Legal
Data Processing Agreement
The data processing terms that apply when a company uses People Stories, and the subprocessors involved.
Roles
When your organisation (“the customer”) uses People Stories to collect video from colleagues and produce videos, the customer is the controller of the personal data it asks contributors and recipients to provide, and Leonardo English AB (“People Stories”) is the processor acting on the customer's instructions. This page describes those processing terms; our privacy notice describes how we act as controller for organiser account and billing data.
Subject matter, duration and nature of processing
We process personal data for as long as the customer's workspace is active, or until the customer asks us to delete it, as described in our privacy notice. Processing consists of receiving, storing, encoding and transmitting video and associated metadata submitted by contributors, and making the resulting video available through a private link.
Categories of data and data subjects
- Contributors: name, optional relationship, location and context, and the video and audio they record or upload.
- Recipients: name and role as entered by the customer.
We do not knowingly process special categories of personal data, though a contributor's video may incidentally show their appearance or voice.
Our obligations as processor
- We process personal data only on the customer's documented instructions, as implemented through the product.
- We keep personal data confidential and ensure that anyone who can access it is bound by an obligation of confidentiality.
- We apply technical and organisational security measures appropriate to the risk, including encryption in transit, private (non-public) storage of media, access tokens scoped to a single project or contribution, and audit of who can reach organiser data.
- We will help the customer respond to a data subject request or a request from a supervisory authority, so far as this is possible given the nature of the processing.
- We will tell the customer without undue delay after becoming aware of a personal data breach affecting their data.
- At the end of the relationship, we delete personal data according to the retention rules in our privacy notice, or sooner at the customer's request, unless we are required by law to keep it.
Subprocessors
We use the following subprocessors to provide People Stories. We will update this list if it changes.
- Cloudflare, Inc. — application hosting, database (D1) and private media storage (R2).
- Google Cloud (region europe-north1, Finland) — background video rendering.
- Stripe, Inc. — payment processing and invoicing for organiser subscriptions.
- WorkOS, Inc. — organiser authentication (a password or an emailed one-time code).
- Resend — transactional email delivery.
- PostHog Inc. (EU cloud, Frankfurt) — product analytics and session replay. Cookies and session recordings are used only with the visitor's consent; private links are removed before any event is sent, and form inputs are masked in recordings.
We authorise the use of these subprocessors and impose data protection obligations on them that are no less protective than those in this agreement. A customer that objects to a new subprocessor may raise it with us at hello@peoplestories.video.
International transfers
Media and application data are stored within the European Economic Area (Cloudflare storage and Google Cloud europe-north1). Some subprocessors above are based outside the EEA. Where personal data is transferred outside the EEA, we rely on that subprocessor's Standard Contractual Clauses or another lawful transfer mechanism.
We have a data processing agreement in place with each subprocessor listed above. In each case that agreement forms part of the subprocessor's own terms of service, which we have accepted, and it incorporates the European Commission's Standard Contractual Clauses for transfers outside the EEA. We will provide a customer with details of any of these on request at hello@peoplestories.video.
Audit
On reasonable notice, we will provide the customer with the information reasonably necessary to demonstrate compliance with this agreement, and will allow for and contribute to audits, including inspections, conducted by the customer or an auditor it appoints, subject to confidentiality and reasonable scheduling.
Liability and term
This agreement takes effect when the customer starts using People Stories and remains in force for as long as the customer's workspace is active. Liability under this agreement is subject to the limitation of liability in our terms of service.
Contact us
Questions about this agreement, or to request a signed copy: hello@peoplestories.video.