Data Processing Addendum

01Roles of the parties

For Customer Content and workspace data, you are the Controller and Superbloo is the Processor. You determine what you upload, which models you run, and who in your organization has access; we process that data only to provide the Services and only on your instructions.

For a limited set of data we are an independent Controller: account registration details, billing records, security logs, and the product analytics described in our Cookie Settings. We process these to run Superbloo as a business, not on your behalf.

02Scope of processing

• Subject matter — provision of the Superbloo AI video and advertising platform.
• Duration — for the term of your subscription, plus the retention period in section 08 of the Privacy Policy.
• Nature and purpose — storage, transmission, transcoding, rendering, and AI-assisted generation and editing of the content you submit.
• Categories of data subjects — your workspace members, and any individuals appearing or identifiable in the content you upload.
• Categories of personal data — names, email addresses, and profile images of workspace members; and whatever personal data is contained in your Customer Content, which may include images, video, and voice recordings of identifiable individuals.

03Our obligations

• Process personal data only on your documented instructions, and tell you if we believe an instruction breaches applicable law.
• Impose confidentiality obligations on personnel with access to personal data.
• Maintain the technical and organizational measures described on our Security page.
• Assist you in responding to data-subject requests, and provide the in-product controls needed to export or delete data yourself.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data.
• Delete or return personal data on termination, subject to the backup expiry cycle in the Privacy Policy.

04Subprocessors

You grant general authorization for us to engage the subprocessors listed at superbloo.com/subprocessors. We impose data-protection obligations on each of them no less protective than this DPA, and remain liable for their performance.

We update that page when the list changes. To receive advance notice of additions, and an opportunity to object, ask us to add you to the notification list at privacy@superbloo.com.

AI model providers are engaged per generation according to the model you select. Choosing a model is your instruction to transmit that request to that provider.

05International transfers

Superbloo is established in the United States and operates globally distributed infrastructure. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum as applicable. Module Two (controller to processor) applies to our processing of Customer Content.

Product analytics and error reporting are hosted in the European Union, so those categories do not leave the EEA in the ordinary course.

06Audits

On reasonable written request, and no more than once per year unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this DPA — including completing a security questionnaire. We do not currently hold a SOC 2 or ISO 27001 report; see Security for our current position.

07Model training

We do not use Customer Content to train Superbloo or third-party foundation models unless you explicitly opt in through a clearly labeled setting. Our agreements with model providers prohibit them from training on your inputs or outputs by default.

08Order of precedence

Where this DPA conflicts with the Terms of Service, this DPA controls for matters of personal-data processing. Where it conflicts with the Standard Contractual Clauses, the Clauses control.

09Contact