Data Processing Agreement
Mandra Voice
Version 1.0 · Effective 18 September 2026
This Data Processing Agreement ("DPA") forms part of the agreement between YAANTRIX Technologies Inc. ("Mandra Voice", "Processor", "we") and the customer identified in the applicable Order Form or account ("Customer", "Controller", "you") for the Mandra Voice services (the "Agreement"). It applies wherever Mandra Voice processes personal data on Customer's behalf under an Enterprise or team plan, and it reflects the requirements of GDPR Article 28, UK GDPR Article 28, PIPEDA, Quebec Law 25, and the CCPA/CPRA service-provider provisions.
For individual users on Basic, Pro, or Pro + Read Aloud plans, Mandra Voice is the controller of your personal information and the Privacy Policy applies instead; this DPA is not needed.
How to execute: an Enterprise Order Form that references this DPA incorporates it. No separate signature is required. If your procurement process needs a countersigned copy, email support@mandravoice.com and we will return one within five business days.
1. Definitions
- Personal Data — any information relating to an identified or identifiable natural person that Mandra Voice processes on Customer's behalf under the Agreement.
- Processing, Controller, Processor, Data Subject, Supervisory Authority, Personal Data Breach — as defined in GDPR Article 4, and read to include the equivalent concepts under UK GDPR, PIPEDA, Quebec Law 25, and the CCPA.
- Data Protection Laws — all laws applicable to the Processing of Personal Data under the Agreement, including GDPR, UK GDPR, the Swiss FADP, PIPEDA and Canadian provincial privacy statutes, and US state privacy laws including the CCPA/CPRA.
- Subprocessor — a third party engaged by Mandra Voice to Process Personal Data on Customer's behalf.
- Standard Contractual Clauses or SCCs — the clauses approved by European Commission Decision 2021/914, and for UK transfers the UK International Data Transfer Addendum issued by the ICO.
- Authorised Users — Customer's employees, contractors, and agents whom Customer permits to use the services.
2. Roles and scope
2.1 Roles. Customer is the Controller (or, where Customer itself acts for a third-party controller, a Processor) and Mandra Voice is the Processor of Personal Data Processed under the Agreement. Where the CCPA applies, Mandra Voice is a "service provider" and Customer is a "business".
2.2 Subject matter and duration. Mandra Voice Processes Personal Data to provide the Mandra Voice dictation, text-improvement, and Read Aloud services to Customer and its Authorised Users, for the term of the Agreement and until deletion under §11.
2.3 Nature and purpose. Capturing Authorised Users' voice audio while they dictate; converting it to text; optionally improving the text; inserting it into the Authorised User's application; storing transcripts and settings under Customer's chosen retention period; metering usage; and providing team administration. Annex I sets out the details.
2.4 Categories of Data Subjects and Personal Data. As set out in Annex I.
2.5 Mandra Voice as Controller. Mandra Voice remains an independent Controller for account administration, billing, security logging, and compliance with its own legal obligations, as described in the Privacy Policy. This DPA does not apply to that Processing.
3. Customer's obligations
3.1 Customer is responsible for the lawfulness of its instructions, for having a lawful basis (and, where required, consent) for the Processing, and for providing any notices to Data Subjects that Data Protection Laws require.
3.2 Customer is solely responsible for ensuring that Authorised Users comply with the Acceptable Use Policy, including the requirements relating to recording consent and the prohibition on protected health information.
3.3 Customer warrants that it will not instruct Mandra Voice to Process special-category data (GDPR Article 9), health information subject to HIPAA or equivalent law, or data of children below the age of digital consent, except as expressly agreed in writing.
4. Mandra Voice's obligations
4.1 Instructions. Mandra Voice will Process Personal Data only on Customer's documented instructions, which are: the Agreement, this DPA, the configuration Customer and its Authorised Users set in the services, and any further written instructions Customer gives. Mandra Voice will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until resolved.
