Data processing agreement

Parties and roles

The customer is the controller of employee data in Newstail. Plailab AB is the processor and processes the data only on the customer's instructions, which are to deliver the service.

What is processed

Name, work email, role, language, topics, listening history, quiz answers and internal messages (text and audio). Data subjects: the customer's employees.

Sub-processors

• Supabase – database, sign-in and audio files. EU (Stockholm).
• Google (Gemini) – the host's voice and transcription of voice messages. Global.
• Anthropic – writes the broadcast text, recap and quiz. USA.
• Perplexity – searches for news. Receives no personal data. USA.
• Apple – notifications to iPhone. Global.
• Resend – sign-in and reminder emails. EU (Ireland).
• Stripe – payment and receipts. EU (Ireland).

We notify the customer before a sub-processor is added or replaced. [Right to object and notice period – under review.]

Security

Encrypted traffic, access per company and team in the database, and individual data that is never shown to the customer – only aggregates from five people. [Full list of measures.]

Incidents

We notify the customer without undue delay of a personal data breach. [Time limit.]

Deletion

When the customer leaves, the company and all employee data are deleted. Billing records are kept for 7 years as required by Swedish bookkeeping law.

• Transcripts of voice messages: 30 days.
• Daily news lists: 60 days.
• Recaps: 90 days. Audio from internal messages: 90 days (the text remains).
• Listening history: 13 months.
• Billing records: 7 years, as required by Swedish bookkeeping law.
• Account: deleted completely when you delete it.

Signed agreement

Need a signed copy before you start? Email hello@newstail.io. [Downloadable PDF.]