Data Processing Addendum.

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between CreatorSense, a business name of Matt Orchard (sole trader), ABN 65 815 285 275, Sydney NSW, Australia ("CreatorSense", the processor) and the creator or agency using Trace (the "Customer"). It applies when CreatorSense processes personal data on the Customer's behalf ("Customer Personal Data"), mainly the fan and buyer details and content the Customer puts into Trace.

It is written to meet Article 28 of the EU GDPR and the UK GDPR, and also covers the Australian Privacy Act 1988 and US state privacy laws, where they apply. Using Trace means the Customer accepts this DPA. If you need a signed copy, email info@creatorsenseai.com.

2. Roles

The Customer is the controller of Customer Personal Data, or a processor acting for a creator (for example an agency acting for the creators it manages), in which case CreatorSense is a subprocessor. CreatorSense is the processor. CreatorSense is a separate controller only for account, billing and security data, as described in the Privacy Policy. Under US state laws, CreatorSense acts as the Customer's service provider and does not sell or share Customer Personal Data, retain, use or disclose it outside the business relationship, or combine it with other data except as those laws allow.

3. Customer instructions

CreatorSense processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use and settings of the service are those instructions. CreatorSense tells the Customer if it believes an instruction breaks data protection law. If the law requires other processing, CreatorSense tells the Customer first unless the law forbids it.

The Customer is responsible for the lawfulness of the data it provides and its instructions, including having a lawful basis, giving notices to its fans, and obtaining any consents.

4. CreatorSense's obligations

• Ensure people authorised to process Customer Personal Data are bound by confidentiality.
• Apply the security measures in Annex 2.
• Engage subprocessors only as set out in section 5.
• Help the Customer, taking into account the nature of the processing, to answer requests from people exercising their rights. Tools in the app let the Customer view, edit, export and delete fan records. If a request reaches CreatorSense directly, we pass it to the Customer without undue delay and do not answer it ourselves unless the Customer asks or the law requires.
• Help the Customer with security, breach notification, data protection impact assessments and prior consultation, using the information available to CreatorSense.
• Delete or return Customer Personal Data at the end of the service under section 9.
• Make available the information needed to show compliance with Article 28 and allow audits under section 10.

5. Subprocessors

The Customer gives general authorisation for CreatorSense to use the subprocessors on the Subprocessors page. CreatorSense will give at least 30 days' notice by email to the account owner before adding or replacing a subprocessor, and update that page. The Customer may object on reasonable data protection grounds within that time by emailing info@creatorsenseai.com. If we cannot resolve the objection, the Customer may cancel the affected service and receive a pro-rata refund of prepaid fees for it.

CreatorSense puts data protection terms in place with each subprocessor that offer at least the same level of protection as this DPA, and remains responsible to the Customer for its subprocessors' performance.

6. Personal data breaches

CreatorSense notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and aims to do so within 72 hours. The notice describes, as far as known, what happened, the data and people affected, likely consequences, and the steps taken or proposed. Information can be given in stages. CreatorSense works with the Customer on notifications to regulators (including the OAIC under the Notifiable Data Breaches scheme) and to affected people. Notifying a breach is not an admission of fault.

7. International transfers

Customer Personal Data is processed in Australia, the United States and on Cloudflare's global network (see the Subprocessors page). For transfers of personal data protected by the EU GDPR to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"):

• Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor;
• clause 7 (docking) applies; clause 9(a) option 2 (general authorisation) applies with the notice period in section 5; the optional language in clause 11 does not apply;
• clauses 17 and 18: the law and courts of Ireland;
• Annex I is completed by Annex 1 of this DPA (the Customer is the data exporter and CreatorSense the data importer; the competent supervisory authority is the one for the Customer's EU establishment or EU representative), and Annex II by Annex 2.

For data protected by the UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Tables 1 to 3 completed from this DPA and either party able to end it as allowed by its Table 4. For Swiss data, the SCCs apply with references read as references to the Swiss Federal Act on Data Protection. If the SCCs conflict with this DPA, the SCCs prevail.

For personal information covered by the Australian Privacy Act, CreatorSense handles it in line with the Australian Privacy Principles, including APP 8 for overseas disclosure.

8. Customer responsibilities

The Customer must only add fan details and content it is allowed to use; tell its fans, in its own privacy notice or platform terms, that copies are individually marked and how delivery records are used; use results lawfully and in line with the Acceptable Use Policy; and keep its account and API keys secure.

9. Deletion and return

The Customer can export and delete fan records, content and cases in the app at any time. When the Customer deletes its account, CreatorSense deletes Customer Personal Data from its live systems straight away and from backups as they are overwritten, unless the law requires CreatorSense to keep it. Hashes already written to a public ledger (only if that feature is on) contain no personal data that identifies a fan and cannot be deleted.

10. Audits

CreatorSense will answer a reasonable written security questionnaire once a year and provide information needed to show compliance with this DPA. If that is not enough, or a regulator requires it, the Customer may carry out an audit with at least 30 days' notice, during business hours, at its own cost, by an auditor bound by confidentiality, without access to other customers' data. Requests go to info@creatorsenseai.com.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where the law or the SCCs do not allow it. If this DPA conflicts with the Terms, this DPA prevails for Customer Personal Data. This DPA ends when CreatorSense stops processing Customer Personal Data.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit: TLS on all connections to the app, API, MCP server and engine.
• Encryption of secrets at rest: integration API keys, access tokens, webhook secrets and two-factor secrets are encrypted at the application level. Media in Cloudflare R2 is encrypted at rest by Cloudflare.
• Credentials: passwords are hashed with Argon2; API keys are stored only as keyed hashes (HMAC-SHA256) and shown once.
• Marking keys: each creator's marking key is derived on use from a master secret held in the hosting environment; keys are not stored in the database and are never returned to an API caller.
• Access control: every request is scoped to the signed-in account; agency teams have roles (owner, manager, chatter) and an audit log; two-factor authentication and passkeys are available; CreatorSense staff access to customer data is limited to what is needed for support and security.
• Data minimisation: Vault IP addresses and browsers are deleted after 90 days; marks carry a code, not a name; Sentry is configured not to send default personal data.
• Resilience: managed database hosting with provider backups; a standby host for the marking engine.
• Monitoring: error monitoring, rate limiting and abuse detection.
• Incident response: incidents are triaged, contained and recorded, and affected customers are told under section 6.
• Deletion: self-service deletion of fans, content, cases and accounts.

More detail is on the Security page.

Annex 3: Subprocessors

See the Subprocessors page, which forms part of this DPA.

Other legal documents: Privacy Policy · Terms of Service · Acceptable Use Policy · Refund Policy · Referral Programme Terms · Subprocessors · Cookie Policy · Security · Copyright Policy.