QARAR DATA PROCESSING AGREEMENT — TEMPLATE

Status: a template for discussion. It is not signed, not legal advice and has not been reviewed by a lawyer. Fill in the parts in [brackets] and have both parties’ counsel review it before use.
Based on the Qarar security page, https://getqarar.com/en/security/, as of 5 October 2026.

1. Parties
- Customer: [legal name, registered address] ("Controller").
- Provider: [Kalemio legal entity name, registered address], operator of Qarar ("Processor").

2. Subject and duration
- The Processor processes personal data only to provide Qarar under the Terms of use (https://getqarar.com/en/terms/), for as long as the Controller uses Qarar, and then deletes it as set out in section 8.

3. Nature and purpose
- Storing meeting recordings; transcribing them and identifying speakers; writing notes from transcripts with an AI model; sharing meetings within the Controller’s workspace; billing.

4. Data subjects
- The Controller’s users; people who take part in recorded meetings or whose names appear in them; guests the Controller invites.

5. Personal data
- Account email addresses and sign-in identifiers; meeting recordings (voice), transcripts, speaker names, attendee names, meeting titles and notes; voice prints, only for users who opt in; device labels, coarse country and hashed network identifiers; billing details, held by Stripe.
- The Controller will not upload special categories of personal data unless it has a lawful basis to do so. Qarar applies no safeguards to them beyond those in Annex 2.

6. Processor obligations
- Process personal data only on the Controller’s documented instructions, which are its use of Qarar’s settings and features and this agreement.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply the measures in Annex 2.
- Help the Controller answer data subject requests for access, correction and deletion.
- Notify the Controller of a personal data breach without undue delay, and within [72] hours of becoming aware of it.
- Answer the Controller’s reasonable written security questions [once a year]. The Processor holds no SOC 2 report, ISO 27001 certificate or HIPAA compliance.

7. Subprocessors
- The Controller authorises the subprocessors in Annex 1. The Processor will announce a new subprocessor on https://getqarar.com/en/security/ [and by email to workspace owners] at least [30] days before it starts processing, and the Controller may object on reasonable grounds [remedy to be agreed].

8. Retention, deletion and return
- Meeting audio: 30 days by default after the transcript is ready; the Controller can choose 7, 30, 90, or 365 days.
- Audio of a meeting whose processing failed for a temporary reason after its upload finished (a transcription service that could not be reached or failed to finish part of it, a step that timed out, or a meeting that waited too long in the queue): kept for the same period, counted from the failure, then deleted. It is used only so the meeting’s creator can try again, up to 3 times, and is not played back or shared. If a retry completes, the meeting audio rule above applies from then on; if it fails again for a temporary reason, the period starts again from that failure.
- Audio of a meeting that failed for any other reason, or once no tries are left (for example a silent recording, a recording longer than the plan allows, audio that cannot be read, a recording in which no speech was found, or an upload that never finished): deleted straight away.
- Partial results of a failed attempt (pieces of transcript, voice data used to tell speakers apart, and copies of audio sent for transcription): deleted straight away.
- Transcripts, notes and notepads: until the meeting is deleted. Deleting a meeting deletes its audio, transcript, notes and notepad.
- The transcription gateway deletes its audio copy when a job ends and its transcript copy after 7 days.
- Whole-account deletion on request to support@getqarar.com. Billing records are kept for 7 years, as tax law requires.
- Before deletion, the Controller can copy or export transcripts and notes from Qarar.

9. International transfers
- Recordings, transcripts, notes and accounts are stored in eastern North America (Cloudflare R2 and D1) and processed by the subprocessors in Annex 1. A meeting’s temporary working state in Cloudflare Durable Objects is placed by Cloudflare near where the meeting is first used, so it may sit in any Cloudflare location. The Processor offers no storage in the Kingdom of Saudi Arabia, the United Arab Emirates or the European Union.
- Transfer mechanism: [to be agreed, for example the EU Standard Contractual Clauses, or the safeguards required by the Saudi PDPL and its transfer regulations].

10. Liability, precedence and law
- Liability: [to be agreed]. If this agreement conflicts with the Terms of use on data protection, this agreement prevails. Governing law and jurisdiction: [to be agreed].

ANNEX 1 — SUBPROCESSORS

Cloudflare
  Hosts the site and app, stores recordings, transcripts and accounts, runs the transcription gateway, and sends sign-in and notification emails.
  Data: All account and meeting data.
  Region: Recordings, transcripts and accounts in eastern North America. A meeting’s temporary processing state (Durable Objects) is placed by Cloudflare near where it is first used, and requests pass through its global network.

RunPod
  GPU servers that run the transcription and speaker engine on chunks of meeting audio.
  Data: Audio chunks while they are processed, the resulting text, and glossary entries and attendee names as spelling hints.
  Region: Not pinned to one region; RunPod picks the data centre.

OpenRouter
  Routes note writing, name correction and meeting-type suggestions to the model provider.
  Data: Transcript text, speaker names, title, attendees, glossary terms and notepad lines. No audio.
  Region: United States, and the model providers’ regions.
  Model providers: OpenAI and Google. Only text, never audio, is sent through OpenRouter, with zero data retention required: a request goes only to a provider that has committed not to store the prompt or output and not to train on them, and otherwise fails and is retried later; see the privacy policy.

Stripe
  Payments, invoices and tax for paid plans.
  Data: Account email, workspace name, and the card and billing details you enter with Stripe. Nothing from meetings.
  Region: United States and other Stripe regions.

Google, Microsoft (Optional)
  Sign-in, only if you choose to sign in with one of them.
  Data: Your email address and a stable account ID.
  Region: The provider’s regions.

ANNEX 2 — SECURITY MEASURES

- In transit: every connection to getqarar.com uses HTTPS, and plain HTTP requests are redirected or refused. Qarar reaches the transcription gateway over an internal Cloudflare binding; the gateway reaches RunPod, and Qarar reaches OpenRouter and Stripe, over HTTPS.
- At rest: Cloudflare encrypts the data stored in R2, D1 and Durable Objects.
- In the application: the secret calendar address is also encrypted with AES-256-GCM and bound to your account. Sign-in codes, session cookies, device tokens and share-link addresses are stored only as hashes.
- What we do not do: audio, transcripts and notes are not end-to-end encrypted. Qarar’s servers can read them in order to transcribe and write notes.
- Sign-in: A one-time code sent to your email, or a passkey. A code expires after 10 minutes.
- Passkeys: The private key stays on your device or in your password manager. Qarar stores only the public key, and your fingerprint or face never leaves your device.
- Devices and sessions: Up to 3 trusted devices; a new device needs a code sent to your email. In Settings you can sign out any Mac, or every device at once.
- Roles: Shared workspaces have an owner, admins and members. Only the owner and admins manage members and seats. A guest sees only the meeting shared with them.
- View-only links: Read-only. Each expires after the time its creator chose (7 days by default) unless it was made with no expiry, can be turned off at any time, and plays audio only if it was included.
- Activity log: Owners and admins see who shared a meeting, opened it through a link or edited it.
- Operator access: The internal analytics dashboard shows meeting states and durations under a pseudonymous ID. It shows no audio, transcript, notes or email address.
- Browser: A strict Content Security Policy: no inline scripts; external scripts are limited to payment and storage-denied purchase measurement. No advertising cookies or meeting content goes to advertising services.

SIGNATURES
Controller: ____________________  Name, title, date: ____________________
Processor:  ____________________  Name, title, date: ____________________