Data Processing Agreement.
Article 28, in plain sight.

1. Definitions and roles

“Data Protection Laws” means the laws that apply to the processing of Personal Data under this DPA, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and any other data-protection law that applies to the Customer. “Customer” means the entity that has accepted the Terms of Service; “LexVio” means Global Synapse Technologies; “Personal Data” means personal data contained in content the Customer submits to the Service. Terms like “controller”, “processor”, “data subject” and “personal data breach” have the meanings given by the applicable Data Protection Laws.

• Customer is the controller (or a processor acting for another controller) of Personal Data it submits to or generates via the Service.
• LexVio is the Customer's processor, processing such Personal Data only on the Customer's documented instructions, to provide the Service.
• For personal data LexVio collects for its own purposes (account holders, billing contacts, usage), LexVio is the controller — see our Privacy Policy.

2. Details of the processing

• Subject matter and nature: hosting, parsing, AI-assisted analysis, redlining, search and retrieval, and storage of documents the Customer submits; transcription and summarisation of meeting recordings the Customer submits; transcription of audio the Customer's users dictate (the dictated audio is transcribed and not stored).
• Purpose: providing the Service as configured by the Customer's authorised users.
• Duration: the term of the Customer's subscription, plus the deletion window in §12.
• Categories of data subjects: the Customer's personnel, counterparties, clients, and other individuals referred to in documents the Customer submits or speaking in meetings the Customer records.
• Categories of Personal Data: identification and contact details, professional and contractual information, voice and the content of what is said in a recorded meeting, and any other personal data the Customer's documents contain. The Service is not intended for special-category data; the Customer controls what it uploads.

3. Instructions

LexVio shall process Personal Data only on the documented instructions of the Customer — deemed to include use of the Service's features as configured by Customer-authorised users — including with regard to international transfers, unless required to do otherwise by law that applies to LexVio; in that case LexVio will inform the Customer before processing unless that law prohibits it. LexVio will inform the Customer immediately if, in its opinion, an instruction infringes applicable Data Protection Laws. LexVio shall not access Personal Data except as necessary to deliver the Service.

4. Customer obligations

• Customer warrants that it has a lawful basis for, and has given any required notices in respect of, the processing this DPA covers — including, for meeting recordings, any consent or notice the law of the place of recording requires.
• Customer is responsible for the accuracy and lawfulness of Personal Data it uploads, and for not uploading data categories prohibited by law or by its own notices.
• Customer is the point of contact for its data subjects; LexVio assists as set out in §8.

5. Confidentiality

LexVio ensures that persons authorised to process Personal Data are bound by contractual confidentiality obligations and have completed privacy and security training. Access is logged and reviewed periodically.

6. Security measures (Annex — Art. 32)

LexVio implements the following technical and organisational measures. Each line describes what is in place today; where a measure is in progress, it says so.

• Encryption — uploaded documents, data exports and database backups are written to object storage with server-side encryption at rest (AES-256; a customer-managed KMS key where the deployment configures one). Traffic is encrypted in transit with TLS 1.2 or later.
• Access control — role-based access within the Service; least-privilege defaults; Customer-set access policies (an IP allowlist, allowed platforms and a maximum session age, enforced on every authenticated request except sign-in and sign-out); LexVio-internal administrative endpoints are restricted to super-admin accounts of LexVio's own organisation. LexVio staff do not read Customer documents; access is limited to logged security or abuse investigations, or support the Customer asks for.
• Logging — append-only audit logs, enforced by database triggers that reject updates and deletes; retained for at least seven years.
• Backups — a database-backup job (nightly dump, integrity-checked, written to object storage in ap-south-1 with server-side encryption) is available and is switched on per deployment by the operator. We do not publish a backup retention period or a restore-test cadence until each is one we can evidence.
• Vulnerability management — automated dependency and static-analysis scans run weekly in CI. A third-party penetration test has not yet been performed; when one is, its date will be published on /trust.
• AI safeguards — every model vendor is reached only through a gated client: an air-gapped deployment (the AIR_GAPPED setting) disables every external model vendor and all telemetry; user-supplied text is screened for prompt injection before any model sees it; each request carries input and output token caps; and each organisation has a daily AI-spend ceiling that stops further model calls when reached. Customer administrators can additionally lower the model tier, switch individual AI features off and set their own daily AI-spend cap; prompt-injection hits and blocked requests are recorded with a content hash, never the prompt itself. Documents the Customer classifies as identity documents are never sent to any AI vendor and never indexed for retrieval. For the global edition, exported meeting minutes, Vio answers and redlined documents carry machine-readable AI-provenance metadata in the file (no visible banner).
• Personnel — background-checked staff; off-boarding deprovisioning within 24 hours.
• Certifications — SOC 2 (Security and Confidentiality criteria): controls mapped and evidence collected in-product; not yet audited. ISO/IEC 27001: not yet certified. Current status is published on /trust.

