Data Processing Addendum

This Data Processing Addendum ("DPA") is between KREATOR FLOW AI LIMITED (company number 16420097, registered in England and Wales, registered office 128 City Road, London EC1V 2NX, United Kingdom), trading as KreatorFlow ("we", "us"), and the customer that agrees to our Terms of Service ("you").

It applies when you use the KreatorFlow developer API, or a Business plan workspace, to process personal data on behalf of others, for example images, video or voice recordings of your end users or clients. It forms part of the Terms and needs no signature. If you need a signed copy for your records, email privacy@kreatorflow.ai.

If this DPA conflicts with the Terms on data protection, this DPA wins. If the Transfer Clauses in section 9 conflict with this DPA, the Transfer Clauses win.

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, and, where they apply to the processing, the EU GDPR and other data protection laws.
• Customer Personal Data means personal data that you, or your end users, submit to the Service and that we process on your behalf as your processor.
• Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in Data Protection Law.
• Sub-processor means a third party we engage to process Customer Personal Data.
• Service has the meaning given in the Terms.

For Customer Personal Data, you are the controller (or a processor acting for your own customer) and we are your processor (or sub-processor). Annex 1 describes the processing.

We are a separate controller, not your processor, when we process personal data for our own purposes. These are: running your account and billing; keeping the Service secure; preventing fraud and abuse; enforcing our Terms and Acceptable Use Policy; meeting our legal duties, including reporting child sexual abuse material to the authorities; and producing aggregated statistics that do not identify anyone. Our Privacy Policy covers that processing.

• We process Customer Personal Data only on your documented instructions, including for international transfers, unless the law requires otherwise. If it does, we will tell you before we process, unless the law forbids that.
• Your instructions are: the Terms and this DPA; your use and configuration of the Service, including your API requests, settings and webhooks; and any other written instructions we agree with you.
• We will tell you straight away if we think an instruction breaks Data Protection Law. We do not have to follow that instruction.
• We do not sell Customer Personal Data, and we do not use it to train AI models.

• You must have a lawful basis for the processing and give people the information Data Protection Law requires, including that their data is processed by us and our sub-processors.
• If you send images, video or voice recordings of real people, you must have their permission, or another lawful basis, for that use. Where the law requires consent, you must get it and be able to show it.
• Do not send special category data (for example health data) or criminal offence data unless you have a lawful basis and it is needed for your use. The Service is not built to identify people: it does not create face or voice templates to recognise anyone.
• Do not send personal data of children under 18 in ways our Acceptable Use Policy does not allow. Never send images of minors for face swap.
• You are responsible for securing your API keys and webhook endpoints, and for what your end users submit.

We make sure that anyone we authorise to process Customer Personal Data is bound by a duty of confidentiality. Staff access it only when they need to, for example to provide support you ask for, to keep the Service safe, or to meet a legal duty.

We take appropriate technical and organisational measures to protect Customer Personal Data, as Article 32 of the UK GDPR requires. They take into account the state of the art, the cost, the nature of the processing and the risks to people. Annex 2 summarises them. We may update them over time, but we will not make them less protective overall.

• You give us general permission to use sub-processors. Annex 3 lists the ones we use now by category; we give API and Business customers the names of each sub-processor on request.
• We will tell you at least 30 days before we add or replace a sub-processor, by email to your account address and by updating Annex 3.
• You can object on reasonable data protection grounds within those 30 days by emailing privacy@kreatorflow.ai. We will work with you in good faith to find a solution. If we cannot, you may stop using the affected part of the Service, and we will refund any prepaid amounts for it that you have not used.
• We put a written contract in place with each sub-processor that gives Customer Personal Data at least the same protection as this DPA. We remain responsible to you for our sub-processors' work.

We are based in the UK. Some sub-processors process Customer Personal Data outside the UK and the European Economic Area, mainly in Singapore, Malaysia and the United States (Annex 3). When we transfer Customer Personal Data to a country without an adequacy decision, we protect it with:

• for UK data, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner;
• for EU data, the EU Standard Contractual Clauses (2021/914);
• a transfer risk assessment and extra safeguards where needed.

Transfers from you to us. If you are in the EEA, transfers to us in the UK are covered by the European Commission's adequacy decision for the UK. If that decision stops applying, the EU Standard Contractual Clauses are incorporated into this DPA ("Transfer Clauses"): Module 2 if you are a controller, or Module 3 if you are a processor. You are the data exporter and we are the data importer. Clause 7 applies. For Clause 9, option 2 applies, with the notice period in section 8. The option in Clause 11 does not apply. For Clause 13, the supervisory authority is the one responsible for you. For Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1, 2 and 3 of this DPA complete the Annexes of the Clauses.

If you are in the UK, transfers to us are not restricted transfers. If you transfer personal data to us from elsewhere and your law requires a transfer mechanism, contact us and we will agree a suitable one.

