Data processing

Roles

For the video material you upload, you are the controller and we are the processor. We act only on your instructions, which in practice means: process this file into clips using these settings, then delete it.

For your account and billing information we are the controller in our own right. That is covered by the privacy notice.

Subject matter and duration

Processing lasts for the duration of a job plus the retention windows stated below. It ends when you delete the material or close your account.

Categories of data

• Audio and video you submit, which may contain the voices and images of you and anyone present in the recording.
• Transcripts derived from that audio.
• Voice profiles, where you create them. These are biometric data and receive the stricter handling described in the privacy notice.

Our obligations

• Process only on your documented instructions.
• Keep the data confidential and limit staff access to those who need it.
• Apply encryption in transit and at rest, signed and expiring download links, and least-privilege access to production systems.
• Not engage a new sub-processor without telling you first.
• Assist you in responding to data subject requests.
• Notify you without undue delay of a personal data breach affecting your material.
• Delete or return the data at the end of processing.

Sub-processors

Purpose	Data seen	Region
Object storage & delivery	Source video, finished clips	EU
Render compute	Source video, audio	EU (own servers)
GPU transcription	Extracted audio only, never video	EU where available
Payments	Billing data only — no footage	EU / US (SCCs)
Transactional email	Email address only	EU / US (SCCs)

Note the third row: only extracted audio is sent to GPU capacity for transcription. Your video never leaves our own servers.

International transfers

We prefer EU regions throughout. Where a provider operates outside the EEA, transfers rely on Standard Contractual Clauses together with supplementary technical measures — principally encryption and data minimisation.

Retention and deletion

• Source video: deleted on collection of results, or 7 days after completion.
• Clips, transcripts and measurements: 30 days.
• Voice profiles: until you delete them.
• Backups holding any of the above are rotated out within 30 days.

Audits

Studio customers may request our current security documentation and a written answer to a reasonable due-diligence questionnaire once per year.

Signing this

If your organisation needs a countersigned agreement, write to legal@vigge.pro and we will provide one.