Speudio Data Processing Agreement

Version 2.7 Last updated: 16 October 2026

This Data Processing Agreement ("DPA") is part of the agreement between SK Creations and the Customer for the Speudio service. It governs how SK Creations processes personal data on the Customer's behalf under Article 28 of Regulation (EU) 2016/679 (the "GDPR").

This DPA is written in English. Translations may be provided for convenience; the English version prevails in case of any conflict.

1. Parties, roles, and incorporation

1.1 Parties. This DPA is entered into between:

• SK Creations, a Swedish sole proprietorship (enskild firma), Hagvägen 41, 194 40 Upplands Väsby, Sweden ("Speudio", "we", the "Processor"); and
• the customer that holds a Speudio account under the Speudio Terms of Service (the "Customer", "you", the "Controller").

1.2 Roles. Speudio is a read-only inbox-to-CRM service: it connects to the mailbox you choose via IMAP or OAuth with read-only access, imports your emails and attachments, builds contact profiles from them, and provides AI assistants over that data. The content of your mailbox contains personal data about your correspondents and customers. For that content:

• you are the controller — you decide which mailbox to connect and what the imported data is used for; and
• Speudio is your processor — we process that content only to provide the service to you.

For your own account data (login email, name, hashed password, locale, plan, usage records, security logs) Speudio acts as an independent controller; that processing is described in the Speudio Privacy Policy and is not governed by this DPA.

Speudio is offered to businesses only (Terms of Service, Section 1.2), so the Customer uses it for business purposes and acts as controller of the imported content.

1.3 Incorporation. This DPA is incorporated into and forms part of the Speudio Terms of Service (the "Agreement"). By using the service to import mailbox content, the Customer instructs Speudio to process that content as described in this DPA. No separate signature is required for the DPA to apply; an executed (signed) copy is available on request via info@speudio.com.

1.4 Controller obligations and rights. As controller of Customer Content, the Customer is responsible for the lawfulness of the processing it instructs. In particular, the Customer warrants that it is entitled to connect the chosen mailbox and to have the personal data it contains processed as described in this DPA, that it has an appropriate lawful basis for that processing, that it provides any information to data subjects required of it as controller, and that its instructions to Speudio comply with applicable data-protection law. The Customer exercises its rights as controller through the documented instructions (Section 3.1), the sub-processor information and objection rights (Section 4.2), the assistance and breach notification rights (Section 6), the export and deletion controls (Section 7), and the information and audit rights (Section 8).

2. Subject matter and details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex A, which forms part of this DPA.

3. Processor obligations

3.1 Documented instructions. Speudio processes Customer Content (as defined in Annex A) only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which Speudio is subject; in that case Speudio will inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

The Customer's documented instructions are:

• (a) the documented functions of the service as made available in the product and described in the in-app documentation — importing the connected mailbox (read-only), deriving contact profiles, generating AI-derived data (captions, embeddings, summaries, suggested questions), search, export, and deletion;
• (b) the Customer's configuration and use of those functions (e.g. which mailbox is connected, which contacts are edited, what is exported or deleted); and
• (c) any further written instructions agreed between the parties.

Speudio will inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection provisions.

3.2 Read-only by design; no use for our own purposes. Speudio accesses the connected mailbox with read-only scope: it never modifies, deletes, or sends mail from the Customer's mailbox. Speudio does not use Customer Content for its own purposes, does not sell it, does not use it to send marketing email to the Customer's contacts, and does not train AI models on it.

3.3 Confidentiality. Speudio ensures that every person authorised to process Customer Content is bound by a contractual or statutory duty of confidentiality. Humans at Speudio do not read the Customer email content held in the service; that content is processed programmatically (including by the AI features the Customer invokes), and every query for emails, attachments and contact profiles is scoped server-side to the account that owns them. Two exceptions exist, both of them opened by the Customer's own action rather than by Speudio, and both are described in Section 3.6: a screenshot the Customer attaches to in-app product feedback, and Customer Content the Customer quotes into a support ticket. Any other exceptional human access (e.g. for debugging at the Customer's request) is limited to what is strictly necessary.

3.4 Security (Article 32). Speudio implements and maintains the technical and organisational measures set out in Annex B, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing as well as the risk to the rights and freedoms of natural persons. Speudio may update Annex B from time to time, provided the updates do not materially reduce the overall level of protection.

3.5 Personnel. Speudio ensures that access to Customer Content is limited to personnel who need it to perform under the Agreement.

