Data Processing Addendum

For the purposes of GDPR (and equivalent regimes), the customer (you) is the controller and Optima IA (operating Creativity) is the processor. The DPA applies whenever we process personal data on your behalf — for example, end-customer email hashes stored in `ecom_events`, review texts that include personal information, or the public comments people leave on your ads when you connect a Facebook Page (the commenter's name, profile id and comment text).

We give 30 days' notice before adding or replacing a sub-processor. The current list lives in the Privacy Policy under “Sub-processors”. Notifications go to the billing email on file.

Google (Gemini API) was added on 25 September 2026. AI tagging runs from 6 October 2026; an owner who objects writes to support@creativity.run, and it stays off for that workspace.

AI assistants you connect. When you, or a user of your workspace, connect an AI assistant such as Anthropic's Claude or OpenAI's ChatGPT to one workspace, we send it the data of that workspace it requests, on that user's instruction. The assistant is your own provider, used under your own agreement with it: it is not our sub-processor, and the 30 days' notice above does not apply to it. Comments on your ads are sent as text only, with phone numbers, email addresses and @mentions masked and never the commenter's name or id; a Facebook friend tagged in a comment can still appear by name inside the text. Images of your own ads are sent as image data, including storyboards Creativity makes from its stored copies of your videos. With “Allow edits” on for a connection, the assistant can create, change, delete (restorably) and restore that workspace's saved reports on the user's instruction, and nothing else: it never shares, publishes or invites, and never changes anything in Meta. Each user revokes their own connections from Settings → Account → Connect AI; an owner ends another user's access by changing their role or removing them from the workspace. The Privacy Policy's “AI assistants you connect” section describes what is sent and what we log.

At rest: Supabase-managed encryption. Connector OAuth tokens are Fernet-encrypted before write.

In transit: TLS 1.2+ enforced across Vercel, Render, Supabase, and all third-party API calls.

Access control: Postgres RLS scoped by `brand_id`. Operator console gated by allowlist (`OPERATOR_EMAILS`) at the middleware + server-action + API layer.

Logging: auth events, billing events, and operator-route accesses logged with a 90-day retention. Each request a connected AI assistant makes is recorded (the user, the connection, the workspace, the read, edit or prompt, the time, duration, row count, outcome and, for an edit, the saved report it touched), never the question, the request's details or the answer.

As your processor, we don't respond directly to your end-customers. You initiate the request; we provide the tooling and, where needed, manual extraction. Typical SLA: 7 days for access exports, 30 days for full erasure (matches the soft-delete-then-purge schedule).

Transfers to third-country sub-processors are governed by the EU Standard Contractual Clauses (Module 3: processor-to-processor). Google Gemini API calls (creative tagging and transcription, paid tier) rely on those Clauses and Google's data processing terms: the data may be processed in any country where Google operates, and an uploaded video is deleted after each call. Anthropic Claude calls rely on those Clauses: Anthropic does not offer an EU inference region on our account, so we do not pin one. PostHog product analytics run on PostHog's EU cloud; before cookie consent they count visits with a server-side daily hash and store nothing on the device.

Within 60 days of termination, you may request a final JSON export. After the export window, we soft-delete brand rows and purge them 30 days later. Supabase keeps daily backups for 7 days, so purged data leaves the backups 7 days later. A written deletion certificate is available on request to support@creativity.run.