4.2 No secondary use. Mandra Voice will not sell, share, rent, or disclose Personal Data, will not use it for its own purposes, and will not use it — or permit any Subprocessor to use it — to train, fine-tune, or improve any machine-learning model. Audio is not retained by Mandra Voice or its Subprocessors after transcription.
4.3 Confidentiality. Mandra Voice will ensure that every person authorised to Process Personal Data is bound by a written confidentiality obligation and receives appropriate training. Access is limited to personnel who need it to provide or support the services.
4.4 Security. Mandra Voice will implement and maintain the technical and organisational measures in Annex II, and will not materially decrease the overall level of protection during the term.
4.5 Assistance. Taking into account the nature of the Processing, Mandra Voice will assist Customer, by appropriate technical and organisational measures, in responding to Data Subject requests (§8), and in meeting Customer's obligations regarding security, breach notification, data protection impact assessments, and prior consultation with Supervisory Authorities. Assistance beyond what the services provide as standard may be charged at Mandra Voice's then-current professional-services rates.
4.6 Records and compliance. Mandra Voice maintains a record of Processing activities as required by GDPR Article 30(2) and will make it available to a Supervisory Authority on request.
5. Subprocessors
5.1 Authorisation. Customer gives general written authorisation for Mandra Voice to engage the Subprocessors listed at mandravoice.com/subprocessors as of the effective date, and any Subprocessors added under §5.3.
5.2 Flow-down. Mandra Voice will impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, including the prohibition on model training and audio retention in §4.2, and remains fully liable to Customer for each Subprocessor's performance.
5.3 Changes. Mandra Voice will give Customer at least 30 days' written notice (by email to the account owner and by updating the Subprocessors page) before authorising a new Subprocessor to Process Personal Data. Customer may object on reasonable data-protection grounds within that period by emailing support@mandravoice.com. The parties will discuss in good faith; if no resolution is reached before the change takes effect, Customer may terminate the affected services and receive a prorated refund of prepaid fees for the remainder of the term. This is Customer's sole remedy for an objection.
5.4 Emergency replacement. Where a Subprocessor must be replaced urgently for security or continuity reasons, Mandra Voice may do so with shorter notice and will explain the reason; Customer's objection right in §5.3 still applies.
6. International transfers
6.1 Mandra Voice is established in Canada. The European Commission has recognised Canada (Decision 2002/2/EC) as providing adequate protection for Personal Data transferred to commercial organisations subject to PIPEDA, and the UK has retained that finding. Transfers from the EEA, UK, and Switzerland to Mandra Voice are made on that basis.
6.2 Onward transfers to Subprocessors in the United States rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the Subprocessor is certified, and otherwise on the SCCs (Module 3, processor to processor) together with the supplementary measures in Annex II. Where the SCCs are required between Customer and Mandra Voice directly, they are incorporated by reference with Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, Customer as data exporter, Mandra Voice as data importer, the optional docking clause included, Clause 9 Option 2 with the notice period in §5.3, Clause 17 Option 1 with the law of Ireland, Clause 18 with the courts of Ireland, and Annexes I–III completed by the Annexes to this DPA. For UK transfers the UK Addendum applies with Table 4 permitting either party to end it when the ICO issues revised terms.
6.3 Mandra Voice will notify Customer if it becomes aware that any transfer mechanism it relies on has been invalidated, and will cooperate to put an alternative in place.
6.4 Data residency option. When Deepgram is the active speech engine, audio from Authorised Users in European time zones is routed to Deepgram's EU endpoint. Customers who require contractually guaranteed EEA-only processing of audio should request it on the Order Form; Mandra Voice will confirm in writing whether it can be provided for the configuration requested.
7. Security incidents
7.1 Mandra Voice will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data. Notice will go to the account owner and any security contact Customer designates.
7.2 The notice will describe, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed; and a point of contact. Information may be provided in phases as it becomes available.
7.3 Mandra Voice will take reasonable steps to contain, investigate, and mitigate the breach, and will cooperate with Customer's own notification obligations. Mandra Voice will not notify Data Subjects or Supervisory Authorities on Customer's behalf unless Customer asks it to or the law requires it.