3.6 Customer Content the Customer supplies outside the mailbox connection. Two features of the Service let the Customer hand Speudio a copy of Customer Content directly, and in both a person at Speudio sees that copy:

• A screenshot attached to in-app product feedback. The screenshot is a picture of the Customer's own screen, captured by the browser when the Customer asks for it, so it contains whatever the Service was displaying at that moment, which may include Customer Content. Attaching one is optional; a written note alone is a complete submission. Speudio processes the submission only to understand and fix the reported problem and to improve the Service, and deletes it, screenshot included, within 90 days.
• Customer Content quoted into a support ticket. Speudio's support team reads the tickets the Customer raises, including any email text the Customer pastes or describes in them. Speudio processes it only to answer that support request and to keep a record of the support given, and deletes the ticket when the account is deleted. Where the support team asks the Service's assistant to summarise a ticket or draft a reply, the ticket's text is transmitted to OpenAI under the safeguard in Section 5.2.

Neither channel gives Speudio's personnel any wider reach: reading a ticket does not open the requester's mailbox, attachments or contact profiles, because those queries remain scoped to the account that owns them. Both channels are within the Customer's control, and a Customer that does not wish Speudio's personnel to see any Customer Content should not attach screenshots showing it or quote it into tickets. The Customer, as controller, should account for these channels in its own information to data subjects where it chooses to use them.

4. Sub-processors

4.1 General authorisation. The Customer grants Speudio a general written authorisation to engage sub-processors for the processing of Customer Content. The sub-processors currently engaged are listed in Annex C.

4.2 Changes and right to object. Speudio will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance (by email to the account email address and/or by updating the published sub-processor list with notice in the product). The Customer may object on reasonable, data-protection-related grounds within that notice period. If the parties cannot resolve the objection in good faith, the Customer may terminate the Agreement with respect to the affected service and delete or export its data before the change takes effect (see Section 7).

4.3 Flow-down. Speudio imposes on each sub-processor, by contract, data-protection obligations that are in substance the same as those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to fulfil its data-protection obligations, Speudio remains fully liable to the Customer for the performance of that sub-processor's obligations.

4.4 Not a sub-processor. The Customer's own mail provider (e.g. Google, Microsoft, or another provider) is the data source the Customer chooses to connect; it processes the mailbox under the Customer's own agreement with that provider and is not a sub-processor of Speudio.

5. International transfers (Chapter V)

5.1 Primary location. The service, its database, and all Customer Content — including the attachment files belonging to Customer Content and the original formatted (HTML) copy of each imported message — run on Speudio's own server in Sweden, within the EU. This is a self-hosted server operated by SK Creations rather than a certified third-party data centre, so no data-centre certification is claimed for it; the technical and organisational measures protecting it are set out in Annex B. Cloudflare carries the traffic to and from the service, as described in Section 5.2 and Annex C, and stores none of it. Speudio's backups are kept on Speudio's own equipment in Sweden (Section 7.3).

5.2 Transfers outside the EU/EEA. Customer Content is transferred outside the EU/EEA only to the sub-processors listed below. The first is OpenAI (USA), for the AI features of the service (chat assistants, vision captions, and web-search sub-calls) and for the support desk's assistant, which receives the text of a support ticket when Speudio's support team asks it to summarise that ticket or draft a reply to it (Section 3.6). This transfer takes place under OpenAI's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). Under OpenAI's API terms, API data is not used for model training by default and is retained for a maximum of approximately 30 days for abuse monitoring.

Status: OpenAI's Data Processing Addendum was executed between SK Creations and OpenAI Ireland Ltd on 12 June 2026 (incorporating the EU Standard Contractual Clauses).

The second is Cohere (USA/Canada), which performs two functions. Since July 2026 it is Speudio's embedding provider: the text of Customer Content is transmitted to Cohere's embeddings API when it is added to the search index, so that a query in one language retrieves material written in another. It also performs search-relevance ranking, for which the search text and the text of up to 100 candidate documents (up to about 4,000 characters each, often most of an email) are transmitted to Cohere's reranking API. These transfers take place under Cohere's data-processing terms, which incorporate the EU Standard Contractual Clauses (Article 46(2)(c) GDPR); API data is not used for model training (disabled via Cohere's data controls) and is retained for a maximum of approximately 30 days for abuse monitoring.

