Data Processing Addendum

1. Scope and parties

This DPA is between Agentic Flow LLC, a Texas, United States limited liability company (“Processor”, “we”), and the customer that has agreed to the TrulyFinal Terms of Service (“Customer”, “you”). It applies to Customer Personal Data that we process in providing the Service, where that processing is subject to Data Protection Laws. If this DPA conflicts with the Terms, this DPA prevails for data protection matters.

This DPA does not cover data for which we are an independent controller, such as studio account, billing and website data, which is described in our Privacy Policy.

2. Definitions

• “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended (“CCPA”), each as applicable.
• “Customer Personal Data” means personal data in Customer Content, and personal data about Customer’s clients and reviewers, that we process on Customer’s behalf.
• “Subprocessor” means a third party we engage to process Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR. Other capitalised terms have the meanings in the Terms.

3. Roles and instructions

1. Customer is the controller (or a processor acting for its own clients) and we are the processor of Customer Personal Data.
2. We will process Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA and Customer’s use and configuration of the Service are Customer’s complete instructions. We will tell Customer if we believe an instruction breaches Data Protection Laws.
3. We may process Customer Personal Data where required by law; in that case we will tell Customer first unless the law forbids it.
4. Customer is responsible for the lawfulness of its instructions, for having a lawful basis and giving any notices required for the processing, and for the accuracy of the Customer Personal Data it provides.
5. The subject matter, nature, purpose and duration of processing, and the types of data and data subjects, are set out in Annex 1.

4. Confidentiality

We ensure that anyone we authorise to process Customer Personal Data is bound by confidentiality obligations and only has access as needed to provide, secure and support the Service.

5. Security

We implement and maintain the technical and organisational measures in Annex 2, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risks to data subjects. We may update these measures over time provided the overall level of security is not reduced.

6. Subprocessors

1. Customer gives general authorisation for us to engage Subprocessors. Our current Subprocessors are listed in Annex 3.
2. We will impose data protection terms on each Subprocessor that protect Customer Personal Data to a standard at least equivalent to this DPA, and we remain responsible for our Subprocessors’ performance.
3. We will update the list on this page and notify Customer by email at least 30 days before a new Subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period. We will then work in good faith to address the objection; if we cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.

7. Assistance and data subject rights

1. Taking into account the nature of processing, we will assist Customer by appropriate technical and organisational measures to respond to requests from data subjects to exercise their rights. The Service lets Customer view, export and delete its projects and files.
2. If we receive a request directly from a data subject relating to Customer Personal Data, we will pass it to Customer and will not respond ourselves except to direct the data subject to Customer, unless Customer authorises us to.
3. Approval records. Approval records are append-only and tamper-evident. To honour an erasure request while preserving Customer’s business record of the approval, we will pseudonymise the personal data in affected approval records (such as name, email address, IP address and user agent) rather than delete the record itself.
4. We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to our processing.

8. Personal data breaches

We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach. Our notification is not an admission of fault.

9. Deletion and return

Customer can export its data from the Service at any time, including while its workspace is read-only. We delete Customer Personal Data 90 days after the account is closed or after the workspace has been read-only for 90 days, and deleted data rolls off our backups within a further 7 days, unless the law requires us to keep it. Customer can ask us to delete its data sooner by emailingsupport@trulyfinal.com.

10. Audits

On written request, we will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires and available third-party certifications or reports of our Subprocessors. If that information is not enough to meet Customer’s obligations under Data Protection Laws or a supervisory authority requires it, Customer may carry out an audit, at its own cost, no more than once a year, on at least 30 days’ notice, during business hours, subject to reasonable confidentiality and security conditions and without access to other customers’ data.

11. International transfers

We store Customer Personal Data primarily in the United States, and our Subprocessors may process it in the locations listed in Annex 3. Where Customer Personal Data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been found to provide adequate protection, the parties agree that:

1. EEA transfers are governed by the SCCs, which are incorporated by reference. Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. Clause 7 (docking) applies; under Clause 9 Option 2 (general written authorisation) applies with the notice period in section 6; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by the laws of, and disputes resolved in the courts of, Ireland. Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.
2. UK transfers are governed by the UK Addendum, which is incorporated by reference. Table 1 is completed with the parties’ details in this DPA, Table 2 with the SCC modules and options above, Table 3 with the Annexes of this DPA, and in Table 4 either party may end the UK Addendum as set out in its Section 19.
3. Swiss transfers are governed by the SCCs as adapted for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority and references to “Member State” including Switzerland.
4. If we adopt an alternative lawful transfer mechanism (for example, certification under the EU–US Data Privacy Framework), that mechanism may apply instead, to the extent it covers the transfer.

If the SCCs or UK Addendum conflict with this DPA, the SCCs or UK Addendum prevail.

12. US state privacy laws

Where the CCPA or similar US state laws apply, we act as Customer’s “service provider” or “processor”. We will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service under the Terms; retain, use or disclose it outside our direct business relationship with Customer; or combine it with personal data we receive from other sources except as permitted by law. We will tell Customer if we can no longer meet our obligations under those laws.

13. General

This DPA lasts for as long as we process Customer Personal Data. The limitations of liability in the Terms apply to this DPA, except where Data Protection Laws or the SCCs do not allow it. This DPA is governed by the law that governs the Terms, except where the SCCs or UK Addendum require otherwise. For a countersigned copy, email hello@trulyfinal.com.

Annex 1: Details of processing

Annex 2: Technical and organisational security measures

Encryption

• All traffic to the Service uses TLS (HTTPS).
• Uploaded and delivered files are stored encrypted at rest in Cloudflare R2.
• The database is hosted by Neon with encryption at rest.

Access control

• Passwords are stored only as salted, one-way hashes.
• Workspace data is separated by tenant, and access in the app is limited by workspace membership and role.
• Review and delivery links use long, unguessable tokens; reviewer guest sessions are scoped to the review link.
• Session cookies are secure, HTTP-only and limited to essential use.
• Staff access to production systems is limited to those who need it, protected with multi-factor authentication, and used only to operate, secure and support the Service.

Integrity

• Approval records are append-only and hash-chained, so later changes are detectable.
• Each approved file version is fingerprinted with SHA-256.

Availability and resilience

• The Service runs on Cloudflare’s global network with DDoS protection.
• Database backups support point-in-time recovery for up to 7 days.
• File processing runs in isolated containers and is queued so failures can be retried.

Operations

• Infrastructure is managed as code, and changes are reviewed before deployment.
• Dependencies are kept up to date and security fixes are prioritised.
• Application and security logs are kept for a limited period to detect and investigate abuse and incidents.
• We have an incident response process that includes the breach notifications in section 8.
• Subprocessors are chosen for their security practices and bound by written data protection terms.

Data minimisation and deletion

• Reviewers do not need accounts; we collect only a name and email address to attribute comments and approvals.
• We do not use advertising trackers, and we only set essential cookies.
• Data is deleted on the schedule in section 9, with erasure requests in approval records handled by pseudonymisation.

Annex 3: Subprocessor list

We use the following Subprocessors to provide the Service. Primary data is stored in the United States.

Stripe and Google mainly process account and support data for which we are a controller; they are listed here because support emails or billing contacts can include Customer Personal Data.