Scope and roles
This Addendum forms part of the Terms of Service between you ("Customer") and the company that provides Cue ("Cue"). It applies whenever Cue processes personal data on Customer's behalf ("Customer Personal Data") under data protection laws, including GDPR, UK GDPR and US state privacy laws. Customer is the controller, or a processor for its own clients, and Cue is its processor or subprocessor. If this Addendum and the Terms conflict on personal data, this Addendum wins.
Under California law, Cue acts as a service provider: it will not sell or share Customer Personal Data, or retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service.
Processing on your instructions
Cue processes Customer Personal Data only on Customer's documented instructions, which are these Terms and Customer's use of the product, unless the law requires otherwise, in which case Cue will tell Customer first if the law allows. Cue will tell Customer if it believes an instruction breaks data protection law. Customer is responsible for having a lawful basis, for giving notices, and for getting any consents, including from people whose speech may be captured.
People and confidentiality
Cue limits access to Customer Personal Data to people who need it to run or support the service and are bound to keep it confidential.
Security
Cue maintains appropriate technical and organizational measures, listed in Annex 2 and on the Security page. Cue may improve them, but will not materially reduce the overall level of protection.
Subprocessors
Customer gives general authorization for the subprocessors on the Subprocessors page. Cue will give at least 30 days' notice before adding or replacing one, by updating that page and notifying account holders. Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may stop using the affected part of the service. Cue binds each subprocessor to obligations at least as protective as these and remains liable for its performance.
Requests from individuals, and assistance
Cue will promptly pass on any request it receives from an individual about Customer Personal Data and will not answer it except on Customer's instructions. Taking into account the nature of the processing, Cue will reasonably help Customer respond to such requests, and with security, breach notices, data protection impact assessments and consultations with regulators.
Personal data breaches
Cue will notify Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will give what Cue then knows: the nature of the breach, the data and people affected, likely consequences and the steps being taken. Cue will send further details as it learns them. A notice is not an admission of fault.
International transfers
Customer Personal Data is stored in Singapore and processed in the United States and other locations listed on the Subprocessors page.
Where a transfer from the EEA, the UK or Switzerland to a country without an adequacy decision is subject to data protection law, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), which are incorporated by reference: Module Two where Customer is a controller and Module Three where it is a processor. Clause 7 applies; Clause 9 option 2 applies with the notice period above; the optional language in Clause 11 does not apply; the governing law and courts are those of Ireland; and the annexes are completed by Annexes 1 to 3 below. For UK transfers, the UK International Data Transfer Addendum applies. For Swiss transfers, the Clauses apply with the necessary changes for Swiss law.
Return and deletion
Customer can delete talks, practice runs, decks and images in the product at any time, and can ask Cue to delete an organization. Within 30 days after the service ends, or after a deletion request, Cue will delete Customer Personal Data, or return it if Customer asks before deletion, unless the law requires it to be kept. Provider backups and logs age out on their own schedule and are protected until then.
Information and audits
Cue will make available the information reasonably needed to show compliance with this Addendum, and will allow audits, including inspections, by Customer or its appointed auditor where that information is not enough or a regulator requires it. Audits need reasonable notice, take place in business hours no more than once a year unless a breach or regulator requires otherwise, are subject to confidentiality, and are at Customer's cost.
Liability and term
Liability under this Addendum is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses do not allow it. This Addendum lasts for as long as Cue processes Customer Personal Data.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Exporter | Customer, as identified in its account |
| Importer | Cue |
| Subject matter and purpose | Providing Cue: building slide sets, running live and practice sessions, showing history and logs |
| Nature of processing | Storing, analyzing with AI models, generating content from, displaying and deleting data |
| People concerned | Customer staff and presenters; people named in uploaded materials; people whose speech is recognized during a session |
| Personal data | Names, work emails, images or names in decks and documents, transcribed speech, any other personal data Customer chooses to upload |
| Special categories | None intended. Customer should not upload them unless necessary. Speech is handled as text. Cue does not use it to identify anyone. |
| Frequency | Continuous while the service is used |
| Retention | Until deleted by Customer or as set out in "Return and deletion" |
| Supervisory authority | The authority competent for Customer under Clause 13 of the Standard Contractual Clauses |
Annex 2: Security measures
- Encryption in transit (TLS) and at rest (AES-256), provided by our infrastructure providers
- Row-level security on every Cue database table, so each read and write runs as the signed-in user and is limited to their organization
- No service-role database key in the Cue app or its server functions
- Private storage for decks and documents, restricted to organization members
- Unguessable, replaceable tokens for audience links, which expose only that talk's opening slide and each slide as it comes up
- Audience screens can receive but not send, so only members of the organization can change what they show
- Daily limits on jobs that use the AI models
- Slide matching on the presenter's own device, so nothing leaves it for that step
- API keys held as server secrets, never sent to browsers
- Access by Cue staff limited to what is needed for support and incidents
Annex 3: Subprocessors
See the current list on the Subprocessors page.