• If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay.
• We will give you the information you need to meet your own duties, as far as we have it: what happened, the kinds and rough numbers of people and records affected, the likely consequences, and what we have done or plan to do. If we do not have all of it at first, we will send it in stages.
• We will take reasonable steps to contain the breach and reduce its effects, and help you with notices to regulators and to the people affected.
• Telling you about a breach is not an admission of fault.

We will help you respond to requests from people who use their rights under Data Protection Law, such as access, correction, deletion and objection, taking into account the nature of the processing. Much of this you can do yourself, for example by deleting uploads and outputs through the API. If a person contacts us directly about Customer Personal Data, we will pass the request to you and will not answer it ourselves, unless the law requires us to.

We will give you reasonable help, using the information available to us, with data protection impact assessments, consultations with regulators, and your security duties. Where this goes beyond the information in this DPA and our documentation, we may charge a reasonable fee, unless the help is needed because we broke this DPA.

• While you use the Service, you can download and delete Customer Personal Data yourself, for example through the API.
• We delete API outputs and uploads at the end of their retention period unless you have a Storage Pack. We clear the prompts and request details of API jobs 90 days after the job completes.
• When your account ends, you have until it closes to download what you need. About 30 days after your account is deleted, we delete or anonymise the remaining Customer Personal Data, and delete it from our sub-processors where they let us do so; copies a sub-processor keeps are deleted under its own retention terms. We may keep data where the law requires us to; we keep it protected and use it only for that reason.
• On request, we will confirm in writing that we have done this.

• We will make available the information you reasonably need to show that we meet Article 28 of the UK GDPR and this DPA. We will answer reasonable security questionnaires.
• If that information is not enough, or a regulator requires it, you may audit our compliance, on reasonable request. You must give us at least 30 days' notice, audit no more than once a year (unless after a breach or at a regulator's request), use an auditor bound by confidentiality, and avoid disrupting our business or other customers' data. You pay for your own audit costs.
• We may share our sub-processors' own audit reports or certifications in place of an audit of their systems.

This DPA lasts as long as we process Customer Personal Data for you, and the parts about deletion, confidentiality and audits continue until we have deleted it. Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Transfer Clauses do not allow this.

• Subject matter and purpose: providing the Service to you, including AI generation and editing of images, video and audio, speech and transcription, safety checks, storage and delivery of files, and the developer API.
• Nature of the processing: receiving, storing, transmitting to sub-processors for generation and safety checks, generating outputs, sending webhooks, retrieving and deleting.
• Duration: while you use the Service, plus the deletion periods in section 13.
• People concerned: your end users; people who appear in images, video or audio you send; people named or described in prompts; your staff and workspace members.
• Types of personal data: prompts and other text; images and video that may show people's faces; voice recordings, and voice models made from them for speech; transcripts; identifiers you choose to include; webhook URLs; the names and email addresses of workspace members.
• Special category data: none intended (section 5). Face images are used to make the outputs you ask for, not to identify anyone. No face or voice templates for recognition are made.
• Frequency: continuous, each time you or your end users use the Service.

• All connections to the website, the app and the API use HTTPS (TLS) encryption.
• Files are reached through signed links that expire, by default after 15 minutes. Upload links expire after 10 minutes.
• API keys are stored only as hashes, are shown once, and can be revoked at any time.
• Webhooks are sent only to HTTPS addresses and signed with HMAC-SHA256. Webhook signing secrets are stored encrypted (AES-256-GCM). Requests we make to addresses you give us are protected against server-side request forgery.
• Passwords are hashed with scrypt and a unique salt. Login session tokens are stored only as hashes, and sessions expire after 30 days.
• Rate limits and bot protection guard sign-in, sign-up and the API.
• Workspace roles (owner, admin, editor, viewer) control who can see and change content.
• Staff access is limited to authorised people who need it. Support access to act as a user lasts at most one hour and is logged.
• Our API request logs do not record request bodies, API keys, headers or prompts. Error logs are kept for 30 days.
• Our infrastructure runs on BytePlus and our hosting provider, which are responsible for the physical and network security of their data centres.
• We have a process for finding, containing and reporting security incidents.

• BytePlus (a ByteDance company): AI image, video and audio generation and editing; speech, transcription and translation; automated safety checks on images and video; web research for video prompts; video editor processing; file storage; the main database. Location: Singapore and Malaysia (Johor).
• Our hosting provider: Website and API hosting, application functions and bot protection. Location: Singapore (functions), with a global network.
• Video processing providers: Make the depth-map version of a video for the optional depth-map video filter, only when it is used. Location: United States.
• Our error monitoring provider: Error monitoring. Error reports can include account or workspace IDs and technical data. Location: United States or European Union.
• Our rate limiting provider: Rate limiting, using hashed identifiers. Location: Cloud provider region.
• Our email provider: Sending service emails, such as workspace invitations and account notices. Location: United States.

We also use Stripe for payments, but for billing data Stripe and we each act as controllers, so it is not listed here. If you connect an AI assistant such as Claude or ChatGPT, its provider is a separate controller of what it receives, and is not our sub-processor.