Data Processing Agreement
Last updated:
This Data Processing Agreement ("DPA") is part of the Terms of Service between the clinic ("controller") and "BLS AI AUTOMATION" DOO PODGORICA ("processor"). It applies whenever material the clinic puts into DentVideo contains personal data and the clinic is the controller of that data. It is concluded when the clinic accepts the Terms; no signature is needed. On request we also provide it as a signed document.
1. Processor
- Company
- "BLS AI AUTOMATION" DOO PODGORICA
- Legal form
- Limited liability company under the laws of Montenegro (društvo sa ograničenom odgovornošću)
- Registered office
- Neznanih Junaka 60, 81000 Podgorica, Montenegro
- Register
- Central Register of Business Entities (CRPS), Montenegro
- Registration number
- 5-1333594
- Tax ID (PIB)
- 03784410
- Managing director
- Berke Bulsu
- Brand
- Bulsu Labs — product: DentVideo
2. Subject matter, nature and purpose
We process the clinic's personal data only to provide DentVideo: to store uploads, transcribe recordings, write, narrate and render videos, run checks, show the results in the clinic's library and send service emails. Processing lasts for as long as the clinic uses DentVideo, plus the deletion period in section 9.
- Data subjects: the clinic's dentists and staff; people who appear or speak in recordings the clinic uploads; patients only if the clinic uploads material that identifies them.
- Categories of data: names, email addresses, image and voice, transcripts, clinic profile details. Health data is not required by DentVideo; it is processed only if the clinic uploads it, in which case the clinic is responsible for having a legal basis and the patient's explicit consent.
3. Instructions
We process the data only on the clinic's documented instructions, which are the Terms, this DPA and the clinic's use of the service's settings, unless the law requires otherwise; in that case we tell the clinic first unless the law forbids it. If we believe an instruction breaks data protection law, we tell the clinic.
4. Confidentiality
Everyone at BLS AI Automation DOO who can access the data is bound to confidentiality.
5. Security measures
- Encryption in transit (HTTPS) for every connection to the site, the app and our database.
- Isolation of each clinic's data by database access rules; a clinic can read only its own rows and files.
- Files served only through short-lived signed links; uploads limited by type and size.
- Server and provider accounts limited to the people who run DentVideo.
- Rate limits and spending limits on every paid processing step.
- Self-service account deletion that removes the clinic's data, as described in section 9.
6. Sub-processors
The clinic gives general authorisation for the sub-processors below. We impose data protection obligations on each of them that are no less protective than this DPA, as far as their standard terms allow, and remain responsible for them.
- Purpose:
- Virtual private server that runs dentvideo.com, the video workers, our database, logins and file storage (our own installation of the open-source Supabase software).
- Data:
- All service data: account, clinic profile, uploads, videos, billing references, logs.
- Location:
- Germany (EU)
- Purpose:
- Writes and reviews scripts, creates the synthetic narration, and transcribes uploaded recordings when our own transcription service is unavailable.
- Data:
- Clinic profile details used in scripts, script text, recording audio (for transcription).
- Location:
- United States
- Purpose:
- Sends service emails (sign-in codes, "your videos are ready", billing notices).
- Data:
- Email address, clinic name, email content.
- Location:
- United States
- Purpose:
- Checkout, subscriptions, invoices, taxes and refunds as merchant of record. For payment data Dodo Payments is an independent controller.
- Data:
- Email address, name and billing details, payment data, subscription status.
- Location:
- See Dodo Payments' privacy policy
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hostinger | Virtual private server that runs dentvideo.com, the video workers, our database, logins and file storage (our own installation of the open-source Supabase software). | All service data: account, clinic profile, uploads, videos, billing references, logs. | Germany (EU) |
| OpenAI | Writes and reviews scripts, creates the synthetic narration, and transcribes uploaded recordings when our own transcription service is unavailable. | Clinic profile details used in scripts, script text, recording audio (for transcription). | United States |
| Resend | Sends service emails (sign-in codes, "your videos are ready", billing notices). | Email address, clinic name, email content. | United States |
| Dodo Payments | Checkout, subscriptions, invoices, taxes and refunds as merchant of record. For payment data Dodo Payments is an independent controller. | Email address, name and billing details, payment data, subscription status. | See Dodo Payments' privacy policy |
We email the clinic at least 30 days before we add or replace a sub-processor. If the clinic objects on reasonable data protection grounds and we cannot resolve it, the clinic may cancel and we refund any prepaid fee for the period after the change.
Not sub-processors: Supabase is open-source software that we run ourselves on the server above (Supabase Inc. receives no data). Google search suggestions and the Pexels stock-video library receive only general search terms, never personal data. Dodo Payments acts for payment data as an independent controller under its own terms.
7. International transfers
We are established in Montenegro, outside the EU/EEA, and some sub-processors process data in the United States. Where the GDPR, the UK GDPR or other applicable law requires a transfer mechanism for data sent to us or to a sub-processor, the parties rely on an adequacy decision where one exists, or else on the European Commission's standard contractual clauses (controller-to-processor or processor-to-processor module, with the UK addendum where relevant), which we sign on request.
8. Assistance, breaches and audits
- We help the clinic answer requests from data subjects, for example by finding or deleting material, as far as the service allows.
- We help the clinic with security, data protection impact assessments and consultations with authorities where they concern our processing.
- We notify the clinic of a personal data breach affecting its data without undue delay after becoming aware of it, with the information we have.
- We make available the information needed to show compliance with this DPA and allow audits on reasonable notice, at most once a year unless an authority requires more, at the clinic's cost.
9. Deletion at the end
The clinic can download its videos at any time. When the clinic deletes its account, we delete its data from our live systems straight away; copies in backups are overwritten as they roll over, and within 30 days no clinic data remains with us, unless the law requires us to keep it.
10. Law and precedence
This DPA follows the governing law and courts of the Terms, without limiting the rights of data subjects or authorities under the GDPR or other applicable data protection law. If this DPA conflicts with the Terms on data protection, this DPA prevails. The English text is authoritative.