GDPR & Data Protection

1. Controller vs. Processor Roles

Under European data protection law, the classification of roles depends on the context of the data processed:

• Seminara as Data Controller: We act as a Data Controller for Host account credentials, billing records, direct communications, and technical telemetry collected to manage your subscription.
• Seminara as Data Processor: We act as a Data Processor on behalf of the Host (who is the Data Controller) with respect to presentation slide decks, proprietary documents, and Attendee interaction records (such as Q&A transcripts and lead capture submissions).

2. Lawful Bases for Processing (GDPR Art. 6)

• Performance of a Contract (Article 6(1)(b)): Delivering live presentation rooms, rendering slides, synthesizing AI speech in response to attendee questions, and metering minute balances.
• Legitimate Interests (Article 6(1)(f)): Protecting our WebRTC network against denial-of-service attacks, detecting fraudulent billing attempts, and maintaining software stability.
• Compliance with Legal Obligations (Article 6(1)(c)): Retaining statutory accounting and tax records in accordance with applicable corporate regulations.

3. Categories of Personal Data Processed

• Host Identity: Name, verified email address, workspace identifiers, and OAuth tokens.
• Presentation Assets: PDF slide content, speaker notes, and vectorized knowledge embeddings.
• Ephemeral Voice Audio: Spoken audio streams during live Q&A, processed in real-time in RAM without raw audio file storage on disk.
• Q&A Transcripts & Lead Data: Text transcripts of attendee questions and lead capture responses saved to the host’s private workspace.

4. Technical & Organizational Safeguards (TOMs)

• PostgreSQL Row-Level Security: Strict database partition policies enforce that tenant data can only be queried by the authenticated host (auth.uid() = host_id).
• Encryption in Transit & at Rest: All web traffic and WebRTC media streams are enforced over TLS 1.3; database storage and vector indexes are encrypted using AES-256.
• Zero Model Training: Commercial agreements strictly prohibit our foundation model providers from utilizing customer data for training.

5. Data Subject Rights (Articles 15–22)

Data subjects have specific statutory rights under GDPR, including the Right of Access (Art. 15), Right to Erasure (Art. 17), Right to Rectification (Art. 16), and Right to Data Portability (Art. 20). To submit a GDPR Data Subject Access Request (DSAR), email shivamselam@seminara.online. We process verified requests within 30 days without charge.

6. International Transfers & SCCs

Where data is transferred outside the European Economic Area (EEA), we ensure equivalent protections via European Commission Standard Contractual Clauses (SCCs), certified enterprise cloud facilities, and robust end-to-end cryptographic transport protocols.

7. Sub-processors & Data Processing Agreements

All sub-processors are bound by strict DPAs pursuant to GDPR Article 28. Enterprise customers requiring a bespoke signed Data Processing Addendum (DPA) can request our standard addendum by contacting our legal desk. Full details are available in our Sub-processors Directory.

8. Data Protection Officer & Inquiries

Omni AI Club Private Limited
Attn: Shivam Selam, DPO
Email: shivamselam@seminara.online
Address: Bokajan, Karbi Anglong, Assam, India, 782480