Data Processing Agreement
This Data Processing Agreement ("DPA") supplements our Terms of Service and applies when you use NewTales in a capacity that involves processing personal data of your own end users (for example, by sharing a generated story link to your audience). It is offered for transparency and to help business customers meet their obligations under the EU General Data Protection Regulation (GDPR).
1. Roles of the parties
- For data about you as a NewTales user (account, billing, authentication), NewTales acts as the data controller. See our Privacy Policy.
- For data you upload or generate about third parties (for example, text you type or upload that contains personal data), you are the data controller and NewTales is a data processor acting on your instructions.
2. Subject matter and duration
Subject matter: hosting of prompts, generated stories, cover images and narrated audio, together with their metadata. Duration: as long as your account is active plus the retention period set out in the Privacy Policy.
3. Nature and purpose of processing
We process your content solely to (a) generate audiobooks on your request, (b) store the output for you to access and (c) serve shared links to visitors where you have made a story public.
4. Categories of data and data subjects
- Categories of data: text prompts, uploaded text, AI-generated stories, metadata (title, genre, language, tags), audio files, cover images.
- Categories of data subjects: you, and any individuals you may describe in the text you submit. Do not submit special categories of personal data (GDPR Art. 9).
5. Obligations of NewTales as processor
- Process personal data only on documented instructions from you (including those set out in the Terms and this DPA).
- Ensure that personnel authorised to process personal data are subject to confidentiality.
- Implement appropriate technical and organisational measures (HTTPS, hashed passwords, signed URLs, access controls, EU-based hosting).
- Assist you with requests from data subjects, security incidents and data protection impact assessments, taking into account the nature of processing.
- Notify you without undue delay after becoming aware of a personal data breach affecting your content.
- Delete or return your content at the end of the service, as described in the Privacy Policy.
6. Sub-processors
We engage the following sub-processors. You authorise these sub-processors by using the Service. If we add a new sub-processor, we will update this list before the change takes effect.
| Sub-processor | Location | Purpose |
|---|---|---|
| Stripe | Ireland / USA | Payments and invoicing |
| Anthropic PBC | USA | Story generation (Claude API) |
| Google LLC | USA | Cover image and text-to-speech (Gemini API) |
| ElevenLabs | USA | Fallback text-to-speech |
| Resend | USA | Outbound transactional email |
| ImprovMX | USA | Inbound email forwarding (support@, privacy@) |
| Contabo GmbH | Germany / EU | VPS hosting, server infrastructure, databases and object storage |
7. International transfers
Where sub-processors are located outside the EEA, transfers rely on Standard Contractual Clauses or equivalent safeguards published by the European Commission. Copies are available on request.
8. Data subject requests
If a data subject contacts us directly with a request relating to content you uploaded, we will forward it to you when we can identify you as the controller and will assist you in responding.
9. Audits
We make available to you, upon reasonable written request, the information necessary to demonstrate compliance with this DPA (for example, documentation of our security measures and sub-processor list). Given the nature of the Service (shared infrastructure), on-site audits are generally satisfied through written responses and third-party attestations where available.
10. Term and termination
This DPA takes effect when you start using the Service and remains in force for as long as we process your data.
11. Custom / signed DPA
If your organisation requires a signed DPA, email privacy@newtales.pro with your entity name and requirements. We will send a PDF for countersignature.
12. Contact
Privacy contact: privacy@newtales.pro.