Data Processing Agreement

1. Definitions

2. Scope, Roles, and Customer Instructions

Customer is the controller or business for Customer Personal Data, and Project Lens is Customer’s processor or service provider. If Customer acts as a processor for another controller, Project Lens acts as Customer’s subprocessor. Each party will comply with the Data Protection Laws applicable to its role.

This DPA does not govern Personal Information that Project Lens processes for its own business purposes as a controller or business, such as account administration, billing, direct customer communications, security, and non-content service analytics. Those activities are described in the Privacy Policy.

Customer instructs Project Lens to process and transfer Customer Personal Data as necessary to provide, operate, maintain, secure, debug, and support the Services; to make Customer Data available as Customer directs; and to comply with the Agreement, this DPA, and Customer’s documented use of the Services.

Project Lens will process Customer Personal Data only for those purposes, unless another use is required by applicable law. If legally permitted, Project Lens will inform Customer before processing Customer Personal Data for a legally required purpose that is outside Customer’s instructions.

Project Lens will notify Customer if, in our reasonable opinion, a documented instruction violates applicable Data Protection Laws, unless those laws prohibit us from doing so.

3. Customer Responsibilities

Customer is responsible for the lawfulness, accuracy, and quality of Customer Data and for the means by which Customer obtains it. Customer represents that it has all rights, authority, notices, consents, and other permissions required to provide Customer Personal Data to Project Lens and to instruct Project Lens and its Subprocessors to process it.

This responsibility includes complying with recording and privacy laws before recording, uploading, or submitting another person’s voice or other Personal Information through Rundown. Customer will not instruct Project Lens to process Customer Personal Data in violation of Data Protection Laws.

4. Use of Customer Data

Project Lens will not sell Customer Personal Data or use Customer Content for advertising, general product-improvement purposes, or training or improving artificial intelligence or machine-learning models.

AssemblyAI is configured not to use Customer Data or de-identified data for model training, model improvement, or benchmarking. Anthropic’s Commercial Terms prohibit it from training models on Customer Content submitted through its commercial API.

5. Processing Details

6. Confidentiality and Security

Project Lens will ensure that people authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and may access it only as needed to perform their responsibilities.

Project Lens maintains reasonable administrative, technical, and organizational safeguards designed to protect Customer Personal Data against unauthorized access, use, alteration, disclosure, or destruction. These safeguards include, as applicable:

• Encryption of production data in transit and at rest.
• Private, access-controlled object storage for raw Rundown audio.
• Logical access controls and account-scoped authorization for Customer Data.
• Access limited to authorized personnel and service providers with a need to process the data.

7. Subprocessors

Customer authorizes Project Lens to engage the following Subprocessors to provide the Services:

Customer-Directed Third-Party Services are not Subprocessors engaged by Project Lens under this DPA. Customer instructs Project Lens to transfer Customer Data to and from those services as Customer directs, and the third party’s own agreement with Customer governs its processing.

Project Lens will enter into a written agreement with each Subprocessor that imposes data-protection obligations providing an equivalent level of protection for Customer Personal Data as the obligations in this DPA, as applicable to the Subprocessor’s services. Project Lens will remain responsible for each Subprocessor’s performance of those obligations to the extent required by applicable law.

Our speech-to-text and large language model providers may engage downstream subprocessors to perform their services. Those subprocessors may process audio, transcript text, timestamps, request metadata, or other Customer Personal Data as needed for the applicable service, and processing may occur in multiple countries. Current downstream-subprocessor and location information is available through the AssemblyAI Trust Center and Anthropic Trust Center.

Project Lens will reflect any intended material addition or replacement of a Subprocessor on this page before the new Subprocessor begins processing Customer Personal Data and will provide Customer a reasonable opportunity to object on data-protection grounds by contacting legal@projectlens.com. If the parties cannot resolve an objection in good faith, Customer may stop using the affected feature or terminate the affected Services. Customer should review this page periodically for the current list.

8. International Transfers

Customer Personal Data may be processed in the United States and other countries where Project Lens, its Subprocessors, or their downstream subprocessors operate. Those countries may have data-protection laws that differ from the laws in Customer’s location.

