Data processing agreement
This agreement is part of our terms of service. It applies whenever we handle personal data for you as your processor, under the UK GDPR, the EU GDPR or similar laws. You accept it when you accept the terms. If you need a signed copy, email support@useauthority.live.
1. Who's who
You (the business with the Authority account) are the controller. DRAFT: seller's legal name, trading as Authority, DRAFT: address line 1, DRAFT: town, postcode, United Kingdom is the processor. If you're an agency holding seats for your clients, you may be a processor for them, and we're then your sub-processor. You're responsible for having the right agreement with each client.
2. What we process, and why
| Purpose | Running Authority for you: sign-up pages, reminders and follow-ups, live and recorded webinars, chat, questions, polls and offers, replays, results and exports, AI features you use, and sending data to services you connect. |
|---|---|
| People | People who sign up to or watch your webinars, your leads and buyers, presenters and anyone on camera, and your team. |
| Data | Names, email addresses, phone numbers, answers to your sign-up questions, where they came from (links and campaign tags), country (from their internet address), device and browser, when they joined and left, chat messages and questions, poll answers, purchases and bookings your connected services report, recordings (voice and image), transcripts, and AI notes and scores. |
| Sensitive data | None is needed. Don't collect it unless you have a lawful reason. |
| How long | For as long as your account is open, then as in section 8. |
3. Your instructions
We process the data only to run Authority for you, as set out in the terms and in the settings you choose, unless the law makes us do something else. In that case we'll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you.
4. Our people
Only staff who need to can reach your data, and they're bound to keep it confidential. Each time our support opens your account, it's logged and you can see it on your Account page.
5. Security
- Each seat's data sits in its own separate part of the database, reached through its own database login, so one customer's queries can't read another's.
- Everything travels over encrypted connections (HTTPS).
- Passwords are stored only as hashes. Sign-in attempts are limited, and you can end any session.
- Exports leave out passwords, keys and tokens.
- Servers are in Germany, reachable only by our team. Nightly backups are encrypted before they leave the server.
- We don't update the app while a webinar is live, and we run checks that seats stay walled off before releases.
6. Other companies we use (sub-processors)
You agree we can use these companies. Each is bound by a written contract with data protection terms at least as strong as these. We'll email you at least 30 days before adding or replacing one that handles your attendees' data. If you object for a good reason and we can't solve it, you can cancel and we'll refund any time you've paid for and can't use.
| Company | What for | Where | Sees your attendees' data |
|---|---|---|---|
| Contabo | Servers that run the app and its database today | Germany | Yes |
| Hetzner | The dedicated server the app is planned to move to before launch (planned) | Germany or Finland | Yes |
| Bunny (bunny.net) | Delivers live and recorded video to viewers; planned home for recordings | Slovenia, with delivery points worldwide | Yes |
| Cloudflare | Domain names (DNS) and the bot check on our sign-up form | United States, worldwide network | No |
| Resend | Sends emails: account emails, and webinar reminders and follow-ups for our customers | United States | Yes |
| Bird | Sends text messages, only for customers who switch texts on (only when texts are switched on) | Netherlands | Yes |
| Anthropic | The AI model behind the AI features (chat moderation, question sorting, lead notes, the design assistant) | United States | Yes |
| Encrypted nightly backups (Google Drive) | United States and EU | Yes | |
| Stripe | Takes our customers' subscription payments; stores card details (we never see full card numbers) | Ireland and United Kingdom | No |
Services you connect yourself (your CRM, your own Stripe, YouTube, your text provider, your calendar) aren't our sub-processors. You choose them, and your agreement with them applies.
7. Data outside the UK and EU
Where a sub-processor handles data outside the UK or the EU, we use a lawful safeguard: an adequacy decision (such as the UK-US data bridge or the EU-US Data Privacy Framework), or the standard contract clauses with the UK addendum.
8. When you leave
You can download everything at any time (Account → Download everything). When your account is closed, we keep the data for 30 days in case you reopen it, then delete it. Encrypted backups roll off within a few weeks after that. We keep only what the law makes us keep, such as invoices.
9. Helping you
- People's requests: you can do them yourself. Account → Delete one person finds everything tied to an email address across your webinars (sign-ups, time in the room, chat, questions, votes, form answers, clicks, giveaway entries, purchases, bookings, reminders, texts, CRM records and bans), lets you download it first, then deletes it for good. Each deletion is logged, with the email address kept only in a form that can't be read back. Encrypted backups still hold it until they roll off, within a few weeks. Recordings, transcripts and your team's own notes aren't changed by it: ask us if you need help with those. If someone contacts us directly, we'll pass it to you.
- Data breaches: we'll tell you without undue delay, and within 48 hours of finding a breach that affects your data, with what we know and what we're doing.
- Assessments and regulators: we'll give you the information you reasonably need for a data protection impact assessment or a regulator's question.
- Checking on us: we'll answer reasonable written questions about how we protect your data, once a year or after a breach.
10. Everything else
Liability under this agreement follows the limits in the terms of service. If this agreement and the terms disagree about personal data, this agreement wins. It's governed by the law of England and Wales.