- The customer decides. We process workspace data only to provide Speakfold, on the customer’s instructions.
- Named providers. The companies that help us are listed, and admins hear before a new one is added.
- Breaches reported fast. Within 48 hours of us knowing.
- Deleted at the end. The customer can export and delete at any time; we delete within 30 days when asked.
Scope
These terms apply when Speakfold (the “processor”) processes personal data for a customer (the “controller”) in a Speakfold workspace. Words like personal data, processing and breach mean what they mean in the GDPR (EU 2016/679).
Roles and instructions
The customer decides why and how workspace data is processed and is responsible for having a legal basis for it and for informing its people. We process it only on the customer’s documented instructions: our terms, how the customer’s admins set up and use Speakfold, and their written requests. If we believe an instruction breaks data protection law, we say so. We may also use counts of how the product is used, with nothing that identifies a person, to improve Speakfold.
What we process
| Item | Details |
|---|---|
| Subject | Providing Speakfold: planning and drafting LinkedIn posts and comments in each person’s voice, posting what people approve, reminders, and results; and, when the customer turns it on, showing who engaged with its posts. |
| Duration | While the customer uses Speakfold, and until deletion at the end. |
| Nature | Storing, organising, analysing with an AI model, sending to LinkedIn and Slack as people choose, reading the public reactions and comments on the customer’s posts through a provider when the customer turns it on, sending people to the customer’s CRM when an admin asks, displaying, deleting. |
| People concerned | The customer’s employees and others it invites; people whose posts or comments users paste to write a reply; people who react to or comment on the customer’s posts, when Who engaged is on. |
| Kinds of data | Names, roles, work emails, time zones and languages; what people tell Speakfold (interviews, notes, ideas, voice clips as text); drafts and approved posts and comments; LinkedIn files people add (their own posts and numbers); pasted posts and comments; company information; use of the app; LinkedIn and Slack connection keys; for Who engaged, the public names, headlines, profile links and pictures of people who reacted or commented, their reactions and comments, and the fit Speakfold read from the headline (kept 90 days). |
| Special categories | Not needed and not expected. The customer asks its people not to enter them. |
Confidentiality
Everyone at Speakfold who can reach workspace data is bound to keep it confidential, and opens it only to run and secure the service or when the customer asks for help.
Security measures
- Encryption in transit (HTTPS) and at rest in the database.
- LinkedIn and Slack keys sealed with AES-256-GCM, never sent to a browser.
- Sign-in by single-use links stored only as a fingerprint; sessions signed and checked against the database on every request.
- Each workspace separated: every request and every change checks the person and their workspace and role.
- Access to production limited to the people who run Speakfold, with two-step sign-in.
- Backups by the database provider, rolling over within 30 days.
- Records of AI tasks without their content, and checks that warn us when part of the service stops.
Providers
The customer authorises us to use the providers below. They are bound by contract to the same protection. We tell admins at least 30 days before adding or replacing one; the customer may object on reasonable grounds, and if we can’t find a solution together, it can end the affected service.
| Provider | What for | Where |
|---|---|---|
| Vercel | Runs the app and the website | USA, with servers in the EU and worldwide |
| Supabase | The database where workspaces are kept | EU |
| Anthropic | The AI model (Claude) that writes drafts, ideas and comments and reads websites and documents | USA |
| Resend | Sends sign-in links, invites and reminders by email | Sent from the EU (Ireland); company in the USA |
| OpenAI | Turns voice clips into text when Slack hasn’t | USA |
| Stripe | Card payments and invoices | EU (Ireland) and USA |
| Apify | Reads the public reactions and comments on the team’s LinkedIn posts for Who engaged | Company in the EU (Czech Republic); may process in the USA |
LinkedIn and Slack are services the customer’s people choose to connect. They act under their own terms and are not our providers.
Transfers outside the EU
Workspace data is stored in the EU. When a provider processes it outside the EU and EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on the European Commission’s standard contractual clauses.
Helping the customer
We help the customer answer people’s requests to see, correct, delete or take their data; Speakfold has Download my data, removing a person and deleting the workspace built in. We also help, as far as is reasonable, with security, data protection impact assessments and questions from authorities. If a person contacts us directly about workspace data, we pass it to the customer.
Personal data breaches
We tell the customer without undue delay, and within 48 hours of becoming aware of a breach that affects its data, with what we know: what happened, the data and people concerned, the likely effects, and what we are doing about it. We keep the customer updated as we learn more.
At the end
Admins can export data and delete the workspace at any time. When the agreement ends, and the customer asks, we delete the remaining workspace data within 30 days, unless the law requires us to keep it. Backups roll over within 30 days after that.
Information and audits
We give the customer the information it needs to show these terms are followed. The customer, or an auditor it appoints under confidentiality, may audit once a year with 30 days’ notice, more often after a breach, at its own cost and without disturbing the service or other customers’ data.
How this fits with the terms
These terms are part of our terms of service, and the liability terms there apply. Where they differ on data protection, these terms win. Questions go to hello@speakfold.com.