Effective Date: June 3, 2026 · Last updated: September 4, 2026

Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the RecordFlow Terms of Service ("Terms") between you (the "Customer") and RecordFlow ("RecordFlow", "we", or "us"). It applies whenever Customer uses the RecordFlow admin-managed Zoom Marketplace app to archive cloud recordings of other Zoom users in a Zoom account that Customer administers. In that scenario Customer is the controller of member personal data under Article 28 of Regulation (EU) 2016/679 ("GDPR") and equivalent laws (UK GDPR, Swiss FADP, and US state privacy statutes such as the CCPA/CPRA) and RecordFlow is the processor.

Customer's acceptance of the Terms constitutes execution of this DPA. No separate signature or countersignature is required. In the event of a conflict between this DPA and the Terms, this DPA prevails as to the processing of member personal data described below.

1. Subject Matter & Duration

Subject matter. RecordFlow processes (a) the cloud-recording content of each Zoom user that Customer has enabled in the RecordFlow admin dashboard ("Members") — including video, audio, transcript, chat, and meeting-summary files produced by Zoom — and (b) directory and sync-history data about those Members.

Duration. Processing continues from the moment Customer first authorizes the admin-managed app for its Zoom account and ends 30 days after the latest of (a) the last administrator of that Zoom account deauthorizing the app, (b) Customer's written notice to terminate this DPA, or (c) Customer's account-deletion request to support@recordflow.org.

2. Nature & Purpose of the Processing

Nature. Streaming download from Zoom's cloud-recording API, short-lived in-memory holding during transfer, upload to a Google Drive folder that Customer designates, and storage of per-meeting metadata (meeting topic, start time, sync status, Drive folder ID, the identifiers of files already transferred) in RecordFlow's database.

Purpose. Archival of the Members' Zoom cloud recordings to a Google Drive folder under Customer's control, so Customer retains a backup of those recordings outside Zoom. RecordFlow does not use Member personal data for any other purpose, does not train any machine-learning model on it, and does not sell it.

3. Categories of Data Subjects & Personal Data

Data subjects. The Members of Customer's Zoom account that Customer enables in the RecordFlow admin dashboard, and any third parties who speak or appear in those Members' meetings.

Categories of personal data processed:

  • Member directory data: Member name, work email address, Zoom user ID, Zoom account ID, sync-enabled toggle state, and per-member last-archived timestamp.
  • Recording content: meeting video, audio, transcript (VTT and Google Doc), chat log, AI-generated meeting summary, timeline markers, and recording metadata (meeting topic, start time, duration). This content may incidentally include any category of personal data the meeting participants choose to discuss, and may include special-category data under Art. 9 GDPR depending on the meeting's subject matter — Customer is responsible for assessing whether its lawful basis covers that scenario.
  • Sync activity: per-meeting sync status (observed, started, in-sync, synced, error, …), Google Drive folder identifiers, identifiers of recording files already transferred, error messages, cumulative bytes uploaded.

4. Sub-Processors

This section distinguishes two kinds of third party, because they reach Member personal data on a different legal basis and Customer's rights differ accordingly. §4.1 covers providers RecordFlow selects and engages. §4.2 covers storage that Customer selects, contracts for and controls, and that RecordFlow writes to only because Customer instructed it to.

4.1 Sub-processors engaged by RecordFlow

Customer authorizes RecordFlow to engage the following sub-processors. The list below is current as of the Last updated date above and is also reflected in the "Third-Party Services" section of our Privacy Policy, which is the canonical reference for active sub-processors:

  • Cloudflare, Inc. — Workers compute, D1 SQLite database, R2 object storage; primary infrastructure provider. Region: global multi-region.
  • Google LLC / Google Ireland Ltd. — Google Drive and YouTube (destination storage chosen by Customer; recordings sent to YouTube are uploaded to Customer's own channel as private videos and are re-encoded by YouTube); Google OAuth.
  • Microsoft Corporation / Microsoft Ireland Operations Ltd. — Microsoft OneDrive (destination storage chosen by Customer, limited to the RecordFlow app folder); Microsoft Entra ID OAuth.
  • Dropbox, Inc. — Dropbox (destination storage chosen by Customer, limited to the Apps/RecordFlow App folder); Dropbox OAuth.
  • Resend, Inc. — Transactional email delivery for notifications.
  • Functional Software, Inc. (d/b/a Sentry). — Error tracking and session-replay diagnostics.

Adding or replacing a sub-processor. RecordFlow will give Customer at least 30 days' advance notice (by email to the address on file and by updating the Privacy Policy) before engaging a new sub-processor under this §4.1 or replacing an existing one. During that 30-day window Customer may object in writing to support@recordflow.org; if Customer's objection cannot be reasonably resolved, Customer may terminate this DPA and the Terms with respect to the admin-managed app and request return / deletion of Member personal data under §6 below.

Sub-processor obligations. RecordFlow flows down the substantive obligations of this DPA to each sub-processor listed in this §4.1 through written agreements, and remains liable to Customer for any such sub-processor's failure to meet those obligations to the same extent RecordFlow would be liable for its own failure.

