Data Processing Addendum

1. Roles and Scope

You act as the Controller of Personal Data uploaded, generated, or otherwise submitted to the service by you or your end-users. We act as Processor and only process such data on your documented instructions and as necessary to provide the service.

2. Subject Matter and Duration

Subject matter: AI-powered content creation (script generation, voiceover synthesis, video rendering, scheduling, distribution).
Duration: For the term of your subscription plus retention periods described in our Data Retention Policy.

3. Categories of Data and Data Subjects

• Account data: name, email, hashed password, profile.
• Usage data: projects, scripts, prompts, render history, analytics events.
• Connected platform data: OAuth tokens (encrypted with AES-256-GCM) and post metadata for connected social accounts.
• Voice samples: only when you opt into voice cloning, with signed consent.
• Data subjects: you, your team members, your collaborators, and end-users featured in content you upload.

4. Sub-Processors

We engage the following sub-processors. Adding or replacing a sub-processor requires 30 days' notice, during which you may object in writing.

• Supabase, Inc. (US/EU) — database, auth, edge functions, storage.
• Stripe Payments UK, Ltd. — billing and subscription management.
• Paystack Payments Ltd. — African payments and creator payouts.
• Google LLC — Gemini AI Gateway models for script and image generation.
• OpenAI, LLC — model inference for select features.
• ElevenLabs, Inc. (US) — premium voice synthesis and the Ada voice assistant (audio is streamed in real time, not stored by us).
• Resend, Inc. — transactional email delivery.
• Sentry — error monitoring (PII scrubbed).

5. International Transfers

Where Personal Data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) with appropriate supplementary measures, including encryption in transit (TLS 1.2+) and at rest (AES-256).

6. Security Measures

• Encryption: TLS 1.2+ in transit, AES-256 at rest, AES-256-GCM for OAuth tokens.
• Access control: role-based access via has_role() security definer functions; least-privilege service roles.
• Authentication: mandatory email verification, HaveIBeenPwned password leak checks.
• Monitoring: Sentry alerts on error spikes; Telegram on-call for production incidents.
• Backups: daily database backups with point-in-time recovery.
• Audit: role grant/revoke events written to role_audit_log.

7. Data Subject Rights

We assist you in responding to data subject requests (access, rectification, erasure, portability, restriction, objection). Most actions can be performed self-service from the in-app Settings → Data & Privacy panel. For requests we receive directly from your end-users, we will forward them to you without undue delay.

8. Personal Data Breach Notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with the information required under Article 33(3) GDPR.

9. Audit Rights

On reasonable written notice (not more than once per year, except after a confirmed breach), we will make available the information necessary to demonstrate compliance with this DPA, including third-party audit reports and SOC summaries from our sub-processors where available.

10. Return or Deletion

On termination, we will delete or return all Personal Data within 30 days, subject to backup retention windows described in our Data Retention Policy and any legal obligation to retain.

11. Contact & Acceptance

For DPA inquiries or to request a counter-signed copy: privacy@michelleandrichedgestudio.com.

By creating an account or continuing to use the service, you accept this DPA on behalf of the Controller you represent. A counter-signed PDF version is available on request for organizations that require it for procurement records.