Privacy Policy
This document is a working draft published for vendor review and is subject to legal review. The signed customer agreement controls where the two differ.
1. Who we are
SOP Intel LLC (“SOP Intel”, “we”) operates the SOP Intel service: a platform that turns narrated screen recordings of business processes into reviewed, published process documentation. SOP Intel LLC is a limited liability company organized under the laws of the State of Washington.
Questions about this policy, or any request concerning your information, go to contact@sopintel.com.
2. Scope and roles
SOP Intel is deployed for organizations (“customers”) in a dedicated, single-tenant instance. People who use the service do so under an account created by their organization. In that arrangement the customer decides what is recorded and who may see it, and is the controller of that information. SOP Intelprocesses it on the customer’s behalf and on its instructions, as a processor.
This policy describes what SOP Inteldoes. The customer’s own privacy notice governs its relationship with its staff. Where this policy and a signed customer agreement differ, the agreement controls.
3. Information we process
The service handles the following categories of information:
- Account information. Name, work email address, role (member, executive or administrator), department assignments, and account status. Accounts are created by a customer administrator; there is no self-signup.
- Recordings. Screen recordings with narration that users upload. These may show business systems, documents and spoken descriptions of work, and may incidentally include personal information visible on screen or mentioned aloud.
- Derived content. Audio extracted from a recording, its transcript, still frames extracted as step screenshots, and the structured documentation generated from them (steps, roles, controls, flowcharts, RACI matrices, automation assessments).
- Usage and billing events. A record of each transcription and language-model call (provider, model, duration, cost), process views, and administrator actions needed to operate and bill the service.
- Technical logs. Request logs and error logs held by our hosting provider for operations and troubleshooting.
We do not collect information from the public landing or legal pages beyond ordinary server request logs. The service sets only the cookies needed to keep you signed in. There is no advertising or third-party analytics.
4. How we use information
- To transcribe recordings and generate the documentation the customer requested.
- To authenticate users and enforce roles, department visibility and sharing grants.
- To operate, secure, troubleshoot and improve the reliability of the service.
- To meter usage for billing under the customer agreement.
- To respond to support, security and legal requests.
We do not sell information, use it for advertising, or use customer content to train machine-learning models. Our transcription and language-model providers are contractually and technically prevented from training on it as well (see Subprocessors). Generated documentation is instructed to refer to people by role rather than by name.
5. Data processing terms
When processing customer content as a processor, SOP Intel:
- processes it only to provide the service and on the customer’s documented instructions;
- keeps it confidential and limits access to personnel who need it to operate or support the service;
- applies the technical and organizational measures described on the Security page;
- engages only the subprocessors listed below, and gives notice before adding or replacing one;
- assists the customer with requests from its staff about their information, and with security assessments;
- deletes or returns customer content at the end of the agreement, or earlier on written request; and
- notifies the customer without undue delay after becoming aware of a security incident affecting its content.
A data processing agreement setting out these obligations in contractual form is available on request to contact@sopintel.com.
6. Subprocessors
The service runs on the following third-party providers. All are hosted in the United States by default. Each publishes its own security documentation and independent audit reports (such as SOC 2 Type II), which we can help a customer obtain.
| Provider | Purpose | What it receives | Notes |
|---|---|---|---|
| Railway | Application hosting (web app and background worker) | All application traffic and processing in transit; environment configuration | US region. Secrets held only as encrypted environment variables. |
| Supabase | Managed Postgres database and authentication | Account records, process documentation, roles, sharing grants, usage events | Encrypted at rest. Row-level security enabled; data access is server-side only. |
| Cloudflare R2 | Object storage for recordings and extracted frames | Uploaded recordings, extracted audio and frames, attachments | Private bucket per environment. Access only via server-minted URLs valid for one hour. |
| Deepgram | Speech-to-text transcription | Audio extracted from a recording, fetched via a short-lived URL | Every request is sent with the model-improvement opt-out flag. No training on customer audio. |
| Anthropic | Language model for document extraction and automation assessment | Transcript text and process metadata only. Never video, never screenshots. | API usage is not used for model training. Anthropic retains API logs for a limited period (about 30 days) unless zero-data-retention terms are in place. |
| GitHub | Source control and deployment trigger | Application source code only. No customer data. | Private repository. |
Only the transcript text and process metadata are sent to the language-model provider. Video and extracted screenshots never leave our storage and processing environment.
7. Retention and deletion
- Recordings and derived contentare retained for as long as the process exists in the customer’s library, so documentation can be regenerated and re-reviewed. Steps a reviewer marks as sensitive have their extracted screenshots deleted before the document is saved.
- Deletion of a process by an authorized user is a hard delete: stored recordings, audio, frames and attachments are removed first, then the database record. We keep an audit script that verifies no orphaned objects remain. Billing records survive the deletion but no longer reference the content.
- Account information is retained while the account exists. Disabling an account preserves its history; deleting it is handled on administrator request.
- Provider-side retention.Our speech-to-text provider does not retain audio when the opt-out flag we send is honored. Our language-model provider retains API request logs for a limited period (currently about 30 days) unless zero-data-retention terms are in place for the customer’s account.
Customers may request deletion of any or all content in writing at any time, and all content is deleted or returned at the end of the agreement.
8. Security
Data is encrypted in transit and at rest, stored in private buckets reachable only through signed URLs that expire after one hour, and accessible in the application only to authenticated users with the right role or an explicit share. The Security page describes the architecture, controls and our current compliance posture in detail, including what we do not yet have.
9. Your rights and requests
If you use the service through your employer, requests to access, correct or delete information about you should go to your organization first, since it controls the content. We will support that request promptly. You may also contact us directly at contact@sopintel.com; where we are the processor we will refer the request to the customer and assist them.
The service is intended for use by organizations and their staff and is not directed at children.
10. Changes to this policy
We will post any revision here with a new effective date, and notify customers of material changes in advance through their administrator contact.
11. Contact
SOP Intel LLC · contact@sopintel.com