Data Processing Addendum

Last updated: 20 July 2026

This Data Processing Addendum ("DPA") forms part of the agreement between CERNO LABS, obrt za marketing i računalno programiranje, vl. Marko Filipović, Donjozelinska ulica 16, 10380 Donja Zelina, Croatia (OIB: 22778960778, MBS: 99286572) ("Processor", "Sottly") and the customer accepting the Terms of Service ("Controller", "Customer") and governs the processing of personal data under Regulation (EU) 2016/679 ("GDPR").

1. Subject matter and duration

Sottly processes personal data on behalf of the Customer to provide live meeting transcription, AI analysis, and meeting history, for the duration of the Customer's subscription plus the deletion period in Section 8.

2. Nature and purpose of processing

• Streaming and temporary buffering of meeting audio.
• Speech-to-text transcription with speaker attribution.
• AI-generated live suggestions and post-meeting analysis.
• Storage of transcripts, analyses, and consent records.

3. Categories of data subjects and data

• Data subjects: the Customer's meeting hosts and their meeting participants (e.g. clients, prospects, colleagues).
• Personal data: names, voice recordings, spoken content in transcripts, meeting metadata (time, participants, context), consent records.
• The Service is not intended for special categories of data; the Customer must not deliberately direct such data to the Service.

4. Controller instructions

Sottly processes personal data only on documented instructions from the Customer — i.e. as configured in the app (creating meetings, inviting participants, requesting analyses) — unless required otherwise by EU or member state law, in which case Sottly informs the Customer before processing.

5. Confidentiality and security (Art. 32 GDPR)

• Encryption in transit (TLS 1.2+/WSS) for all audio and data.
• Row-level security and role-based access to production data.
• Access to production systems restricted to authorized personnel.
• Logical separation of customer data; unique meeting room isolation.
• Payment data handled exclusively by Stripe (PCI DSS).

6. Subprocessors

The Customer grants general authorization for the subprocessors listed in the Privacy Policy (Supabase, Hetzner, Deepgram, OpenAI, Stripe, Cloudflare). Sottly will notify the Customer of intended changes at least 14 days in advance, giving the Customer the right to object on reasonable data protection grounds. Sottly imposes data protection obligations on subprocessors equivalent to this DPA and remains liable for their performance.

7. International transfers

Transfers outside the EEA occur only under an adequacy decision (including the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses (Module Two/Three, as applicable).

8. Deletion and return

Upon termination of the subscription, Sottly deletes all Customer personal data within 30 days, unless EU or member state law requires longer storage. During the subscription the Customer can delete individual meetings and their transcripts in the app. Upon request before deletion, Sottly provides an export of transcripts in a common machine-readable format.

9. Assistance

Taking into account the nature of processing, Sottly assists the Customer with data subject requests (Art. 12–23), security of processing, breach notifications, and data protection impact assessments (Art. 32–36).

10. Personal data breaches

Sottly notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data, providing the information reasonably required for the Customer's own notification obligations.

11. Audits

Sottly makes available information necessary to demonstrate compliance with this DPA and allows audits by the Customer or its mandated auditor, at most once per year with 30 days' notice, during business hours, without disrupting operations. Third-party certifications and reports may satisfy audit requests where available.

Contact

CERNO LABS, obrt za marketing i računalno programiranje, vl. Marko Filipović, Donjozelinska ulica 16, 10380 Donja Zelina, Croatia — privacy@sottly.ai