Data Processing Addendum

For the private beta, the customer under this addendum is the invited user only when that user determines the purposes and means of processing for their own professional activity. If content is controlled by an organisation, that organisation—not its employee or other authorised user—is the controller. Organisational use is not permitted until the operator has separately recorded the organisation's legal identity, the representative's authority, and the organisation's written acceptance of this DPA. The FrameSense operator identified below is the processor for approved customer content. FrameSense remains a controller for account administration, security, billing, and its own legal obligations.

Operator

Martin Simon

Registration identifier

I?O 11979500

Registered address

Kbelnice 42, 336 01 Letiny, Czech Republic

Legal contact

framesense@seznam.cz

• Subject: technical and, when requested, semantic quality review of uploaded media, optional scripts, supporting documents, images, and pasted text.
• Duration: FrameSense-held customer content follows the selected access-retention period plus asynchronous physical deletion, which may take longer during retries or incidents. When Sense Review is enabled, OpenAI documents no application-state retention for audio transcription; comparison and optional Review-insight calls set application-state storage to false, but abuse-monitoring logs may ordinarily remain for up to 30 days, or longer where required by law or safety needs, unless the project has approved Zero Data Retention or Modified Abuse Monitoring.
• Nature: upload, storage, local document extraction and sampled-shot text recognition, transcription, technical checks, optional script and supporting-material comparison, evidence summaries, sampled-frame visual/content insights, project and version comparison, suggested chapters and alternative wording, display, and deletion.
• Supporting materials may include PDF, DOCX, TXT, MD, CSV, XLSX and EML files, PNG, JPEG and WebP images, and pasted text. Extraction and review are bounded; available coverage and limitations accompany the result.
• Sense Review may send extracted audio, up to six reduced-size video-frame samples, bounded transcript excerpts and optional script-comparison windows to OpenAI. Supporting materials may add bounded extracted text, source names and locations, and up to 20 reduced-size images or rendered pages to the same insights request. Original video and complete attachment files are not uploaded to OpenAI as files; selected image or page samples can still contain personal data.
• Document preparation and sampled-shot text recognition run in FrameSense workers. Stored shot-preview JPEGs and original attachments follow media expiry; result evidence, project and version metadata, and recognised shot text can remain as described in the Privacy Notice.
• Purpose: provide, secure, support, and troubleshoot the analysis requested by the customer.
• Data subjects: people appearing or speaking in customer content and people named or described in scripts, documents, emails, spreadsheets, images, or pasted text.
• Data types: image, voice, statements, identifiers, production metadata, and any other personal data the customer includes.

Customers must not submit special-category or criminal-offence data unless they have documented a lawful basis and explicitly agreed the additional safeguards with the operator.

The operator processes customer content only to provide the requested FrameSense service, follow documented customer instructions, protect the service, and comply with law. If an instruction appears unlawful, the operator will inform the customer unless prohibited by law.

Access is limited to authorised people and service accounts subject to confidentiality and least-privilege controls. FrameSense uses encrypted transport, managed encryption at rest, isolated roles, owner-scoped application access, bounded logs, and deletion workers described in the service documentation.

The providers below may process customer content or related service data only for the stated purpose. Their current roles and processing locations are also described in the Privacy Notice. By accepting this DPA, the customer gives general written authorisation for the listed sub-processors. Before adding or replacing a sub-processor that will process customer content, the operator will give reasonable prior notice through the account email or in-product legal notice and publish a new legal-document version.

• Vercel: Hosts and delivers the web application and runs its server-side web functions. The beta web runtime may process requests outside the European Economic Area.
• Neon: Provides the PostgreSQL database for accounts, analysis and source state, findings, quoted evidence, project and version-comparison metadata, recognised shot text, credits, and billing state. The private-beta database is configured in the EU Central (Frankfurt) region.
• Amazon Web Services: Provides private object storage, work queues, analysis workers, and operational security logs. FrameSense private-beta workloads use AWS eu-central-1 (Frankfurt).
• OpenAI: Receives extracted audio for transcription, optional bounded script/transcript comparison windows, and up to six reduced-size sampled video frames, bounded transcript excerpts, completed-check evidence and selected findings for visual/content advice, suggested chapters and alternative wording when a user requests enabled Sense Review. Optional supporting documents, images and pasted text add bounded extracted text, source names and locations, and up to 20 reduced-size images or rendered document pages to the same insights request. The original video is not sent to OpenAI as a file, and complete attachment files are not uploaded; selected image or page samples can still contain personal or confidential information. Comparison and insights requests set application-state storage to false; provider abuse-monitoring logs may ordinarily be retained for up to 30 days, or longer for legal or safety needs, unless approved provider retention controls apply. Sense Fast does not call OpenAI. OpenAI may process data outside the European Economic Area under the operator's applicable provider terms and transfer safeguards.

The customer may object before the announced change takes effect on reasonable data-protection grounds. The parties will try in good faith to resolve the objection; if they cannot, the customer may stop the affected processing or terminate the affected service. The operator will bind every sub-processor to data-protection obligations that provide materially the same protection required by this DPA and remains responsible to the customer for the sub-processor's performance.

Where personal data is transferred outside the EEA, the operator will use the transfer mechanism and supplementary safeguards approved for the applicable provider relationship.

Taking account of the processing, the operator will reasonably assist the customer with security, impact assessments, regulator consultations, and requests to access, correct, restrict, export, or delete customer-content data. A person represented in customer content should normally contact the uploader or other controller first. The operator will route a properly identified request to that controller and avoid disclosing another customer's data.

The operator will notify the customer without undue delay after becoming aware of a personal-data breach affecting its customer content. Available details needed for the customer's response may follow in phases as the investigation progresses. At the end of service, the operator will delete or return customer content as instructed, except for data that law requires it to retain. Media deadlines and account-deletion handling are described in the Privacy Notice.

On reasonable written request, the operator will provide information needed to demonstrate compliance with this addendum. Any audit must protect other customers, confidential systems, and provider security, use existing independent evidence first, and avoid unnecessary disruption.

The customer decides whether uploaded content may lawfully be processed, gives complete and lawful instructions, handles notices and requests as controller, and uses access controls appropriate to the content. If this addendum conflicts with the Terms on processing customer content, this addendum controls for that processing; mandatory data-protection law always prevails.