---
title: "Data Processing Addendum | Speakeroo"
description: "Data Processing Addendum for organizations on Speakeroo: roles, subprocessors and where they process, breach notice, and why Speakeroo is not for health records."
url: "https://speakeroo.app/dpa"
---

# Data Processing Addendum

Last updated: October 12, 2026

## Who This Addendum Covers

This Data Processing Addendum ("Addendum") is between Simple Pi Pty Ltd ("Speakeroo", "we") and every organization on Speakeroo, whether a Team or a class ("you"). It forms part of our [Terms of Use](https://speakeroo.app/terms) and applies from the moment your organization is set up. Nothing needs to be signed.

- **You are the controller** of the personal information your members share with your organization: the sessions they hand in or share, recordings you add for them, feedback, notes, goals, plans, messages and enrolment details
- **We are your processor** for that information and use it only to provide the Service to you, on your instructions as set through the Service and these terms
- Each member's own account, and practice they have not shared with you, stays under our [Privacy Policy](https://speakeroo.app/privacy), where we are the controller

## Not for Health Records

Speakeroo is a speaking practice tool. It is not a health record, a medical device, or a clinical assessment, and its scores are practice feedback rather than clinical or diagnostic measures.

- We do not sign HIPAA business associate agreements. If you are a HIPAA covered entity or business associate, you must not use Speakeroo with protected health information
- Therapists and coaches may use Speakeroo for practice between sessions. Keep diagnoses, treatment plans and clinical notes in your own records system, not in Speakeroo
- Where a client's recordings are health information under the law that applies to you, you are responsible for having a lawful basis and any consent needed to ask them to practise here

## What We Commit To

- Process your organization's information only to provide the Service to you
- Never sell it, or use it for advertising
- Limit access to staff who need it to run and support the Service, under a duty of confidentiality
- Encrypt it in transit and at rest
- Help you answer requests from your members to access, correct or delete their information
- Tell you without undue delay, and within 72 hours of becoming aware, of a breach that affects your organization's information, with what we know and what we are doing about it
- Answer reasonable written questions about how we protect your information

## Controls Your Organization Has

- **Consent at join:** members agree to your organization's recording terms before they join
- **Audio retention:** an owner can have recordings your organization can see deleted after a set number of days, keeping transcripts and scores. It applies to members who agreed to the current retention terms
- **Audit log:** a record of who opened, played or exported a member's recordings, and of changes to the roster and settings

## Subprocessors and Where They Process

You authorize us to use these subprocessors, each under its own data processing terms.

| Subprocessor | Purpose | Location |
| --- | --- | --- |
| Convex | Database and recording storage | United States |
| OpenAI | Transcribing recordings and analysing transcripts | United States |
| Google (Gemini API) | Analysing recordings | Worldwide |
| AssemblyAI | Transcribing recordings | United States |
| Deepgram | Standby transcription provider | United States |
| Langfuse | Checking the quality of AI analysis (transcripts and results, no audio) | European Union |
| WorkOS | Sign-in, invitations and SSO | United States |
| Stripe | Organization billing | United States |
| Cloudflare | Content delivery and email delivery | Worldwide |
| Expo | Push notifications to the mobile app | United States |
| PostHog | Product analytics and web error reports | European Union |
| Sentry | Mobile app error reports | United States |

We email organization owners at least 30 days before a new subprocessor starts processing your information. If you object, tell us within that time and you may cancel without penalty before the change takes effect.

## International Transfers

Your organization's information is stored in the United States and processed in the places listed above. Where the GDPR or UK GDPR applies to a transfer, the European Commission's standard contractual clauses (and the UK addendum to them) are incorporated into this Addendum, with you as data exporter and us as data importer. For Australian organizations, we handle information overseas in line with the Australian Privacy Principles.

## When Your Organization Leaves

Email [support@speakeroo.app](mailto:support@speakeroo.app) after your subscription ends and we will delete your organization's information within 30 days, apart from billing records we must keep by law. Members keep their own accounts and the practice they did not share with you.

## Contact

Questions about this Addendum, a security questionnaire, or a breach: [support@speakeroo.app](mailto:support@speakeroo.app).

© 2026 Simple Pi Pty Ltd. All rights reserved.