Data Processing Agreement

This agreement is concluded between the business customer (“Customer”) and The Funkatorium GbR, Am Rehwinkel 2a, 14548 Schwielowsee, Germany (“we”, “us”). It forms part of the Terms of Service for business customers. Terms defined there have the same meaning here.

1. Subject and roles

1.1 We process personal data contained in Customer’s Content on Customer’s behalf in order to provide the Service. For this processing, Customer is the controller and we are the processor (Art. 28 GDPR).

1.2 For the purposes in section 5.1(a)(ii) and (iii) of the Terms and for Customer’s account, usage, payment and identity verification data, we act as controller. This agreement does not apply to that processing.

1.3 The processing lasts as long as the account contract and ends when the Content is deleted under section 9.6 or 9.7 of the Terms.

2. Nature of the processing

2.1 Purpose and nature. Storing Content, transmitting Inputs to AI model providers to generate Outputs, converting and analysing media, providing Outputs to Customer, and finding and fixing errors.

2.2 Data. Personal data that Customer includes in Inputs or that is reproduced in Outputs, in particular images, video and audio of persons, voices, names and other information in text. These can include special categories of personal data (Art. 9 GDPR), such as data concerning a person’s sex life in adult content.

2.3 Data subjects. Persons whom Customer’s Content depicts, records or names, such as actors, crew members, clients and other third parties, and Customer’s own staff.

3. Instructions

3.1 We process the data only on Customer’s documented instructions. The Terms and Customer’s use of the Service, including requests to the Assistant and the provider settings, are Customer’s instructions. Customer can give further instructions in text form.

3.2 We inform Customer without undue delay if we believe that an instruction infringes data protection law.

3.3 We may process the data otherwise only where Union or Member State law to which we are subject requires it; we then inform Customer before processing unless the law prohibits this.

4. Our obligations

4.1 Confidentiality. Persons who process the data on our behalf are bound to confidentiality.

4.2 Security. We take the technical and organisational measures in Annex 1 (Art. 32 GDPR). We may adapt them as long as the level of protection does not fall.

4.3 Assistance. Taking into account the nature of the processing, we assist Customer with requests from data subjects and with Customer’s obligations under Art. 32 to 36 GDPR. We may charge reasonable costs for assistance beyond what the Service provides itself.

4.4 Personal data breaches. We notify Customer without undue delay after becoming aware of a personal data breach affecting the data and provide the information Customer needs to meet its own notification duties.

4.5 Deletion. When the processing ends, Customer can export its Content as described in the Terms. We then delete the data under section 9.6 or 9.7 of the Terms, unless Union or Member State law to which we are subject requires us to keep it.

4.6 Information and audits. We make available to Customer the information necessary to demonstrate compliance with this agreement. Customer may audit us, itself or through an auditor bound to confidentiality, after giving at least 30 days’ notice, during normal business hours, at its own cost and no more than once a year, unless a personal data breach or an order of a supervisory authority gives cause.

5. Sub-processors

5.1 Customer authorises us to engage the sub-processors listed in Annex 2.

5.2 We inform Customer in text form of any intended addition or replacement of a sub-processor. Customer may object within 14 days for good reasons of data protection. If we do not address the objection, either party may terminate the affected contracts with effect from the change.

5.3 We impose on each sub-processor by contract the same data protection obligations as in this agreement, and we remain fully liable to Customer for the performance of their obligations.

5.4 Providers that the Model Terms and Pricing page marks as training on Content receive Content as separate controllers, not as our sub-processors. Customer can switch these providers off in the settings. As long as Customer has not done so, Customer instructs us to send Content to them whenever the Service uses one of their models for Customer.

5.5 Where a sub-processor processes data outside the EU or EEA, the transfer is based on an adequacy decision, including the EU-US Data Privacy Framework, or on standard contractual clauses, as stated in Annex 2.

6. Precedence

In matters of data protection, this agreement takes precedence over the Terms; liability under it is governed by section 8 of the Terms.

Annex 1 — Technical and organisational measures

Encryption. All connections to our systems and from them to our service providers use TLS; traffic between our own services runs in the hosting provider’s encrypted private network. Stored media files are encrypted at rest by the storage provider. Provider API keys that customers connect are additionally encrypted with AES-256-GCM before they are stored.

Access control. Users sign in through a dedicated identity provider; sessions can be revoked and revoked sessions are rejected. Our web application and our backend authenticate to each other with short-lived signed tokens. Administrative functions require a separate key. Access to production systems is limited to the partners.

Separation. Each customer’s Content is assigned to its studio and is served only to the people in that studio, as far as their role allows, or through share links created in the studio. Adult content is shown only to people who are admitted to the adult area and have unlocked it.

Monitoring. Errors and the availability of our systems are monitored. Operational logs, error reports and traces are kept for at most 90 days.

Deletion. Content is deleted when the customer deletes it, and all Content of an account is deleted 30 days after the account contract ends. Pictures of real people stored with a model provider for reuse are deleted 30 days after their last use at the latest.

Data minimisation. We use no analytics or advertising tracking.

Annex 2 — Sub-processors

Further sub-processors. fal and DeepInfra run open models, such as DeepSeek, Wan, LTX-Video, Kokoro, ESRGAN and FILM, on their own servers. For the models below, fal and OpenRouter forward each request to the company that runs the model. Transfers to these companies are onward transfers by fal and OpenRouter under the standard contractual clauses we have agreed with them; Microsoft and DigitalOcean are also certified under the EU-US Data Privacy Framework.

These companies are also named on our Model Terms and Pricing page.