7. Sub-processors

Customer gives general written authorisation for LexVio to engage sub-processors to deliver the Service. LexVio imposes data-protection obligations on each sub-processor equivalent to those in this DPA, and remains liable to the Customer for their performance. The list below is the current, complete list. It is also published in machine-readable form at /api/v1/privacy/subprocessors, derived from the running deployment's configuration — an air-gapped deployment reports an empty list. Locations are those of the processing endpoint, as best we can state them.

• Amazon Web Services (ap-south-1, Mumbai, India) — object storage for uploaded documents, data exports and backups; transactional email. Receives uploaded documents, account data and backups.
• Anthropic (United States) — model inference for contract analysis, redlining and the copilot. Receives document text and prompt content submitted for analysis. Under Anthropic's API terms, customer content is not used to train its models.
• OpenAI (United States) — text embeddings for search and retrieval; multi-agent contract analysis when Deep Audit is used; speech-to-text transcription of meeting recordings (Meeting Intelligence); speech-to-text for voice dictation. Receives chunks of uploaded documents (other than identity documents), document text submitted for analysis, meeting audio together with the resulting transcript, and dictated audio (not retained by LexVio) with its transcript. Under OpenAI's API terms, customer content is not used to train its models.
• Google (United States) — multi-agent contract analysis when Deep Audit is used. Receives document text submitted for analysis. Under Google's API terms, customer content is not used to train its models.
• LlamaParse (United States) — document parsing and text extraction. Receives uploaded document files.
• Deepgram — speech-to-text transcription of voice input. Receives the raw audio you record or upload, in full. Processing region: not selected by our integration, so we do not assert one. Transfer safeguard: being confirmed.
• Twilio — WhatsApp delivery of notifications and assistant replies. Receives message bodies, including AI-generated replies, and recipient phone numbers. Location and transfer safeguard: being confirmed.
• Karza (India) — identity verification for professionals listing on a marketplace that exists only in LexVio's separate India edition; a global-edition account does not reach it. Receives those professionals' identity and bank-account details. Data processing agreement: being confirmed.
• Stripe — payment processing. Receives billing details; never document content.
• PostHog — product analytics (consent-gated on the marketing site; disabled entirely on an air-gapped deployment).
• Sentry — error monitoring (scrubbed of Personal Data; disabled entirely on an air-gapped deployment).

Channels the Customer connects with its own credentials.Where a Customer administrator connects the organisation's own email relay (SMTP), its own SMS account (Twilio) or its own WhatsApp Business account in the Integrations administration pages, that vendor is engaged by the Customer under the Customer's own agreement with it and acts as the Customer's processor, not as LexVio's sub-processor; it is therefore not listed above. Credentials are stored encrypted and are never shown back. Today only the organisation's email relay is used for sending; the SMS and WhatsApp configuration is used only for the test messages an administrator sends.

