Data Processing Addendum
1. Introduction and Scope
This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer," "Controller") and ICVR LLC, operator of Craftology ("Craftology," "Processor"), governing the processing of personal data by Craftology on the Customer's behalf in connection with the Craftology service (the "Agreement"). Where there is a conflict between this DPA and the Agreement on data protection, this DPA controls.
2. Definitions
Terms such as "personal data," "processing," "controller," "processor," "data subject," and "supervisory authority" have the meanings given in the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and other applicable data protection laws.
3. Roles of the Parties
The Customer is the Controller (or a processor acting on behalf of a third-party controller) and Craftology is the Processor. Craftology processes personal data only on documented instructions from the Customer, including those set out in the Agreement and this DPA.
4. Processing Details
-
Subject matter: Provision of the Craftology AI creative-production platform.
-
Duration: For the term of the Agreement plus any retention period set out in the Privacy Policy § 6 and Technical & Organizational Measures ("TOMs") published at craftology.io/security-measures.
-
Nature and purpose: Hosting, storage, processing, and AI-assisted generation of content as directed by the Customer including delivery of Output to authorized recipients via a content-delivery network (CDN) with edge caching, using signed, short-lived URLs.
Categories of data processed. The Service processes the categories below on the Customer's behalf. Whether a category constitutes "personal data" depends on the Customer's use; Craftology applies confidentiality and security safeguards (§7) to all of them, including creative material that may not be personal data in the narrow sense.
| Category | Description | May contain personal data |
|---|---|---|
| Account data | Names, emails, authentication identifiers, profile and role information for the Customer's users. | Yes |
| Creative content | Character bibles, story/script material, look-development assets, world/franchise and production materials. | Sometimes |
| Prompts | Text instructions submitted to generate or edit content. | Sometimes |
| Input references | Reference images, assets, or URLs supplied to guide a generation. | Sometimes |
| Media depicting or voicing people | Images, footage, and audio uploaded by the Customer that may depict a real individual or contain their voice. | Yes. Craftology does not process this material to identify individuals; see §5.1 |
| Uploaded media | Footage, images, audio, and other files the Customer uploads. | Sometimes |
| Generated output | AI-produced assets returned to the Customer. | Sometimes |
| Telemetry / usage data | Log data, IP address, device/browser information, feature usage, and performance metrics. | Yes |
| Billing data | Metering/usage-for-billing and payment records (card data tokenized by the payment processor). | Yes |
| Support data | Support tickets and communications with the Customer. | Yes |
| Generation records | For each generated asset, the inputs and metadata used to produce it: the prompt, chat history, model applied, and references to the input assets. Where an input was itself generated on the Platform, its own generation record is linked. Uploaded input assets and an AI-generated description of each are also stored. | inherits from the prompts, references and assets it records |
-
Categories of data subjects: the Customer's users, employees, and collaborators; and individuals depicted or referenced in submitted content.
-
Hosting. Craftology provides the Service as a Craftology-hosted platform. All categories above are processed within Craftology's hosting environment and by the subprocessors listed at craftology.io/subprocessors.
5. Obligations of Craftology (Processor)
5.0 Craftology will:
- process personal data only on the Customer's documented instructions, including with regard to international transfers.
- ensure persons authorized to process personal data are bound by confidentiality.
- implement the security measures in Section 7.
- respect the conditions for engaging subprocessors in Section 6.
- assist the Customer, insofar as possible, in responding to data-subject requests.
- assist the Customer with security, breach notification, data protection impact assessments, and prior consultations.
- at the Customer's choice, delete or return personal data at the end of the services (Section 9).
- make available information necessary to demonstrate compliance and allow for and contribute to audits (Section 10).
- immediately inform the Customer if, in its opinion, an instruction infringes applicable data protection law.
5.1. Media depicting or voicing people, and special-category data.
-
When the Customer uploads an image, the Service automatically classifies whether it depicts a person and, where it does, stores a short general description limited to non-identifying attributes (such as apparent age range, pose, clothing, and setting).
-
Audio uploaded by the Customer, which may contain a real person's voice, is stored and transmitted to the AI inference subprocessor used for the requested generation solely as a reference for that generation; Craftology does not transcribe or analyse audio, or extract voice characteristics from it.
-
Craftology does not perform facial or voice recognition, does not create biometric templates or voiceprints, and does not infer racial or ethnic origin, health, religious or philosophical beliefs, political opinions, or sex life or sexual orientation from uploaded media.
-
The Customer is responsible for having a lawful basis, and any consents, releases, or publicity, performance, or voice rights required, for individuals depicted or voiced in content it uploads, consistent with the Content Policy.
