Data Processing Addendum

Last updated

This addendum forms part of the Depicta Terms of Service between you and 30ohm L.P. ("we"). It applies automatically when you use Depicta for business purposes and, through Depicta, process personal data on behalf of others. For example, you build Depicta into your own app or service, or you use it on your clients' photos. Where it conflicts with the Terms, this addendum prevails for Customer Personal Data.

1. Definitions

  • Customer Personal Data: personal data in the prompts, uploaded or linked images, and generated or processed images that you send to Depicta or receive from it, to the extent you are its controller (or a processor for your own client).
  • GDPR: Regulation (EU) 2016/679. Other terms have the meaning the GDPR gives them.

2. Roles

  1. For Customer Personal Data, you are the controller (or a processor acting for your client), and we are your processor.

  2. We are a controller, not your processor, for the processing we do for our own purposes, described in our Privacy Policy:

    • your account, billing and payments;
    • security and abuse prevention, including our content checks on prompts and images and the human review of their decisions;
    • keeping prompts, encrypted, for 12 months to investigate abuse, answer lawful requests from authorities, and establish or defend legal claims;
    • the fingerprints (hashes) of generated and uploaded images;
    • complying with our legal obligations.

    This addendum does not restrict that processing. You must tell the people whose data you send us that we process it for these purposes, and link to our Privacy Policy.

3. Our obligations as processor

  1. Instructions. We process Customer Personal Data only on your documented instructions. These are the Terms, this addendum and the requests you make through the service, unless EU or Member State law requires otherwise; in that case we tell you first, unless the law forbids it. If we think an instruction infringes data protection law, we tell you.
  2. Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality.
  3. Security. We take the measures in Annex 2 (GDPR Art. 32).
  4. No other use. We don't use Customer Personal Data for any purpose other than providing the service and the purposes in Section 2.2. In particular, Customer Personal Data is excluded from the prompt analysis program (Privacy Policy §8); don't opt in to it for an account that sends us Customer Personal Data.
  5. Sub-processors.
    • You give us general authorisation to use the sub-processors listed in the Privacy Policy, Section 4.1 and 4.1.1: hosting and email, our inference provider, and the AI model providers for the models you use.
    • We bind each of them to data protection obligations that give the protection Art. 28(4) requires, and we stay responsible to you for their performance.
    • We tell you about a new sub-processor at least 14 days before it processes Customer Personal Data, by updating the Privacy Policy and emailing your account address. Exception: an urgent replacement needed for security or to keep the service running, which we tell you about as soon as we can.
    • You may object on reasonable data protection grounds within that period. If we can't resolve the objection, you may end your use of Depicta, and we refund the price of your unused paid credits.
  6. International transfers. Some sub-processors are outside the EU. Transfers rely on the mechanisms stated in the Privacy Policy, Section 5: adequacy decisions, including the EU-US Data Privacy Framework, or the Standard Contractual Clauses.
    • If you are established outside the EEA and the GDPR does not apply to your processing, Module 4 (processor to controller) of the Standard Contractual Clauses (Decision (EU) 2021/914) applies to data we return to you, and is incorporated by reference.
    • In those clauses, Greek law governs and the courts of Athens have jurisdiction.
  7. Assistance. Taking into account the nature of the processing and the information available to us, we help you:
    • answer requests from data subjects (GDPR Chapter III);
    • meet your obligations under Articles 32 to 36. Generated and uploaded images are deleted within hours, so in practice assistance concerns prompts. We may charge reasonable costs for assistance beyond what the dashboard and our standard support provide.
  8. Personal data breaches. We notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data. We include the information Art. 33(3) requires as it becomes available.
  9. End of processing.
    • Customer Personal Data is deleted on the schedule in the Privacy Policy, Section 6:
      • generated and processed images normally within 15 minutes after the 1-hour delivery link expires, and in any case within 24 hours;
      • uploads within 24 hours.
    • When you stop using Depicta, we keep no Customer Personal Data as your processor beyond that schedule.
    • Prompts kept for our own purposes (Section 2.2) are deleted after 12 months, unless the law or a legal hold requires otherwise.
  10. Information and audits.
    • We make available the information needed to demonstrate compliance with this addendum:
      • our Privacy Policy;
      • a description of our security measures;
      • answers to reasonable written questions.
    • If that isn't enough, you or an auditor bound by confidentiality may audit us, including by inspection:
      • once a year at most, unless a supervisory authority requires more or a breach gives cause;
      • on 30 days' written notice;
      • during business hours, without disrupting the service or other customers' data;
      • at your cost.

4. Your obligations

  1. You have a lawful basis for the Customer Personal Data you send us, and you give the people concerned the information the GDPR requires, including about our own processing (Section 2.2).
  2. You don't send special categories of personal data, or data about criminal convictions, unless the Acceptable Use Policy allows it. You don't send images of real people for uses it forbids.
  3. You are responsible for your end users' compliance with the Acceptable Use Policy for requests made through your account.

5. Liability

Each party's liability under this addendum is subject to the Terms, Section 15. This does not limit either party's liability to data subjects under GDPR Art. 82.

6. Duration

This addendum applies as long as we process Customer Personal Data for you. Sections 3.9 and 3.10 survive until that data is deleted.

Annex 1: Details of the processing

  • Subject matter and duration: providing the Depicta service to you, for as long as you use it.
  • Nature and purpose:
    • checking, generating, editing, combining and processing images at your request;
    • delivering the results;
    • marking generated images as AI-generated (EU AI Act Art. 50(2)).
  • Types of personal data: whatever you include in prompts and images. Typically:
    • names and descriptions of people;
    • likenesses in photos;
    • metadata in uploaded files;
    • request metadata.
  • Data subjects: your end users and clients, and the people shown or named in prompts and images.
  • Special categories: not intended; see Section 4.2.
  • Retention: see Section 3.9.

Annex 2: Security measures

As described in the Privacy Policy, Section 13, and elsewhere in it:

  • Location and transport:
    • hosting and storage in the EU (France);
    • encryption in transit (TLS 1.2 or higher).
  • Encryption and minimisation:
    • prompts encrypted at rest (AES-256-GCM);
    • passwords and API keys stored only as hashes;
    • download links that expire after one hour, and no permanent image storage.
  • Access and accountability:
    • least-privilege access to internal systems;
    • every authenticated request to our administrative interfaces, including any access to personal data, logged;
    • content reviewers see requests without account details.
  • Isolation, routing and reviews:
    • the content classifier runs in a separate container with no shared state;
    • requests to AI model providers go only to the endpoints we pin (Privacy Policy, Section 4.1.2);
    • regular security reviews (dependency scanning, configuration audits).

Annex 3: Sub-processors

The current list is in the Privacy Policy, Sections 4.1 and 4.1.1, which is part of this addendum.