Data processing agreement
This agreement applies where you use Farkad as an organisation and are the controller of the personal data processed through it. It supplements the privacy policy and the terms of service.
Last updated
Roles
For data you instruct us to process on your behalf, you are the controller and Farkad is the processor under Article 28 GDPR. We process that data only on your documented instructions, unless a law we are subject to requires otherwise.
Subject matter and duration
The processing covers voice recordings and the health and habit entries extracted from them, for the duration of your use of the service. The categories of data subject are the individuals whose recordings you submit.
Subprocessors
We use Google Cloud and Firebase for hosting, storage and database, Google Vertex AI for transcription and extraction, and Stripe for payments. You authorise these subprocessors on entering this agreement, and we will give notice before adding or replacing one so you can object.
Security measures
Data is encrypted in transit and at rest. Access is scoped per user and enforced at the database and storage layer rather than in the client, application access to production is limited to those who need it, and staff bound to confidentiality are the only people with it.
International transfers
Storage and processing take place in Google Cloud's europe-west1 region, with one exception: transcription and extraction are served by Google's global endpoint, which may run the call in any region Google operates, because no European region serves the models this product runs on. What is sent there is the recording and the transcript, for the length of the call, and nothing is stored at the far end. Everything this service does store stays in Europe: the database, the audio and the traces in europe-west1, and the database backups in Google's eur3 European multi-region. Our users are in Canada, the United States and Algeria, and cross-border transfer is disclosed here because Law 25 requires it.
Assisting you
We will assist you in responding to data-subject requests, and in your obligations on security, breach notification and data-protection impact assessments, taking into account the nature of the processing and the information available to us.
Deletion and return
On termination we delete the personal data processed on your behalf, or return it, at your choice, except where retention is required by law. Audio follows the 30-day window stated in the privacy policy.