: the customer's presenters and speakers, and audience members who view captions (audience members join without accounts and provide no personal details).

3. Customer instructions

OwnTongue processes personal data only to provide the service as described in the Terms and this DPA, and on the customer's documented instructions — operating the service as configured by the customer counts as such an instruction. We will inform the customer if we believe an instruction violates applicable law.

4. Confidentiality

People authorized to access personal data on our side are bound by confidentiality obligations and access only what their role requires.

5. Sub-processors

1. The customer authorizes OwnTongue to use sub-processors to deliver the service. The current sub-processors list is published at owntongue.com/sub-processors, including each provider's purpose, data processed, and region.
2. We will update that page at least 10 days before a new or replacement sub-processor begins processing customer personal data . Customers who object to a new sub-processor on reasonable data-protection grounds may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees — this refund right supersedes the general no-refund default in the Terms of Service for this specific case.
3. We remain responsible for our sub-processors' performance of the obligations in this DPA.

6. Security measures

OwnTongue maintains technical and organizational measures appropriate to the nature of the processing, including:

• Audio is never stored — it is streamed for live transcription and discarded; no recordings, no voiceprints.
• Caption text is processed in memory and not retained after the session.
• Encryption of data in transit.
• Hosting and storage with Microsoft Azure in US regions, with restricted access to production systems.
• Minimal data collection by design — account data is limited to identity, plan state, and usage counters.

A current overview is maintained on our Security page.

7. Personal data breach notification

If we become aware of a personal data breach affecting the customer's data, we will notify the customer without undue delay [REVIEW: specific notification timeframe TBD — e.g. within 72 hours], describe what we know about the breach's nature and scope, and keep the customer informed as we investigate and remediate.

8. Assistance to the customer

Taking into account the nature of the processing, we will give the customer reasonable assistance in responding to data-subject requests (access, deletion, correction) and in meeting the customer's own security and assessment obligations. Because audio is never stored and captions are not retained, requests concerning session content will typically be satisfied by that fact alone.

9. Deletion on termination

When the customer's subscription ends, we will delete the customer's account data and usage records within a reasonable period after termination, except where law requires us to keep specific records (for example, billing records). Session content needs no deletion step: audio is never stored and caption text is not retained after each session.

10. Audit and information rights

On reasonable written request (no more than once per year, absent a genuine incident), we will provide information demonstrating our compliance with this DPA — such as our security overview, sub-processor list, and answers to a reasonable security questionnaire. We do not offer on-site audits at our current size; where a customer's regulator requires more, we will discuss reasonable options in good faith.

11. International transfers

Session content and account storage are processed in the United States, and the service is offered to US customers only at launch. Sign-in identity (email, OAuth identifiers) is processed by the customer's chosen identity provider (Microsoft Entra ID or Google) on those providers' global platforms — see the sub-processors list. No other international data transfers are contemplated by this DPA today.

12. Order of precedence

If this DPA conflicts with the Terms of Service on a data-protection matter, this DPA controls. Otherwise the Terms apply.

13. Contact

To request a countersigned copy of this DPA or ask questions: legal@owntongue.com.
Mailing address: [REVIEW: mailing address TBD].