A study is a folder on your own storage: a project database alongside the recorded video. Screen text indexing, speech transcription, event logging and AI analysis all run on that machine and write back into that folder.
We are not a party to it. We do not host it, receive it, back it up, or have any credential that would let us read it. If your participants are recorded, their video and their words are yours to hold and yours to protect, under whatever consent and retention rules govern your research.
In data-protection terms: for the personal data of your participants, you are the controller and we are not a processor, because the data never comes into our hands. If your organisation requires a data processing agreement covering participant data, the honest answer is usually that none is needed for the product itself — but tell us what you need and we will work through it with you.
The observer console and the participant station run on your own machine and are reached over your own network. Used that way, nothing about a session crosses the internet at all.