Data Processing Addendum

This template is ready on request and unsigned by default — most customers don't need a signed DPA to use mado, but Enterprise customers can request one. Available on the Enterprise plan; contact us to execute it.

Roles

For personal data contained in your uploaded recordings, you are the data controller and we are the data processor, processing only on your documented instructions.

Subject matter and duration

Processing consists of storing, transcoding, and serving your Content for as long as your workspace exists, plus any retention period required by section 5.

Sub-processors

See our public subprocessor list. We will notify customers under a signed DPA before adding a new sub-processor with material access to Content.

Payments are outside this addendum. Paid plans are sold through Link, Stripe's reseller, which acts as merchant of record and processes buyers' billing and payment details as the seller under its own terms. It receives no Content.

Security measures

• Encryption in transit (TLS) and at rest for stored Content;
• Tenant-scoped access control at the database layer;
• Destructive redaction — redacted pixels are removed, not covered;
• No customer Content on non-EU infrastructure, except through AI assist where the customer has turned it on (see International transfers).

Deletion

Content is deleted within 30 days of a confirmed deletion request.

International transfers

We do not transfer Content outside the EU as part of normal processing. The exceptions are both opt-in and off by default. AI assist: when a customer turns it on for a workspace, screenshots and recognised text from that workspace's new recordings are sent to Anthropic, PBC (United States) to generate step text and translations. Voice & music: when a customer turns it on for a workspace, narration script and music style prompts written for that workspace's demos are sent to ElevenLabs Inc. (United States) to generate voiceover, background music and sound effects — never a screenshot. Both transfers are covered by Standard Contractual Clauses, and each ends when the customer turns its setting off.