How it works
Data Processing Addendum, step by step
Article 28, point by point
Instructions, confidentiality, security, other processors, help with people's requests, help with your own obligations, deletion or return at the end, and information and audits, each said in what Hazelsong actually does, in the order of Article 28(3) of the GDPR and of the UK GDPR.
The companies are read from the code
The list of companies that receive personal data is one file, and a check fails if the code calls a vendor the list does not name, or the list names one the code never calls. Each entry says what that company receives and what its own terms say, as read on a printed date, including where no data processing addendum was found.
A new company is announced 30 days ahead
Before a new company receives any of your customers' data, it is listed on the page and in its machine-readable copy at /dpa/subprocessors.json with the day it starts, at least 30 days later, and you may object in that time. The check refuses a new entry announced later than that.
Transfers, California and Canada
The EU standard contractual clauses (modules two and three) and the UK Addendum are incorporated by reference with their options chosen; the page also carries the California service-provider terms and the written mandate Quebec's privacy act asks for.
Recordings are not training material
Every recording sent to Deepgram for a transcript carries Deepgram's opt-out from using it to train its models, because Deepgram's terms train on what is sent unless each request opts out.
Safe by design
The rule that makes it safe to have
Clear boundaries
What it will not do
Every capability page ends with this list. It is the part that says what you are actually buying.
- It will not claim compliance with any law, or a certification Hazelsong does not hold.
- It will not name a representative in the EU or the UK: none is appointed, and the page says nothing it cannot back.
- It will not treat a writer's permission to publish as the business's legal basis for processing, or as consent to anything on a visitor's device.
- It does not yet state the regions in which the database and file storage hold data.
- It does not email you when a company is added: the page and its machine-readable copy are where the 30 days' notice is given.
- It is not legal advice, and it does not decide for you whether your own collection is lawful.
Where it lives in the code: app/dpa/page.tsx · app/dpa/subprocessors.json/route.ts · lib/subprocessors.ts · app/terms/page.tsx · app/privacy/page.tsx · app/api/transcribe/route.ts · scripts/dpa-check.mjs
This is running now
Open a project and use it. Nothing on this page is a roadmap.