6. Subprocessors
6.1 The Customer provides general authorization for Craftology to engage the subprocessors listed at craftology.io/subprocessors. Craftology will impose data-protection obligations on each subprocessor that are no less protective than this DPA, and remains liable for their performance.
6.2 New subprocessors. Craftology will notify the Customer by email to its account administrator(s), and update the Subprocessors list, at least fifteen (15) days before a new subprocessor begins processing Customer personal data. Features that rely on the new subprocessor are not made available to the Customer before the notice period ends, unless the Customer requests earlier access in writing. Additional services or models provided by a subprocessor already on the list do not constitute a new subprocessor, unless they involve processing in a new location.
6.3 Objection. The Customer may object on reasonable data-protection grounds within the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the Agreement before the new subprocessor begins processing its personal data, and Craftology will refund unused purchased Credits in accordance with the Terms of Service.
6.4 Removal and replacement. Craftology may stop using a subprocessor at any time, including without notice where the subprocessor ends or suspends its service. Where this affects a default model, Craftology will replace it with a model provided by a subprocessor already authorized under this Section.
6.5 Urgent engagement. Where a new subprocessor must be engaged urgently for security or service-continuity reasons, Craftology may do so immediately and will notify the Customer as soon as practicable; the Customer's right to object under 6.3 applies.
7. Security Measures
Craftology implements and maintains the technical and organizational measures described in the Technical & Organizational Measures ("TOMs") published at craftology.io/security-measures, which are incorporated into this DPA by reference and constitute Annex II to the Standard Contractual Clauses where they apply. Craftology may update the TOMs from time to time, provided that no update materially reduces the overall level of protection of Customer personal data.
8. Personal Data Breach
Craftology will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting the Customer's personal data. Where full information is not available within that period, Craftology will provide the information then available and supplement it without undue delay as it becomes known.
9. Return and Deletion
9.1 Craftology's obligations under this Section apply to Customer personal data held in systems under Craftology's control. Copies the Customer has exported, downloaded, or shared outside the Service (including exported provenance records) are outside Craftology's control and remain the Customer's responsibility.
9.2 Upon termination or expiry, the Customer may, within 30 days, request export or return of its personal data held in Craftology-controlled systems. After that period, or on earlier written instruction, Craftology will delete such data within 30 days.
9.3 Transient working copies (temporary copies of input and output assets created during processing) are deleted automatically within 30 days, as set out in the TOMs . Data contained in encrypted backups is deleted on expiry of the applicable backup rotation (30 days), during which it remains subject to this DPA and is not restored to production except for disaster recovery.
9.4 Craftology retains account, billing, telemetry, support, and provenance records to the extent and for the periods required by applicable law or necessary to establish, exercise, or defend legal claims, as set out in the Privacy Policy and Technical & Organizational Measures ("TOMs") published at craftology.io/security-measures.
9.5 Craftology will certify deletion in writing on the Customer's request.
10. Audits
Craftology will make available to the Customer information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections. Craftology will first provide its most recent third-party certifications or audit reports (such as SOC 2, once available) and responses to reasonable security questionnaires. If these do not reasonably satisfy the Customer's obligations, or a supervisory authority requires it, the Customer may conduct an audit, itself or through an independent auditor bound by confidentiality, on at least 30 days' notice, no more than once in any 12-month period, during business hours and in a manner that minimizes disruption. Each party bears its own costs unless the audit reveals a material breach by Craftology.
11. International Transfers
11.1 To the extent Craftology processes personal data subject to the GDPR in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. Craftology is the data importer.
11.2 For the SCCs: (a) Clause 7 (docking clause) applies; (b) Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 6; (c) the optional wording in Clause 11 does not apply; (d) the competent supervisory authority is determined in accordance with Clause 13; (e) Clause 17, Option 1: the SCCs are governed by the law of Ireland; (f) Clause 18: disputes are resolved by the courts of Ireland.
11.3 Annex I is completed by Section 4 of this DPA, with the parties as identified in the Agreement; Annex II by the TOMs; and Annex III by the Subprocessors list.
11.4 For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies, completed with the information above.
12. Liability and Governing Law
The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement; nothing in this DPA limits either party's liability to data subjects under the SCCs or applicable data protection law. This DPA is governed by the law specified in the Agreement, except that the SCCs are governed by the law set out in Section 11.2, and except where applicable data protection law requires otherwise.
13. Contact
To execute this DPA or for any data-protection questions, contact privacy@craftology.io.