The third is Cloudflare (US-headquartered), which carries all traffic between the Customer's users and the service. speudio.com is reached through a secure tunnel from Cloudflare's network to Speudio's own server; the encrypted connection from the user's browser ends at Cloudflare and continues to the server through the tunnel, so Customer Content displayed to or sent by the Customer's users passes through Cloudflare in transit. Cloudflare passes it on without storing it, and its network is global, so a request can pass through a Cloudflare data centre outside the EU. Speudio treats this as a transfer to a third country, safeguarded under Cloudflare's Data Processing Addendum incorporating the EU Standard Contractual Clauses (Article 46(2)(c) GDPR); Cloudflare is also certified under the EU-U.S. Data Privacy Framework. Cloudflare holds none of Speudio's backups and no stored Customer Content.

The fourth is OpenRouter, Inc. (169 Madison Avenue, New York, NY 10016, USA), a routing provider, and it is the only entry on this list that introduces no new kind of data and no new AI provider. Speudio reaches the OpenAI models it uses either directly or through OpenRouter; on the second route the request is transmitted to OpenRouter, which forwards it to OpenAI and returns the answer together with the amount it charged for that request. Customer Content therefore reaches OpenRouter in full: the end user's question and the email bodies, attachment text and contact names retrieved to answer it. Because OpenRouter is able to serve one model from several hosting companies, Speudio restricts every request to OpenAI's own endpoint and disables automatic fallback, so no hosting company outside Annex C becomes a recipient; each request is additionally marked as excluded from any provider that would retain prompts. This transfer takes place under OpenRouter's data-processing agreement incorporating the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).

Status: listed in advance of activation, per the change procedure in Section 4.2. The route is not enabled until OpenRouter's DPA and the Standard Contractual Clauses have been executed.

Payment providers receive no Customer Content. Paid plans are paid by invoice, issued by Speudio in Sweden; no payment is taken inside the Service. Swish is built into the Service but is switched off: it is not offered and transmits nothing. While it was in use (until 25 September 2026), a Swish payment ran through Getswish AB, org.nr 556913-7382, established in Sweden, which operates the Swish system and to which Speudio connects directly with its own merchant certificate, and Lunar Bank A/S, org.nr 502089-5388, established in Denmark, the bank that holds Speudio's Swish merchant agreement and settles the payments. Both are established within the EU/EEA, so no third-country transfer arises and no Article 46 transfer mechanism is required for either. Neither receives Customer Content: what was transmitted is the payment data described in the Speudio Privacy Policy (the amount, a short payment message naming the plan, and a reference identifying the paying account). A payment institution processes payment data under its own legal obligations rather than on Speudio's instructions, so both are treated as independent controllers of the payment execution rather than as sub-processors; they appear in Annex C for transparency.

Stripe is listed in Annex C but is built in and switched off: card payment is not offered to customers and processes nothing, and no Customer Content or customer personal data has been transmitted to Stripe. It stays listed so that the Customer receives the notice contemplated by Section 4.2 before the integration could become active rather than at the moment it does.

5.3 New transfers. Speudio will not transfer Customer Content to any other third country except under a valid Chapter V transfer mechanism and following the sub-processor change procedure in Section 4.2.

6. Assistance to the Controller

6.1 Data-subject requests (Articles 15–22). Taking into account the nature of the processing, Speudio assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to data-subject requests. In practice the service is largely self-service for this purpose: the Customer can search, export (full JSON export at Settings → Privacy), rectify (all contact-profile fields are editable in-app at any time), and delete the relevant data directly. If a data subject contacts Speudio directly about Customer Content, Speudio will not respond on the merits but will refer the request to the Customer without undue delay, unless legally required to act otherwise.

6.2 Articles 32–36. Taking into account the nature of the processing and the information available to it, Speudio assists the Customer in ensuring compliance with the Customer's obligations regarding security of processing, breach notification, data-protection impact assessments, and prior consultation with supervisory authorities.

6.3 Personal data breach. Speudio will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content. The notification will, to the extent then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects; information may be provided in phases as it becomes available. Speudio's notification is not an acknowledgement of fault or liability.

7. Deletion and return of data

7.1 During the term. The Customer can export Customer Content at any time (full JSON export at Settings → Privacy → Export my data) and can delete individual data or the entire account at any time.

