This Data Processing Addendum (“DPA”) forms part of the agreement between Lumivo LLC (“Lumivo”) and the business customer identified in an order or CapyCue account (“Customer”) when Lumivo processes Personal Data in Customer Content on Customer's behalf.
1. Roles and scope
Customer is the controller or business, and Lumivo is the processor or service provider, for Personal Data contained in Customer Content. Each party is independently responsible for Personal Data it processes for account administration, billing, security, fraud prevention, and its own legal obligations. Terms such as controller, processor, business, service provider, personal data, processing, and data subject have the meanings in applicable data protection law.
2. Customer instructions
Lumivo will process Customer Personal Data only to provide and secure CapyCue, follow Customer's documented product settings and support requests, comply with the agreement, and meet legal obligations. The agreement, this DPA, Customer's use of features, and authorized support instructions are Customer's documented instructions. Customer is responsible for ensuring instructions and Customer Content comply with law and for providing required notices and obtaining required rights and consent.
3. Processing details
- Subject matter: hosting and AI-assisted processing of screen recordings and walkthroughs.
- Duration: the term of the agreement plus the deletion and backup period described in the Privacy Policy.
- Nature and purpose: recording upload, storage, transcription, screenshot analysis, script and step generation, synthetic speech, rendering, versioning, publishing, embeds, analytics, support, security, and deletion.
- Data subjects: Customer users, employees, contractors, customers, viewers, and other people whose information appears in Customer Content.
- Data types: account identifiers, audio, images, screen contents, transcripts, names, voices, communications, device and usage data, and any other information Customer chooses to capture.
4. Confidentiality and security
Lumivo will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations. Lumivo will maintain reasonable technical and organizational measures appropriate to the risk, including access controls, encryption in transit, protected cloud storage, logging, monitoring, vulnerability management, backup practices, and incident response.
5. Subprocessors
Customer authorizes Lumivo to use subprocessors to provide CapyCue. Current categories include Microsoft Azure for cloud hosting, storage, database, identity-related infrastructure, and media processing; OpenAI for transcription, text-and-vision analysis, image generation for product content, and synthetic speech; payment providers for billing; and providers for communications, monitoring, and support. Lumivo remains responsible for subprocessor performance to the extent required by applicable law and its agreement with Customer.
Lumivo will make a current subprocessor list available and provide a reasonable method for subscribing to material-change notices before enterprise launch. Customer may object on reasonable data-protection grounds within the notice period. The parties will work in good faith on a commercially reasonable alternative; if none is available, either party may terminate the affected service.
6. Data subject requests
Taking into account the nature of processing, Lumivo will provide reasonable assistance for Customer to respond to requests to access, correct, delete, restrict, object to, or export Customer Personal Data. If Lumivo receives a request relating to Customer Content, it may direct the requester to Customer unless law prohibits doing so.
7. Security incidents
Lumivo will notify Customer without undue delay after becoming aware of a confirmed breach of Customer Personal Data processed under this DPA. Notice will include available information reasonably needed for Customer's legal obligations. Notification is not an admission of fault or liability. Customer is responsible for notifications arising from Customer's systems, credentials, configuration, or unlawful instructions.
8. Assistance and audits
Lumivo will provide information reasonably necessary to demonstrate compliance with this DPA and reasonable assistance with data protection assessments, regulator consultations, and security reviews, considering the nature of processing and information available to Lumivo. Audits must be proportionate, protect other customers and Lumivo confidential information, avoid operational disruption, and ordinarily rely first on current third-party reports and written responses. Customer bears audit costs unless a material breach is found.
9. Return and deletion
At termination or Customer's documented request, Lumivo will delete or return Customer Personal Data as provided by product controls and the agreement, unless law requires retention. Data may remain in protected backups until expiration under Lumivo's normal backup cycle.
10. International transfers
Where applicable law requires a transfer mechanism, the parties will incorporate the applicable standard contractual clauses or other lawful mechanism. Any required module selections, supplemental measures, or regional processing commitments must be documented in an order or signed addendum.
11. Conflict and contact
If this DPA conflicts with the agreement on processing Customer Personal Data, this DPA controls. Requests concerning this DPA may be sent to support@capycue.com.