Data Processing Addendum

1. Roles

For Customer Content you upload to the Service, you are the data Controller and we are the Processor. For account and billing data, we are the Controller (see our Privacy Policy).

2. Subject matter, duration and scope

We process personal data only on your documented instructions, for the duration of your subscription, to provide and support the Service.

3. Sub-processors

We currently use the following sub-processors:

• Paddle.com Market Limited — payments, invoicing, tax.
• Supabase, Inc. — database, auth, storage hosting.
• Cloudflare, Inc. — edge runtime, CDN, DDoS protection.

We will give you at least 30 days' notice of any new sub-processor; you may object on reasonable data-protection grounds.

4. Security measures

We maintain the technical and organisational measures described on our Security page, including encryption in transit and at rest, access controls, audit logging, and regular backups.

5. International transfers

Where personal data is transferred outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum), which are incorporated by reference into this DPA.

6. Assistance

Taking into account the nature of the processing, we will assist you with data-subject requests, breach notifications, data-protection impact assessments, and prior consultations with supervisory authorities.

7. Audits

We will make available all information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by you or an auditor mandated by you, at reasonable notice and during normal business hours, no more than once per year.

8. Deletion or return

On termination of your subscription, we will delete or return all Customer Content within 90 days, save where retention is required by applicable law.

9. Signing

If you require a counter-signed copy of this DPA, email legal@salsabeel.dev with your company name and registered address.