7.2 On termination — return or deletion at the Customer's choice (Art 28(3)(g)). At the end of the provision of the service, Customer Content is, at the Customer's choice, returned and/or deleted: the return option is exercised through the self-service full JSON export (Section 7.1) at any time before deletion. Upon termination of the service — including the Customer's self-service account deletion at Settings → Privacy → Delete account — Speudio deletes all Customer Content: account deletion executes immediately on confirmation as a hard delete, completed at most within 24 hours. It runs in two steps, in this order. The stored objects are deleted first, meaning both the attachment files and the stored original copies of the Customer's messages, and the database records are deleted second, by a single cascading delete of the account record. The order is deliberate and is what the guarantee rests on: the account record is the only thing that identifies which stored objects belong to the Customer, so deleting it first would leave objects that nothing points at. The deletion sweeps everything filed under the Customer's own storage prefixes rather than working from a list held in the database, so an object the database has no record of is deleted as well. If the files cannot be deleted at that moment, nothing is deleted and the Customer is asked to retry, so an interrupted deletion is a delayed deletion and never a partial one. Speudio makes no claim of a single atomic transaction across the database and the object store, because none is available between them. The Customer is responsible for exporting any data it wishes to keep before deleting the account.

7.3 Residual copies, and what the backups contain. Speudio operates nightly encrypted backups (restic), kept in two places, both Speudio's own equipment in Sweden: on Speudio's server, and a second copy on separate hardware kept apart from it. No third party holds a backup. The backups cover the database and Customer Content except the two components that are a copy of the Customer's own mail system, the attachment files delivered with a message and the message's original formatted (HTML) copy; those are left out on purpose and would be fetched again from the connected mailbox if the service had to be rebuilt, which works only while that mailbox still holds them. Annex B item 12 records the measure. Both copies keep 14 daily, 8 weekly and 12 monthly snapshots; there is no yearly tier. Deletion under Sections 7.1 and 7.2 removes Customer Content from the live service immediately; whatever part of the deleted material was held in a snapshot then ages out as that schedule rotates, and is at no point restored into the live service. Backups exist solely for disaster recovery. Security and server logs (which may incidentally reference Customer activity, but not mailbox content) are retained for up to 90 days; records of actions taken by Speudio's own staff on an account are retained for up to 365 days. Copies held by the sub-processors OpenAI and Cohere are deleted under their retention terms (maximum approximately 30 days, abuse monitoring only).

7.3a Accounts locked after a trial. When a free trial ends without a paid plan, the account is locked and Customer Content is kept unchanged. If no plan is set up, the account and all Customer Content are deleted as in Section 7.2 90 days after the trial ended; the Customer is emailed 7 days and 1 day before. Setting up a plan before then keeps everything.

7.4 Legal retention. Deletion under this Section applies unless Union or Member State law requires storage of the personal data, in which case Speudio will protect the data from further processing and delete it when the requirement lapses.

8. Audit and demonstration of compliance

8.1 Information. Speudio makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, on written request to info@speudio.com.

8.2 Proportionate audits. Speudio is a small provider; the parties agree that audit rights are exercised in a manner proportionate to that scale. Speudio satisfies audit requests first through written answers, documentation, its documented technical and organisational measures (Annex B), its regularly tested backups, and its per-customer isolation. If the Customer reasonably demonstrates that this is insufficient to verify compliance, the Customer (or a mandated auditor that is not a competitor of Speudio) may conduct an audit, subject to: reasonable advance written notice of at least 30 days, at most one audit per 12-month period (except after a personal data breach or where required by a supervisory authority), during business hours, under confidentiality, without access to other customers' data, and at the Customer's cost.

8.3 Mandatory audit right. Nothing in this Section limits the audit and inspection rights mandated by Article 28(3)(h) GDPR.

9. Liability and order of precedence

9.1 Liability. Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, except to the extent such limitation is not permitted by applicable law. Nothing in this DPA limits a data subject's rights or either party's liability to data subjects under Article 82 GDPR.

9.2 Order of precedence. In case of conflict between this DPA and the Agreement (including the Terms of Service), this DPA prevails with respect to the processing of personal data. In case of conflict between this DPA and the Standard Contractual Clauses or another mandatory transfer mechanism, the transfer mechanism prevails to the extent of the conflict.

9.3 Severability. If any provision of this DPA is held invalid, the remainder stays in effect, and the invalid provision is replaced by a valid one that most closely reflects its intent.

10. Governing law and venue

This DPA is governed by the laws of Sweden, without regard to its conflict-of-laws rules. The courts of Sweden have exclusive jurisdiction over disputes arising out of or in connection with this DPA, without prejudice to mandatory data-subject rights and the competence of supervisory authorities (for Sweden: IMY — Integritetsskyddsmyndigheten, imy.se).

Annex A — Details of the processing (Art 28(3) GDPR)

Subject matter. Processing of the mailbox content the Customer imports into Speudio ("Customer Content") to provide the Speudio service.

