Data Processing Addendum

1. What this addendum is

This Data Processing Addendum (“DPA”) is part of the Terms of Service between StoresWiki LLC (“we”, “us”) and the customer that holds a ChannelForge workspace (“you”). It applies whenever we process personal data on your behalf to provide the Service and the EU General Data Protection Regulation (“GDPR”), the UK GDPR or another data protection law that requires such terms applies to that processing. You accept it when you accept the Terms; nothing needs to be signed. Where this DPA and the Terms differ about personal data, this DPA applies.

“Customer Personal Data” is the personal data we process for you: the personal data in your workspace’s content and in what we read for it from the accounts you connect. The words “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” mean what the GDPR says they mean.

2. Who decides what

• You are the controller of Customer Personal Data — or, when you act for a client of your own, its processor — and we are your processor (or sub-processor).
• An agency that runs a client’s workspace is “you” for that workspace: it acts for its client, and we act on its instructions, as the Privacy Policy’s “Agency mode” says.
• For the data we hold about you and your members as our own customers — accounts and sign-in, billing, security and abuse prevention, our service emails, our legal obligations — we are an independent controller, and the Privacy Policy applies, not this DPA.

3. The processing

The subject matter is providing the Service under the Terms. It lasts for as long as you use the Service, and until Customer Personal Data is deleted as section 10 says. Its nature and purpose are to host, store, transmit, render, analyse with AI models, publish to the platforms you connect, read back from them and delete Customer Personal Data, so that the Service does what you and your members set it up and ask it to do. Annex 1 lists the categories of data and of data subjects.

4. Your instructions

• We process Customer Personal Data only on your documented instructions: the Terms, this DPA, and what you and your members choose and do in the Service — its settings, connections, schedules, approvals and the requests you make through the app, the API or a connected app. We use it only to provide the Service to you, and we never sell it.
• If the law requires us to process it otherwise, we tell you first, unless the law forbids that.
• If we believe an instruction breaks data protection law, we tell you.
• You are responsible for the instructions you give and for having a lawful basis for the processing, including the notices and consents your audience, your team and the people in your footage are owed — for example before a member ticks the box that shows your audience’s ages, genders and countries on a media kit.

5. Confidentiality and our people

Only StoresWiki LLC’s own staff who run and support the Service can reach Customer Personal Data, and only as far as their work needs it; each of them is bound to confidentiality. In the app they reach it through a staff console that needs a staff role: support staff can look but change nothing, and staff changes — and their use of the staff media explorer — are recorded in the audit log.

6. Security

We protect Customer Personal Data with the technical and organisational measures in Annex 2, which we keep under review as the Service and the risks change. We may change them, but never in a way that lowers the overall level of protection. The Security page describes them for everyone.

7. Sub-processors

• You authorise us to use the sub-processors listed on our Sub-processors page (Annex 3).
• We tell you before a new sub-processor processes Customer Personal Data: on that page, and by email or in the app to your workspace’s owners. If you object on reasonable data protection grounds, tell us; we will try to find a way to meet the objection — for example by keeping that sub-processor away from your workspace. If we cannot, you may stop using the feature concerned, or end the Terms.
• We engage each sub-processor under a written contract that requires it to protect Customer Personal Data as this DPA requires of us, and we remain responsible to you for its work.
• The platforms you connect — YouTube, Facebook, Instagram, Threads, TikTok, LinkedIn, X, Bluesky and Pinterest — are not our sub-processors. They receive what you publish to them under their own terms, as independent services.

8. Helping you

• Requests from data subjects. The Service lets you act on most requests yourself: a member can download their data and delete their account, owners and admins can remove members and disconnect platforms, uploaded footage can be deleted with its file and transcript, a brand voice withdrawn, stored revenue deleted and a workspace deleted. If someone asks us about personal data in your workspace, we tell you and help you answer; we answer them ourselves only as you instruct or as the law requires.
• Your own obligations. We give you the information about the Service you reasonably need for a data protection impact assessment, a prior consultation with a supervisory authority, or your own security.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we tell your workspace’s owners without undue delay, by email and in the app, with what we know: what happened, the categories and approximate number of the people and records concerned, the likely consequences, and what we have done or propose to do. We add to it as we learn more, and help you meet your own duties to notify. Telling you is not an admission of fault.

10. Deletion and return at the end

While your workspace exists you can take your content with you: download your episodes and films, your brand suites, and “Download my data” (your account and the workspaces you own). When a workspace is deleted — by its owner, with the account of its only member, or by an agency removing a client — this is what happens:

• At once: its members lose access, its API keys and pending invitations are revoked, its webhooks, schedules and live channels stop, its queued and running jobs are cancelled and its media kit links stop.
• Within 7 days (six days after the deletion): its connected-platform tokens and connections, everything we read from the platforms for it, its link pages’ click counts and its brand voice are deleted.
• Within 30 days: the rest of its content is deleted, as the Privacy Policy says — its projects, channels, episodes, films, products, transcripts and every file we stored for it.
• Kept, as the law and our accounts require: the workspace’s own record with its members, teams and invitations, billing records, credit history, the audit log, job records (ids, counts and our own words), the record of a brand voice’s consent and of its withdrawal, and the record of the rights confirmed for uploaded footage.
• Backups: database backups keep 7 days of point-in-time recovery, so deleted data leaves them within 7 days.

