Where is the data processed? How long and where is it stored (is any storage outside EEA countries)?
Data is processed under our control within defined retention periods, with no long-term storage by the cloud provider; only non-personal connection logs are stored for billing.
Disclaimer:
This FAQ provides brief answers to frequently asked questions and serves as general guidance only. It does not replace legal advice or binding documentation. For the most up-to-date and legally relevant information, please refer to our official legal documentation at Deepva.ai/legal/.
If you have any legal questions or concerns, feel free to contact us directly.
The processing and storage of DeepVA’s content-related media data takes place exclusively within the European Economic Area (EEA), primarily in Germany. This includes established cloud infrastructures such as Oracle, AWS (Germany), Telekom Cloud, and other European service providers.
When using our AI platform in an on-premises setup, data is processed solely within the infrastructure provided by the customer.
We retain full data ownership. Our cloud providers have no independent rights to store or process data beyond what we explicitly define. This means the provider cannot retain data beyond the agreed-upon retention period.
A detailed list of processing arrangements and subprocessors can be found in our Data Processing Agreement (DPA).
Retention period
Data is only stored for as long as necessary for processing purposes. For example, transcripts are retained for 30 to 90 days, depending on the module, to allow for optional post-processing such as summarization or translation.
Customers may delete their data manually at any time before the end of this period.
Subprocessors outside the EEA
We use a small number of subprocessors outside the EEA for clearly defined, non-content-related services (e.g., CRM and billing). These include:
-
HubSpot (USA): CRM platform
-
Chargebee (USA/EU) & Stripe (EU): billing-related metadata
All subprocessors are bound by strict data protection agreements. Where applicable, EU Standard Contractual Clauses (SCCs) are in place to ensure GDPR compliance.
Exception – connection records
For billing purposes, connection metadata is temporarily stored. These records do not contain personal data and are not connected to transcription content.