These are the terms we offer, in full, with nothing left open. It does not bind on its own: write to legal@sayli.ai and we will issue the executed version for your organization, which is the one that counts.
This is a template Data Processing Addendum for customers who need one. It supplements the Terms of Service when Sayli processes personal data on a customer's behalf.
Parties and roles
The customer is the controller. SAYLI, LLC, an Illinois limited liability company, is the processor. Sayli processes personal data only on the customer's documented instructions, which are: provide the service as described in the Terms and as configured by the customer in the product.
Scope of processing
The customer is responsible for having a lawful basis for the processing, including any consent that call-recording law requires. See Recording consent guidance.
Confidentiality
Persons authorized to process the personal data are bound by confidentiality obligations.
Security measures
Sayli applies the measures described in the Security overview. In summary: encryption in transit and at rest, per-organization tenant isolation enforced in the data model, redaction of sensitive strings at ingest, short-lived signed URLs for object access, short-lived access tokens with rotating refresh tokens, an audit log of state-changing actions, and scrubbing of error telemetry.
Subprocessors
Sayli discloses its subprocessors, with what each one processes and where it runs, to the customer under this DPA or a mutual NDA. Request the current list at privacy@sayli.ai. The customer gives general authorization for the subprocessors on that list. Sayli will give notice before adding or replacing a subprocessor, and the customer may object on reasonable data protection grounds.
Notice is at least 30 days. The customer may object in writing on reasonable data protection grounds within that period, and if the objection cannot be resolved the customer may end the affected part of the service and Sayli refunds the unused fees. This matches the Privacy Policy.
Sayli imposes data protection terms on each subprocessor that are no less protective than this DPA, and remains responsible for their performance.
International transfers
Personal data is processed in the United States, product analytics included.
Sayli is a United States company and processes personal data under United States law. We do not offer data residency outside the United States and we do not operate a European transfer programme. A customer who needs one should raise it with legal@sayli.ai before signing, not after.
Assistance
Taking into account the nature of the processing, Sayli assists the customer with data subject requests, security, breach notification, and data protection impact assessments. Sayli notifies the customer within 72 hours of confirming a personal data breach affecting that customer's data, and sooner where we can. The first notice says what we know at the time, which will not be everything. We keep the customer updated as we learn more rather than waiting until the picture is complete, because the customer has their own clock to meet and needs the early version more than the tidy one.
Deletion on termination
On termination of the subscription, or earlier on the customer's documented instruction, Sayli deletes the customer's personal data. Users can also delete meetings and accounts directly in the product, which erases the associated recordings, transcripts, briefs, and search embeddings. On request, Sayli confirms deletion in writing. Deleted data can persist in encrypted backups for up to 35 days before being overwritten.
Audits
Sayli makes available the information reasonably necessary to demonstrate compliance with this DPA.
Concretely, once in any twelve months a customer may send a written security questionnaire, and Sayli answers it and provides its supporting documentation within 30 days. Each side carries its own costs.
An on-site or third-party audit is available in one circumstance: after a confirmed security incident affecting that customer's data. It runs on 30 days notice, under a non-disclosure agreement, during business hours, scoped to the systems that handle that customer's data, and it must not touch any other customer's data. The customer pays for it unless the incident was caused by Sayli's failure to meet this DPA, in which case Sayli does.
Where Sayli holds a current third-party audit report, that report satisfies this section and replaces the questionnaire. Sayli holds none today; the Security overview says what exists and what does not.