Data Processing Agreement (DPA)
This English version is provided for users outside Türkiye. For users in Türkiye, the Turkish version prevails if the two differ.
This Annex governs the processing of personal data between the Customer using the mayAssistant service (controller) and mayAssistant (the Service Provider — processor). It forms an integral part of the Terms of Use and is intended to meet the requirements of Article 28 GDPR and of KVKK.
1. Roles
For the personal data of third parties (participants) contained in the meeting recordings the Customer uploads, the Customer is the controller and the Service Provider is the processor. The Service Provider processes the data only on the Customer's documented instructions, which consist of the Customer's use of the Service, and informs the Customer if it considers that an instruction infringes data protection law.
2. Subject matter and duration of processing
| Subject matter | Transcribing audio / video recordings, separating speakers, summarising and storing them |
|---|---|
| Duration | The period during which the Service is used, plus the periods in the Retention and Deletion Policy |
| Types of data | Audio recording, video (screen) recording, transcript text, speaker labels, names |
| Data subjects | The Customer's employees, customers and meeting participants |
3. Obligations of the Service Provider
- Process the data only on the Customer's instructions and for the performance of the Service.
- Ensure that personnel with access to the data are bound by confidentiality.
- Take appropriate technical and organisational measures (TLS in transit, password hashing, access logging, separation of privileges) in line with Article 32 GDPR.
- Notify the Customer of a personal data breach without undue delay and at the latest within 48 hours.
- Reasonably assist the Customer in responding to data subject requests and in meeting its obligations under Articles 32 to 36 GDPR.
- At the end of the Service, return or delete the data at the Customer's choice.
- Make available the information needed to demonstrate compliance with this Annex (section 6).
4. Sub-processors
The Customer gives general authorisation for the use of the sub-processors below. The addition of a new sub-processor is announced on this page, and the Customer has the right to object.
| Sub-processor | Purpose | Location |
|---|---|---|
| ElevenLabs, Inc. | Speech-to-text and speaker separation (audio recording) | USA |
| OpenAI, L.L.C. | Summaries, task lists, email analysis and mayAI answers (transcript, connected emails, text written to mayAI, meeting and calendar information read for an answer) | USA |
| DigitalOcean, LLC | Server and data hosting | Netherlands (EU) |
| Apple | App Store subscription and Sign in with Apple — no meeting data is transferred | USA / Ireland |
| Google LLC | Sign in with Google, Google Calendar if connected; website statistics only with the visitor's cookie consent — no meeting data is transferred | USA |
| Microsoft | Outlook / Teams calendar if connected — no meeting recording is transferred | USA |
| Expo (650 Industries) | Distribution of mobile app updates (IP address, app and device version) — no meeting data is transferred | USA |
5. International transfers
Transfers to the AI sub-processors (ElevenLabs, OpenAI) are based on the explicit consent obtained separately from the user in the app (Explicit Consent). In addition, work is under way to put standard contractual clauses in place with these sub-processors — the European Commission's Standard Contractual Clauses for data from the EU/EEA and the standard contracts under KVKK Art. 9 (as amended by Law No. 7499) for data from Türkiye. When this is complete, this page will be updated and the transfers will rest on these appropriate safeguards.
6. Audits
Once a year and with reasonable notice, the Customer may request information to audit compliance with this Annex. Requests are sent to info@mayassistant.com.