Duration. The term of the Agreement — from when the Customer connects a mailbox until the account is terminated or deleted, plus the deletion period in Section 7 (immediate hard delete, completed at most within 24 hours). A copy of Customer Content supplied through one of the channels in Section 3.6 has its own duration: product feedback and any screenshot attached to it are deleted within 90 days of being sent, and a support ticket is deleted with the account.

Nature and purpose of the processing. Read-only retrieval of emails and attachments from the mailbox the Customer connects (IMAP or OAuth, read-only scope); storage; indexing and search; derivation of CRM contact profiles from the imported correspondence; generation of AI-derived data (image captions, embeddings, summaries, suggested questions) using the sub-processors in Annex C; display to the Customer's authorised users; export; deletion. The service never modifies, deletes, or sends mail from the connected mailbox, and Customer Content is not used to train AI models.

In addition, where the Customer chooses to use either channel in Section 3.6, Speudio processes the copy of Customer Content the Customer supplies through it: a screenshot attached to in-app product feedback, processed to diagnose the reported problem and improve the Service, and Customer Content quoted into a support ticket, processed to answer that support request. In both channels a person at Speudio reads the content, which is the exception to the programmatic-processing rule stated above and in Section 3.3.

Where the photo search uses them, Speudio also works out picture facts from images within Customer Content: a picture vector, the number of faces and people an image shows (with the detection score and size of each face box), the kinds of objects detected in it (label, score and size), and its colour shares. This runs on Speudio's own server in Sweden with no sub-processor, and nothing is transmitted for it. Faces are counted only, and none of these facts is used to recognise, identify or compare persons. The facts are deleted with the image.

Where it is switched on, Speudio also reads the printed text in scanned pages and photos of documents within Customer Content (text recognition), so that the text can be searched. This runs on Speudio's own server in Sweden with no sub-processor, and nothing is transmitted for the reading itself. The text is stored with the file and deleted with it; after that it is processed like any other text extracted from Customer Content.

Types of personal data.

• Emails and their metadata (sender/recipient names and addresses, subjects, timestamps, bodies);
• Attachments, including documents and images;
• Derived CRM contact profiles (names, email addresses, organisations, and other profile fields derived from the correspondence or edited by the Customer);
• AI-derived data (captions, embeddings, summaries, suggested questions) generated from the above;
• Picture facts for photo search derived from images (a picture vector, face and person counts with the score and size of each face box, detected object labels with score and size, colour shares). Not used to recognise, identify or compare persons.
• Text read by text recognition from scanned pages and photos of documents within Customer Content.

Special categories of data (Article 9 GDPR) are not intentionally processed; they may appear incidentally inside the Customer's mailbox content, which is determined and controlled by the Customer.

Categories of data subjects. The Customer's correspondents — typically the Customer's own customers, suppliers, partners, and other contacts whose emails appear in the connected mailbox — and the Customer's users insofar as their own messages appear in that mailbox.

Plan-related retention during the term. Each plan holds a set amount of storage for Customer Content (Solo 3 GB, Pro 6 GB, Business 25 GB; a trial has the Pro figure), covering the imported messages and their attachments together, measured as the Customer's own mail provider would measure them; the data Speudio derives from that content in order to operate the service — the search index, the embeddings, the extracted text and the generated captions — is not counted against it. The number of messages is not limited. This is a ceiling, not a rolling window: what is imported is retained while the account exists, nothing is removed to make room for newer mail, and a full plan stops importing new email instead.

Photos read by the AI. Of the photos in mail that arrived before a mailbox was connected, the AI reads at most 1,000 on Solo, 3,000 on Pro and 10,000 on Business (500 during a trial), newest first. Photos that arrive later are read within the plan's own photo allowance. Photos that are not read stay stored and viewable; they only lack an AI description.

Annex B — Technical and organisational measures (Art 32 GDPR)