7.4 Notice of a breach is not an admission of fault or liability.
8. Data Subject requests
8.1 The services provide self-service tools for Authorised Users to access, export, correct, and delete their own data. Customer's administrators can deprovision users and delete their data through the admin console.
8.2 If Mandra Voice receives a request directly from a Data Subject relating to Customer's Personal Data, it will, where the Data Subject can be identified as Customer's, direct them to Customer and notify Customer within five business days. Mandra Voice will not respond substantively except as required by law.
8.3 Where Customer cannot fulfil a request through the tools provided, Mandra Voice will provide reasonable assistance on request.
9. Audits
9.1 Mandra Voice will make available on request the information reasonably necessary to demonstrate compliance with this DPA, including: this DPA; the Subprocessors list; a description of the security measures in Annex II; summaries of any third-party security assessments or penetration tests; and responses to a reasonable written security questionnaire (once per year, or more often following a Personal Data Breach).
9.2 Where the information in §9.1 is insufficient to satisfy a legal requirement, Customer (or an independent auditor bound by confidentiality and not a competitor of Mandra Voice) may audit Mandra Voice's compliance, no more than once per year on 30 days' notice, during business hours, in a manner that does not unreasonably disrupt operations, and at Customer's expense. Findings are confidential. On-site access is limited to Mandra Voice's own premises and systems; Subprocessor facilities are covered by the Subprocessors' own audit reports.
9.3 Mandra Voice does not currently hold a SOC 2 report or ISO 27001 certificate and does not represent otherwise. If and when it obtains one, it will be made available under §9.1.
10. Return and deletion
10.1 During the term, Customer controls retention through the services' settings, and Authorised Users can delete their transcripts at any time.
10.2 On termination or expiry of the Agreement, Customer may export Personal Data using the services' export tools for 30 days. After that period, Mandra Voice will delete all Personal Data within a further 30 days, except where retention is required by law (for example, billing records under Canadian tax legislation), in which case the data will be isolated, protected, and deleted when the requirement lapses.
10.3 Deletion from backups occurs on the backup rotation cycle, currently 30 days. Backups are encrypted and are not restored except for disaster recovery.
10.4 On request, Mandra Voice will confirm deletion in writing.
11. CCPA / CPRA service-provider terms
To the extent the CCPA applies, Mandra Voice: (a) will not sell or share Personal Data; (b) will not retain, use, or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; (c) will not combine it with Personal Data received from other sources except as the CCPA permits; (d) certifies that it understands and will comply with these restrictions; (e) will notify Customer if it can no longer meet its obligations; and (f) grants Customer the right to take reasonable steps to stop and remediate unauthorised use. Customer may, on reasonable notice, verify Mandra Voice's compliance through the mechanisms in §9.
12. Canadian provisions
12.1 Mandra Voice is subject to PIPEDA and will Process Personal Data in accordance with Schedule 1 of that Act. Mandra Voice's designated privacy officer is named in the Privacy Policy and can be reached at support@mandravoice.com.
12.2 For Personal Data of Quebec residents, Mandra Voice has conducted an assessment of privacy-related factors before transferring Personal Data outside Quebec, as Law 25 requires, and will make a summary available on request. Mandra Voice maintains a confidentiality-incident register and will notify Customer of any confidentiality incident presenting a risk of serious injury in accordance with §7.
12.3 Nothing in this DPA prevents Mandra Voice from disclosing Personal Data where required by a lawful demand of a Canadian court or authority. Mandra Voice will notify Customer before disclosing unless legally prohibited, and will disclose only the minimum required.
13. Liability and precedence
13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, and this DPA does not create any liability in addition to them. Nothing limits either party's liability to Data Subjects under Data Protection Laws.
13.2 If there is a conflict between this DPA and the Agreement, this DPA prevails for the subject matter of data protection. If there is a conflict between this DPA and the SCCs, the SCCs prevail.