Where an entry says “being confirmed”, LexVio has not yet verified that vendor's processing location or transfer safeguard and will update this list when it has; the machine-readable register carries the same flag.

LexVio will give Customer at least 30 days' advance notice (by email to the account's primary admin) of any new or replacement sub-processor. Customer may object on reasonable data-protection grounds; if no workable accommodation is found, Customer may terminate the affected subscription for cause.

8. Assistance with data subject rights

Taking into account the nature of the processing, LexVio will assist the Customer by appropriate technical and organisational measures in responding to data subject requests — access, rectification, erasure, restriction, portability, objection. Standard self-service tooling is available in the app (Settings → Privacy: data export and account deletion); complex cases via support@globalsynapsetech.com within 5 business days. If a data subject contacts LexVio directly about Customer content, LexVio will refer them to the Customer without undue delay.

9. Personal data breach notification

LexVio will notify Customer of a confirmed personal data breach affecting Customer Personal Data without undue delay and in any event within 24 hoursof confirmation, with the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and remediation measures — so the Customer can meet its own notification obligations (e.g. GDPR Arts. 33–34). As the Customer's processor LexVio does not notify a supervisory authority about Customer content on the Customer's behalf; that is the Customer's decision as controller. LexVio will make its own notifications to authorities only where a law binding on LexVio requires them.

10. DPIAs and audits

LexVio will provide reasonable assistance with data protection impact assessments and prior consultation (GDPR Arts. 35–36) insofar as they concern the Service. LexVio makes available the information necessary to demonstrate compliance with this DPA: LexVio does not currently hold SOC 2 or ISO 27001 certification (see /trust); where it obtains such attestations it will provide the then-current reports on reasonable request, not more than annually, under confidentiality. Until then, LexVio responds to reasonable written security questionnaires, and will allow audits — including inspections — required by Data Protection Laws or a competent authority, with scope, timing and cost agreed in writing in advance.

11. International transfers

Uploaded documents, data exports and backups are stored in India (AWS ap-south-1) and content is processed by the sub-processors in §7 at the locations stated there — the AI vendors in the United States. India does not hold an EU or UK adequacy decision, so transfers from the EEA, the UK and Switzerland are made under appropriate safeguards:

• For EEA transfers, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller → processor), are incorporated into this DPA by reference, with the Annexes deemed completed by the details in §2 (description of processing), §6 (security measures) and §7 (sub-processors); the Customer is data exporter and LexVio data importer; option clauses are applied as published in the executed copy available on request.
• For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies to the clauses above.
• For Swiss transfers, the EU SCCs apply with the amendments required by the FDPIC.
• Sub-processor transfers are covered by equivalent clauses between LexVio and each sub-processor, except where §7 marks a sub-processor's safeguard as being confirmed.

LexVio will provide reasonable information to support the Customer's own transfer risk assessment on request, and will notify the Customer if it becomes unable to comply with these safeguards.

12. Return or deletion

During the subscription the Customer controls retention: a Customer administrator can set a retention period per document category, after which the stored file is purged automatically, and a retention period for meeting audio (the transcript and minutes are kept as the Customer's business record); without a period set, content is kept until the Customer deletes it. On termination of the Service, LexVio will, at Customer's choice and within 30 days, either return or securely delete all Personal Data, unless a law that applies to LexVio requires longer retention of a specific category (e.g. billing records), in which case that data is retained only as long and as far as that law requires.

13. Liability, precedence, execution

• Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service; nothing limits liability that cannot be limited under applicable law.
• If this DPA conflicts with the Terms, this DPA prevails for the processing of Personal Data; if the SCCs conflict with this DPA, the SCCs prevail.
• Customers are deemed to accept this DPA — including the clauses incorporated in §11 — on accepting the Terms of Service or executing an Order Form referencing this URL. Customers requiring a counter-signed copy should contact info@globalsynapsetech.com; we typically counter-sign within 5 business days.