1. Hosting. The service, the database holding Customer Content, and the attachment files and message copies within Customer Content run on Speudio's own server in Sweden, within the EU. It is a self-hosted server operated by SK Creations, not a certified third-party data centre, so no data-centre certification is claimed for it; the measures in this Annex are how it is protected. Traffic reaches the server through Cloudflare's network over a secure tunnel (Section 5.2, Annex C).
2. Encryption in transit. All connections — between the user and the service, and between the service and the connected mailbox or sub-processors — use encrypted transport (TLS).
3. Least-privilege mailbox access. The service never modifies, deletes, moves, marks, or sends mail. Microsoft mailboxes are connected through Microsoft Graph with the read-only Mail.Read permission only. Gmail and other providers are read over IMAP with every folder opened in read-only mode, so the connection cannot carry a write command. Gmail is connected with an app password the Customer creates in its Google account; an app password is not limited to reading at Google's end, so the restriction is enforced by how Speudio connects, and the Customer can revoke the password at any time.
4. Tenant isolation. Per-user tenancy isolation is enforced server-side: every data access is scoped to the authenticated account.
5. Authentication. Passwords are stored only as bcrypt hashes; session cookies are httpOnly; recovery codes are provided for account recovery. Account creation is rate-limited, and administrative account functions are restricted to authorised staff.
6. No human content access, with two Customer-opened exceptions. Humans do not read the Customer email content held in the service; processing is programmatic, including AI processing, and it is enforced by scoping every content query server-side to the account that owns the data rather than by a rule staff are asked to follow. The two exceptions are the channels in Section 3.6, both opened by the Customer: a screenshot attached to in-app product feedback, and Customer Content quoted into a support ticket. Neither widens personnel access beyond the item supplied: reading a ticket does not open the requester's mailbox, attachments or contact profiles.
7. No model training. Customer Content is not used to train AI models, by Speudio or (per their API terms and data settings) by the AI sub-processors listed in Annex C.
8. Deletion. Self-service, immediate hard deletion of the entire account: the stored objects (the attachment files and the original message copies) are deleted first, then the account record with cascading removal of related records. A failure to delete the files aborts the deletion and is retried rather than leaving files behind (Section 7).
9. Logging. Security and server logs are retained for up to 90 days to detect and investigate abuse and incidents.
10. Confidentiality. Personnel with any access are bound by confidentiality obligations (Section 3.3).
11. Bounded retention for the Section 3.6 channels. A nightly job deletes product feedback, and any screenshot attached to it, 90 days after submission, so content supplied through that channel cannot accumulate indefinitely awaiting manual removal.
12. Restoring availability and access (Art 32(1)(c)). Nightly encrypted backups hold the database and Customer Content except the attachment files delivered with a message and the original formatted copy of each message, which are a copy of the Customer's own mailbox and are fetched from it again in a rebuild (Section 7.3). The backups are kept in two places, both Speudio's own equipment in Sweden: on the server and on separate hardware kept apart from it. A documented procedure covers a restore, and a test restore is performed periodically rather than the ability to restore being assumed. Backup integrity is verified on every run, and a run that cannot complete raises an alert instead of recording success.

Annex C — Authorised sub-processors

No other sub-processors are engaged. Speudio uses no analytics, advertising, or tracking vendors. The Customer's own mail provider (Google, Microsoft, or other) is the Customer's chosen data source, not a sub-processor (Section 4.4). The payment parties in this table are listed for transparency: they take part in paying for the Service, not in the processing of Customer Content, and Speudio treats them as independent controllers of the payment execution (Section 5.2).

Change log: Cohere (search relevance) and Cloudflare (encrypted backup storage) were added in the July 2026 revision of this list. In version 1.1 (22 July 2026) the entries for Cloudflare and Cohere were corrected to describe what each provider actually does: Cloudflare has been the primary store for attachment files since 20 June 2026 and also operates the network edge, and Cohere has been the embedding provider since July 2026. Stripe was added in advance of the launch of online payment, per the change procedure in Section 4.2. In version 1.2 (25 July 2026) Getswish AB and Lunar were added, because Swish is the payment method actually in use, and the Stripe entry was corrected: the card integration is built into the Service but is switched off and processes nothing. Neither payment party receives Customer Content. In version 1.3 (25 July 2026) both payment entries were completed with the details Article 28(2) disclosure calls for: the full legal name and registration number of each party, Getswish AB (org.nr 556913-7382) and Lunar Bank A/S (org.nr 502089-5388), and each party's country of establishment, Sweden and Denmark respectively. Both sit inside the EU/EEA, so neither entry rests on a third-country transfer mechanism. No sub-processor was added or removed by this version. Version 1.4 (26 July 2026) does not touch this list either: it restates plan-related retention in Annex A, where each plan now holds a stated number of emails instead of the paid plans holding an unstated one and the Free plan a moving window of 200, and imported email is no longer removed to make room for newer email. Version 1.5 (26 July 2026) leaves this list untouched as well: it only lowers three of the four figures version 1.4 stated in Annex A, to Solo 25,000, Pro 60,000 and Business 100,000, with the Free plan's 5,000 unchanged. The retention mechanism itself is unchanged, and no sub-processor, recipient, transfer or category of data was added or removed. Version 1.6 (29 July 2026) adds no sub-processor either, but it does widen the OpenAI entry to name a use it already had: the text of a support ticket is transmitted when Speudio's support team asks the assistant to summarise it or draft a reply. The substance of this version is elsewhere. New Section 3.6 describes the two channels through which the Customer may hand Speudio a copy of Customer Content outside the mailbox connection, a screenshot attached to in-app product feedback and Customer Content quoted into a support ticket, and states plainly that a person at Speudio reads both. Section 3.3 and Annex B item 6 previously asserted that humans do not read Customer email content without naming those two exceptions, and now name them; Annex B item 6 also states that the rule is enforced by server-side scoping rather than by staff discipline. Annex B gains item 11: feedback and any screenshot in it are deleted by a nightly job 90 days after submission, where previously nothing deleted them at all. Annex A records both channels and their durations. Section 7.2 describes account deletion more precisely: the attachment files are deleted before the account record, a failed file deletion aborts the whole deletion rather than proceeding, and Speudio no longer describes the operation as a single transaction, because no transaction spans the database and the object store. Nothing about how Customer Content is processed changed with this version, apart from the new 90-day deletion, which reduces what is retained.

