Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") is between the Customer and PROJECT VELAR S.R.L. ("MuseMill") and forms part of the Terms of Service. It applies when MuseMill processes personal data contained in Customer Content on the Customer's behalf ("Customer Personal Data"). For that data the Customer is the controller (or a processor acting for its own controller) and MuseMill is the processor (or sub-processor).

Terms such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meaning given in the EU GDPR (Regulation 2016/679). This DPA also covers the UK GDPR, the Swiss FADP and US state privacy laws, where they apply. If this DPA conflicts with the Terms, this DPA prevails for Customer Personal Data.

2. Processing only on your instructions

MuseMill processes Customer Personal Data only to provide the Service as described in the Terms and Annex 1, and on the Customer's other documented instructions (including those given through the Service settings), unless the law requires otherwise; in that case we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks data protection law.

The Customer is responsible for having a lawful basis and the necessary notices and permissions (for example, consent or written authorisation from people featured in posts) for the Customer Personal Data it puts into the Service.

3. Confidentiality

Everyone at MuseMill who can access Customer Personal Data is bound by confidentiality and only accesses it when needed to provide or support the Service.

4. Security

MuseMill applies the technical and organisational measures in Annex 2, which are appropriate to the risk. We may improve them over time but will not reduce the overall level of protection.

5. Sub-processors

The Customer gives MuseMill general authorisation to use sub-processors. Current sub-processors are listed at musemill.ai/subprocessors. MuseMill imposes data protection obligations on each sub-processor that are no less protective than this DPA, and stays responsible for their performance.

We will give at least 30 days' notice of a new sub-processor by email to account owners and on the sub-processors page. The Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, the Customer may end the affected Service and we will refund any prepaid fees for the remaining period.

6. Helping you meet your obligations

Taking into account the nature of the processing, MuseMill will help the Customer, through the Service's features (such as export and deletion) and on request, to respond to requests from individuals exercising their rights, and to carry out data protection impact assessments and prior consultations where required. If an individual contacts us directly about Customer Personal Data, we will pass the request to the Customer and not answer it ourselves unless the Customer asks us to.

7. Personal data breaches

MuseMill will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will provide the information the Customer reasonably needs to meet its own notification duties, as it becomes available, and take reasonable steps to contain and remedy the breach. Notifying a breach is not an admission of fault.

8. International transfers

MuseMill is established in the EU. Where Customer Personal Data is transferred to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), which are incorporated by reference: Module 4 (processor to controller) where MuseMill returns data to a Customer outside the EEA, and Module 3 (or Module 2) in MuseMill's agreements with sub-processors. Where a sub-processor is certified under the EU-US Data Privacy Framework, that certification also applies. For data subject to UK or Swiss law, the UK International Data Transfer Addendum and the Swiss amendments apply. Romanian law governs the clauses and the courts of Bucharest have jurisdiction, unless the clauses require otherwise.

9. Information and audits

MuseMill will make available the information reasonably needed to demonstrate compliance with this DPA, including answers to a reasonable security questionnaire once a year. If that is not enough, or a supervisory authority requires it, the Customer may audit MuseMill (directly or through an independent auditor bound by confidentiality) on 30 days' notice, during business hours, at the Customer's cost, and no more than once a year unless a breach has occurred.

10. Return and deletion

The Customer can export Customer Personal Data from the Service at any time, and for at least 30 days after the subscription ends. When the Customer deletes its account, or on request after the subscription ends, MuseMill deletes Customer Personal Data from active systems, and from backups within 30 days, unless the law requires us to keep it (in which case we keep it protected and use it only for that purpose).

11. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, MuseMill acts as a service provider / processor and will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Customer; or combine it with personal data from other sources except as the law permits. MuseMill will comply with the applicable law, give the same level of protection it requires, and tell the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorised use.

12. General

This DPA lasts as long as MuseMill processes Customer Personal Data. Liability under this DPA is subject to the limits in the Terms, except where the law does not allow such limits. Contact for data protection matters: privacy@musemill.ai.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption: HTTPS (TLS) for all traffic; data encrypted at rest by our hosting providers.
• Tenant separation: every customer table is protected by database row-level security, so one customer's data can't be read by another.
• Access control: least-privilege access, separate service credentials, secrets kept out of code and in managed secret stores, multi-factor authentication on administrative accounts.
• Data minimisation: no card data stored (handled by Stripe); IP addresses for free previews kept only as one-way hashes; anonymous previews deleted after 7 days.
• Resilience: managed database with backups; isolated, rate-limited processing jobs with spending caps and a global stop switch.
• Application security: input validation at every trust boundary, protections against server-side request forgery when reading websites, sanitising of AI output before rendering.
• Incident response: logging and monitoring, a documented breach process, and the notification commitments in section 7.
• People: confidentiality obligations and access only on a need-to-know basis.