4.2 Customer-designated storage destinations

RecordFlow can archive recordings to S3-compatible storage that Customer supplies — for example Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, or a self-hosted MinIO deployment on Customer's own infrastructure. A destination of this kind is not a sub-processor engaged by RecordFlow, and the commitments in §4.1 do not apply to it. The distinction is not the identity of the vendor but who chooses and contracts with it:

  • Customer selects and controls it. Customer supplies the endpoint, region, bucket and key prefix, and holds the account with the storage provider. RecordFlow has no relationship with that provider, does not select it, and cannot negotiate terms with it. Where Customer runs the storage themselves, there is no third party involved at all.
  • RecordFlow writes on Customer's documented instruction. Configuring the destination is that instruction for the purposes of Art. 28(3)(a) GDPR and §2 of this DPA. RecordFlow writes only beneath the key prefix Customer named, using credentials Customer issued and can revoke at any time in their provider's console.
  • Customer is responsible for the provider relationship. Concluding any data processing agreement or Art. 28 terms required with the storage provider, and satisfying itself as to that provider's security, location and retention, is Customer's responsibility as controller. RecordFlow makes no representation about the provider and accepts no liability for it.
  • No enumeration and no advance notice. Because the provider is Customer's choice rather than RecordFlow's, it cannot be listed in advance in §4.1, and the 30 days' notice and objection right above do not apply — there is nothing for RecordFlow to notify Customer of before Customer's own configuration takes effect.

RecordFlow remains responsible, as processor, for what it does with the credentials and the data in transit: credentials are encrypted at rest (AES-256-GCM), used solely to write to the destination Customer named, and deleted when the destination is disconnected or the account is offboarded. Once written, the stored copy sits in Customer's own storage account under Customer's control, and its configuration, access, versioning, retention and cost are Customer's to manage.

5. Security & Breach Notification

Technical and organisational measures. RecordFlow maintains the following measures, which Customer accepts as appropriate to the risk of the processing described in §2:

  • Encryption at rest: all stored OAuth tokens (Zoom and Google), session cookies, and OAuth state are encrypted with AES-256-GCM before being written to the database.
  • Encryption in transit: every connection between RecordFlow and Zoom, Google, Resend, and the Customer's browser uses TLS 1.2 or higher.
  • Recording content is not persisted on RecordFlow infrastructure. Recording bytes are streamed in 10 MB chunks from Zoom's servers through a Cloudflare Worker and uploaded directly to Customer's chosen Google Drive folder; they exist in worker memory only for the duration of the active transfer.
  • Authentication: OAuth 2.0 with PKCE for Zoom and Google; encrypted session cookies; no plaintext credential storage.
  • Auto-delete audit log: when Customer or a Member enables the optional auto-delete-after-archive feature, every delete attempt is recorded in an INSERT-only audit log retained for 24 months.
  • Access control: production database access is restricted to RecordFlow personnel with a documented operational need; session-replay and error-tracking access is restricted to the same personnel set.

Breach notification. RecordFlow will notify Customer in writing (email to the address on file is sufficient) without undue delay and in any event within 72 hours after becoming aware of a personal-data breach affecting Member personal data, so that Customer can satisfy its own notification obligations under Art. 33 GDPR. The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address and mitigate the breach.

6. Audit & Return / Deletion

Audit right. Customer may, on at least 30 days' prior written notice to support@recordflow.org and not more than once per calendar year (more often only if required by a supervisory authority or following a confirmed personal-data breach), request a written response to a reasonable security questionnaire and copies of any then-current third-party security attestations RecordFlow holds for itself or its sub-processors. The parties will negotiate in good faith any on-site or system-level audit that Customer's regulator specifically requires.

Return / deletion on termination. On termination of this DPA (see §1 above), RecordFlow will, within 30 days, delete all Member directory data, per-member sync history, and stored OAuth tokens for the affected Zoom account. Recording content already copied into Customer's Google Drive remains in Customer's Drive — RecordFlow only ever writes to that Drive, never deletes from it. Customer may instead request return of the deleted directory / history data in a portable format, in which case RecordFlow will deliver the export within the same 30-day window before deleting its copy.

7. International Transfers

Where this DPA involves the transfer of Member personal data originating in the EU/EEA, UK, or Switzerland to a country that is not the subject of an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Decision 2021/914) by reference, with Customer as data exporter and RecordFlow as data importer. RecordFlow flows down equivalent transfer mechanisms to the sub-processors it engages (see §4.1). Copies of the operative SCCs are available on request to support@recordflow.org.

This does not extend to a customer-designated destination under §4.2. Where Customer directs RecordFlow to write to storage in a country without an adequacy decision, Customer is the party in a relationship with that provider and is responsible for the transfer mechanism covering it. Customer chooses the destination's region at connection time.

8. Customer Instructions & Processor Obligations

RecordFlow will process Member personal data only on Customer's documented instructions, which are set out in (a) this DPA, (b) the Terms, and (c) the in-app configuration choices Customer makes through the RecordFlow admin dashboard (which Members are enabled, which Google Drive folder is the destination, whether transcript-only mode is on, whether auto-delete is on). If RecordFlow believes a Customer instruction infringes GDPR or another data protection law, it will inform Customer without undue delay and may suspend performance of that instruction until Customer confirms or amends it.

RecordFlow ensures that personnel authorized to process Member personal data are bound by confidentiality obligations and have received appropriate data-protection training. RecordFlow assists Customer, taking into account the nature of the processing and the information available, in meeting Customer's own obligations under Articles 32 to 36 GDPR (security, breach notification, DPIAs, prior consultation) and Articles 12 to 23 GDPR (data-subject rights — see also "Member rights pathway" in our Privacy Policy).

9. Contact

Data-protection enquiries, sub-processor objections, audit requests, and data-subject-rights requests under this DPA should be sent to support@recordflow.org. Postal correspondence: Adam Dobrawy, al. Jerozolimskie 89/43, 02-001 Warszawa, Poland.

Your acceptance of the Terms of Service constitutes execution of this DPA. No countersignature is required.