Version 1.7 (2 August 2026) adds one sub-processor, OpenRouter, Inc. (USA), and adds nothing else. It is a router rather than a model provider: Speudio reaches the same OpenAI models either directly or through OpenRouter, so the same Customer Content is transmitted to the same AI provider with one additional company handling it in transit. No new category of Customer Content is processed, no retention period changes, and the purposes in Annex A are unchanged. The entry is published in advance of activation under Section 4.2, and the route stays off until OpenRouter's DPA and the Standard Contractual Clauses are executed. Because OpenRouter can serve one model from several hosting companies — Amazon and Microsoft among them — the pinning described in the entry is part of the disclosure and not a performance setting: without it the set of recipients would be chosen per request rather than named here. The purpose of the change is measurement of cost, which processes no Customer Content of its own: OpenRouter reports the amount charged for each request, where Speudio otherwise derives it from a manually maintained price table.

Version 1.8 (5 August 2026) adds no sub-processor and removes none. It widens the existing Cloudflare entry so that it covers the original formatted (HTML) copy of each imported message as well as the attachment files it already covered, both held in the same bucket restricted to Cloudflare's EU jurisdiction. That copy previously sat in the database on Speudio's hosting provider; the readable text of each message, its subject and its sender and recipients remain there. No new category of Customer Content is processed, the purposes in Annex A are unchanged, no retention period changes, and the transfer position is unchanged because Cloudflare was already an authorised sub-processor for Customer Content under this Annex. Deletion on termination under Section 7.2 reaches the new location: the erase sweeps Speudio's storage area for that Customer by prefix rather than from a list held in the database, so an object left behind by a failed write is erased with the rest.

Version 1.9 (8 August 2026) restates plan-related retention in Annex A and adds no sub-processor. Each plan previously held a stated number of emails (Free 5,000, Solo 25,000, Pro 60,000, Business 100,000). That figure is removed and the number of messages an account holds is no longer limited; the plan's storage — Free 3 GB, Solo 15 GB, Pro 30 GB, Business 50 GB, covering the imported messages and their attachments together — is now the only limit on how much Customer Content is held. Annex A also states what that figure does not count, which is the data Speudio derives from Customer Content in order to operate the service. The retention mechanism itself is unchanged: the figure is a ceiling rather than a rolling window, what is imported is retained while the account exists, nothing is removed to make room for newer mail, and a full plan stops importing new email instead. No sub-processor, recipient, transfer or category of Customer Content was added or removed, and no retention period is extended.

Version 2.0 (8 August 2026) states what the off-site backups contain, in Section 7.3 and in new Annex B item 12. Speudio's backups deliberately exclude the two components of Customer Content that are a copy of the Customer's own mail system, the attachment files delivered with a message and the original formatted (HTML) copy of each message; those are restored by re-synchronising the connected mailbox rather than from a snapshot. Section 7.3 previously described the backups as covering Customer Content without qualification, which overstated their scope. No sub- processor, recipient, transfer or category of Customer Content is added or removed, no retention period is extended, and nothing about how Customer Content is processed in the live service changes. The direction of the change is a reduction: less Customer Content is written to a second location. The Customer should note the corresponding limitation, now stated in both places, that material deleted from the connected mailbox after import cannot be reconstructed by Speudio from a backup.

