Do I need a DPA with CHAMELAION to process personal data in my media?
Yes, suppose your uploads contain personal data of third parties, for example, someone’s voice or face. In that case, you must have a valid legal basis, for example, consent, and you need a DPA with CHAMELAION before using the service. The DPA is part of the checkout flow and can also be concluded by email or e-signature. The DPA is always part of the enterprise plan. Please send us the signed DPA through email: [email protected].
What counts as personal data in media?
Any information that can identify a person, directly or indirectly, for example, voice, image, names, or other identifiers appearing in your audio or video.
Who is the controller, and who is the processor?
For your account, billing, and website logs, CHAMELAION acts as the controller. For third-party personal data inside your media, CHAMELAION acts as your processor under the DPA.
Which subprocessors are involved, and are there safeguards in place?
Core subprocessors are listed in the Privacy Policy, for example, Google for authentication, hosting, and storage; ElevenLabs for speech synthesis; DeepL for translation; OpenAI for context refinement; and Stripe for payments. These providers work under DPAs, and international transfers use EU safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
Where is the data processed?
CHAMELAION hosts in Europe, and subcontractors are GDPR-compliant or operate under signed DPAs.
How long do you keep my media?
Submitted files are processed only as needed, then flagged for deletion when the service or project is finished, unless you actively save a project or a legal retention rule applies. For rare error analysis, temporary retention may apply for a short period.
Contact
Questions or need a countersigned DPA, including an updated subprocessor list, just email [email protected]