13.3 This DPA is governed by the law that governs the Agreement, except that the SCCs are governed as stated in §6.2.
Annex I — Details of Processing
Data exporter / Controller: the Customer named in the Order Form. Data importer / Processor: YAANTRIX Technologies Inc., 4600 Joy Rd, Maidstone, Ontario N0R 1K0, Canada. Contact: support@mandravoice.com.
| Categories of Data Subjects | Customer's Authorised Users (employees, contractors, agents); incidentally, any third party whose personal data an Authorised User dictates |
| Categories of Personal Data | Account identifiers (name, email, profile picture); voice audio during dictation (transient, not retained); transcripts and processed text; the identity of the application dictated into; language and formatting settings; custom dictionary and snippets; usage metrics (word counts, durations, feature use); device identifiers, platform, app version; team membership and role |
| Sensitive data | Voice recordings are sensitive personal information under the CPRA and are Processed only to perform the transcription requested. No special-category data under GDPR Art. 9 is to be Processed except by written agreement. No biometric identifiers, voiceprints, or speaker embeddings are created |
| Frequency | Continuous, for the term of the Agreement |
| Nature of Processing | Collection, transmission, transcription, text improvement, storage, retrieval, deletion |
| Purpose | Providing the dictation, text-improvement, and Read Aloud services to Authorised Users, and team administration for Customer |
| Retention | Audio: not retained. Transcripts: per Customer's configured retention (default 30 days; options 7, 30, 90, 365 days, or indefinite). Account data: term of the Agreement plus the periods in §10 |
| Primary storage location | Canada (AWS ca-central-1) — Personal Data at rest stays in Canada |
| Subprocessor transfers | As listed at mandravoice.com/subprocessors, with the transfer mechanism stated for each |
| Competent Supervisory Authority (SCCs Clause 13) | The authority of the EU member state in which Customer is established, or, for a Customer outside the EU, the Irish Data Protection Commission |
Annex II — Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption | TLS 1.2+ for all connections; secure WebSockets for audio streams; databases and backups encrypted at rest; provider API keys held in server-side secret storage and never shipped in the client |
| Access control | Row-level security enforced in the database for every table, so application bugs cannot expose one tenant's rows to another; administrative access restricted to named personnel, audited, and separately authorised; least-privilege service roles for backend functions |
| Audio handling | Audio streamed to the transcription provider and discarded on completion; no audio written to disk, object storage, or backups; provider logging disabled per request where the provider offers it (e.g. ElevenLabs enable_logging=false) |
| Client security | Desktop application runs with context isolation enabled and Node integration disabled, navigation and window-open restricted to vetted destinations; hardened runtime, code signing and Apple notarisation on macOS; automatic updates delivered over TLS from a fixed release channel. Windows installers are not yet code-signed |
| Secrets on device | Any customer-supplied API keys encrypted with the OS secure store (macOS Keychain, Windows DPAPI) |
| Rate limiting and abuse controls | Per-user, per-endpoint rate limits; per-user spend budgets on paid provider calls; device-session limits |
| Monitoring | Centralised error reporting with data scrubbing before transmission; alerting on failed webhooks, budget breaches, and provider circuit-breaker events |
| Backups and recovery | Encrypted automated backups; documented failover to a standby database; 30-day backup rotation |
| Data minimisation | Privacy Mode available to every user to prevent transcript storage entirely; configurable retention with automated daily purge; word counts only (no content) retained for metering |
| Personnel | Confidentiality obligations for all personnel with access; access reviewed on role change and revoked on departure |
| Incident response | Documented breach-response runbook with 48-hour customer notification target; confidentiality-incident register maintained |
| Subprocessor management | Each Subprocessor is used under its published data-processing and API terms, which prohibit use of Customer content for model training; a Subprocessor may retain content briefly for abuse monitoring under those terms (for example OpenAI, up to 30 days). Logging is disabled where the provider offers the option. 30-day advance notice of changes |
Annex III — Subprocessors
The current list, with purpose, location, and transfer mechanism for each, is maintained at mandravoice.com/subprocessors and is incorporated by reference.