Version 2.1 (20 August 2026) records that Speudio has moved to its own server in Sweden and narrows what each outside provider does. The service, the database, and all Customer Content — including the attachment files and the original formatted (HTML) copy of each message — now run on Speudio's own self-hosted server in Sweden; previously the service was hosted by one.com and those files and copies were held in Cloudflare's object storage. The one.com entry above is reduced to transactional email delivery only, and the Cloudflare entry to encrypted off-site backup storage only: Cloudflare no longer stores Customer Content and no longer operates the network edge for speudio.com. Because those two components of Customer Content now exist only on Speudio's own server, the backups include them — reversing the exclusion recorded in version 2.0 — so that this content keeps a second, encrypted copy (Section 7.3, Annex B item 12); the backup schedule is 7 daily, 4 weekly and 6 monthly snapshots off-site, with a more frequent copy on Speudio's own server, and no yearly tier. No new sub-processor is added; the one.com and Cloudflare roles are narrowed, and hosting is now performed by SK Creations itself rather than by a sub-processor. No data-centre certification is claimed for the self-hosted server. Sections 5.1, 5.2, 7.3, 8.2 and Annex B items 1 and 12 are updated accordingly.

Version 2.2 (25 September 2026) records that paid plans are now paid by invoice and that Swish is switched off, built in and kept ready like the card integration. The Getswish AB and Lunar Bank entries in Annex C and the payment paragraph in Section 5.2 are updated to say so; both stay listed for transparency. The storage figures in Annex A drop the Free plan's, which new accounts no longer receive, and name the free trial. No sub-processor is added or removed, and no Customer Content goes anywhere new.

Version 2.3 (25 September 2026) lowers the storage figures in Annex A: Solo 10 GB, Pro 15 GB, Business 30 GB (from 15, 30 and 50 GB); a trial has the Pro figure. No Customer Content already imported is removed, no sub-processor is added or removed, and no Customer Content goes anywhere new.

Version 2.4 (27 September 2026) corrects descriptions that no longer matched how the service runs. Cloudflare carries the traffic to the service through a secure tunnel and holds no backup; Sections 5.1 and 5.2, Annex B item 1 and Annex C now say so. The backups are kept in two places, both Speudio's own equipment in Sweden, with 14 daily, 8 weekly and 12 monthly snapshots, and leave out attachment files and original message copies, which come from the Customer's own mailbox (Section 7.3, Annex B item 12). Transactional email is sent through MXroute LLC rather than one.com; it receives no Customer Content. New Section 7.3a deletes an account whose trial ended without a plan 90 days after the trial ended. Annex A gives the new storage figures, Solo 3 GB, Pro 6 GB and Business 25 GB, and the limit on how many earlier photos the AI reads. Annex B item 3 says that Gmail is connected with an app password. Section 1.2 drops the paragraph on private use, as the service is offered to businesses only.

Version 2.5 (8 October 2026) describes two transfers more exactly. Section 5 and Annex C say that Cohere's reranking API receives the text of up to 100 candidate documents, up to about 4,000 characters each, rather than "short excerpts". Annex C says what a web-search sub-call sends: only the query the assistant writes, with email addresses, links and long numbers removed, which OpenAI's web-search tool passes to its search partners. No sub-processor is added.

Version 2.5 (8 October 2026) records that MXroute LLC also sends the confirmation of a trial or plan request made with the short form on the sign-up and trial-ended pages (Annex C). That form collects a name, a business name and an email address, which SK Creations processes as controller under its Privacy Policy, not as processor under this DPA. No Customer Content is involved and no sub-processor is added or removed.

Version 2.6 (15 October 2026) describes picture facts for photo search in Annex A: a picture vector, face and person counts, detected object labels and colour shares worked out from images within Customer Content on SK Creations' own server in Sweden. Faces are counted only, and the facts are never used to recognise, identify or compare persons. No sub-processor is added and nothing is transmitted for this.

Version 2.7 (16 October 2026) describes text recognition in Annex A: where it is switched on, the printed text in scanned pages and photos of documents within Customer Content is read on SK Creations' own server in Sweden so that it can be searched, stored with the file and deleted with it. No sub-processor is added and nothing is transmitted for the reading itself.

Signature block

This DPA applies by incorporation into the Terms of Service (Section 1.3). Where a countersigned copy is required:

Processor: [SK Creations — sole proprietorship, reg. no. provided upon execution] Hagvägen 41, 194 40 Upplands Väsby, Sweden Signature: _________________________ Name: _________________________ Date: ____________

Controller (Customer): _________________________________________ Signature: _________________________ Name: _________________________ Date: ____________

SK Creations Hagvägen 41 194 40 Upplands Väsby Sweden info@speudio.com

This document is provided in English as the authoritative version; any translations are for convenience only and the English version prevails.