Deleting a workspace deletes our copy only: it does not remove ChannelForge’s access at a platform. To do that, use the platform’s own settings, as the Privacy Policy explains.

11. Information and audits

We make available the information you need to show that we meet our obligations under Article 28: this DPA, the Security page, the Sub-processors page, and written answers to your reasonable questions about how we protect Customer Personal Data. If that information is not enough, you — or an independent auditor you choose who is bound to confidentiality — may audit our compliance, on reasonable notice, at your cost, and in a way that does not expose other customers’ data or weaken the Service’s security.

12. Where the data goes

The Service is hosted in the European Union, in AWS eu-central-1 (Frankfurt). Some processing happens elsewhere, as the Sub-processors page shows: AI model access through AWS Bedrock in the United States, GPU rendering where GPU capacity is (today the Netherlands, the United States and Singapore), Google’s speech services worldwide, Gemini in the United States, and payments and Cloudflare’s network in several countries. We transfer Customer Personal Data out of the European Economic Area, the United Kingdom or Switzerland only with a transfer mechanism the law that applies recognises — an adequacy decision, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

13. Liability, duration and changes

• Each party’s liability under this DPA is subject to the limits in the Terms, except where the law does not allow it to be limited.
• This DPA lasts for as long as we process Customer Personal Data for you.
• We may update this DPA for changes in the law or the Service, never to lower the protection it gives. We tell workspace owners about material changes as the Terms say.

14. Contact

Questions about this DPA: support@storeswiki.com, or choose “Data Processing Addendum” on the contact form.

Annex 1 — Data subjects and personal data

We do not ask for special categories of personal data (Article 9 of the GDPR) or data about criminal convictions. Do not put them in your workspace without a lawful basis for it. The processing is continuous while you use the Service; each kind of data is kept as section 10 and the Privacy Policy’s “How long we keep it” say.

Annex 2 — Technical and organisational measures

• Encryption in transit — TLS on every hop: from the browser to Cloudflare, and from Cloudflare to our server with a Cloudflare origin certificate; HSTS keeps browsers on HTTPS; our services verify the database’s certificate.
• Encryption at rest — the database, the media bucket and the server’s disk are encrypted; platform tokens, two-factor secrets, webhook secrets and a brand voice’s key are also sealed with AES-256-GCM; passwords are hashed with argon2id; API keys, session tokens and review-link tokens are stored only as hashes.
• Network — the server accepts web traffic only from Cloudflare, and administrative access from one allowed address; the database sits on a private network; the AI model gateway cannot be reached from the internet; sign-in, sign-up and the API are rate limited.
• Workspaces kept apart — every page, action and database query is scoped to its workspace; a membership and a role (owner, admin, editor, viewer) are required; projects can be restricted to teams; API keys belong to one workspace and carry scopes; webhooks go only to public HTTPS addresses, checked at delivery, never following a redirect.
• GPU machines — they hold no cloud or model credentials; each job runs as its own unprivileged user, in a folder other jobs cannot open, with its own process and file-system namespaces and private temporary space, cleaned before and after; a job that runs code written for it has its network closed to everything but its own tunnels to our model gateway and voice service (and, for a film, the machine’s own name resolver); model calls carry a per-job, budget-capped token that expires; the machines accept connections only from our control plane.
• Accounts — two-factor authentication with an authenticator app and one-time recovery codes; sessions stored server-side, rotated at sign-in, ended by a password change and revocable; repeated failed sign-ins are slowed and then locked; password resets do not reveal whether an account exists.
• Staff access — in the app, through a staff console that needs a staff role; support staff can only look; staff changes and the staff media explorer’s use are recorded in the audit log.
• Logging and monitoring — an audit log of security-, membership-, billing- and staff-relevant actions; a monitoring service that checks the Service every few minutes and raises incidents.
• Backups and resilience — automated database backups with point-in-time recovery over 7 days and deletion protection; two web instances with rolling deploys; jobs that survive restarts.
• Secrets — kept only on our server, each readable only by the service that needs it (the AI model key by the model gateway alone); the server reaches its storage bucket and its email through a role, not a stored key; card details never reach us, because payments happen on Stripe’s and PayPal’s own pages.
• Media — a private storage bucket, with public access blocked; members get media through short-lived signed links; public pages you publish (link pages, media kits) load nothing from other sites and set no cookies.
• Deletion — an automated purge of deleted workspaces on the timings in section 10, and a file of uploaded footage deleted 30 days after its upload.
• Changes — changes are tested before they ship, and each deploy ends with checks of the signed-in pages and of real form submissions.

Annex 3 — Sub-processors

The sub-processors, what each does and where, are listed on the Sub-processors page, which is part of this DPA and is updated as section 7 says.