When Data Protection Laws require a transfer mechanism for Project Lens’s transfer of Customer Personal Data to a Subprocessor, Project Lens uses the safeguards in its applicable Subprocessor agreement. Project Lens’s current agreements with AssemblyAI and Anthropic incorporate the European Commission’s Standard Contractual Clauses and applicable United Kingdom and Swiss transfer addenda.

This DPA does not itself incorporate the European Union Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or Addendum, or another transfer mechanism between Customer and Project Lens. Customer must not submit Customer Personal Data for which such a mechanism is legally required unless the parties first put an applicable mechanism in place in writing. Contact legal@projectlens.com to request additional transfer terms.

9. Data Subject Requests and Compliance Assistance

Customer is responsible for responding to requests from people exercising rights over Customer Personal Data. Taking into account the nature of the processing and the functionality available through the Services, Project Lens will provide reasonable assistance that Customer cannot reasonably complete without our help.

If Project Lens receives a request concerning Customer Personal Data processed on Customer’s behalf, we may direct the requester to Customer and, where legally permitted and reasonably identifiable, notify Customer of the request.

Taking into account the nature of processing and the information available to Project Lens, Project Lens will also provide reasonable assistance with Customer’s applicable security, breach-notification, data-protection impact assessment, and regulatory-consultation obligations.

10. Security Incidents

Project Lens will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. To the extent reasonably available, the notice will describe the nature of the Security Incident, the categories of data affected, likely consequences, and measures taken or planned to address it.

Project Lens will take reasonable steps to contain, investigate, and remediate the Security Incident and will provide reasonable cooperation to support Customer’s legally required response. Notification is not an admission of fault or liability.

11. Deletion and Retention

During the Agreement, Project Lens will handle verified deletion requests in accordance with the Privacy Policy and applicable law.

Following termination of the Agreement, at Customer’s choice, Project Lens will return Customer Personal Data in a reasonably available format or delete it from active systems, and will delete existing copies, unless applicable law requires storage. Customer must request return before deletion and may use available export features. Copies retained temporarily in backups will remain protected from further processing except as required for backup restoration or applicable law and will be deleted on the applicable deletion cycle.

• Project Lens-held raw audio, transcripts, Rundowns, version history, and temporary PDF artifacts follow the artifact-specific retention schedule in Section 7.1 of the Privacy Policy.
• Audio and transcripts submitted to AssemblyAI have a one-day time to live, at which point AssemblyAI begins deletion. Deletion may take additional time to complete, and limited metadata is retained for logging and billing.
• Anthropic retains API inputs and outputs no longer than 30 days under Project Lens’s current commercial configuration. Content flagged by Anthropic’s automated trust-and-safety systems as violating its Usage Policy may be retained for up to two years, and related trust-and-safety classification scores may be retained for up to seven years. Anthropic may also retain data when required by law.
• When Project Lens permanently deletes an account or project through its hard-deletion process, associated Rundown records are removed and associated stored artifacts are queued for deletion. Removing or archiving a project through the ordinary in-app workflow may retain its records.

Deletion from backups and Subprocessor systems may complete on different schedules. Project Lens will use available contractual and technical controls to instruct Subprocessors to delete Customer Personal Data when required by the Agreement, this DPA, or applicable law.

12. Compliance Information

Upon Customer’s reasonable written request, Project Lens will provide information reasonably available and necessary to demonstrate compliance with this DPA, subject to appropriate confidentiality, security, privilege, and third-party restrictions.

If that information is not reasonably sufficient, Customer may request a reasonable audit limited to Project Lens’s processing of Customer Personal Data. The parties will agree in advance on scope, timing, confidentiality, security, cost, and measures to avoid disrupting the Services. Customer may exercise this right no more than once in any 12-month period unless a Security Incident or applicable Data Protection Law reasonably requires otherwise.

This DPA does not represent that Project Lens holds any certification or participates in any privacy framework not expressly identified here.

13. General

If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA controls to the extent of that conflict. All other terms of the Agreement, including limitations of liability and dispute-resolution terms, remain in effect.

This DPA ends when Project Lens no longer processes Customer Personal Data on Customer’s behalf, except for provisions that must remain in effect to protect retained Customer Personal Data or fulfill their purpose.