Data Processing
Addendum.
This Data Processing Addendum ("DPA") forms part of the Carousel Studio Terms of Service and applies when we process personal data on your behalf as a processor under applicable data protection laws.
1. Roles & scope
You (the customer) are the data controller. Carousel Studio is the data processor for any personal data you upload, type, or generate within the Service. This DPA applies for as long as you use the Service.
2. Subject matter & duration
We process personal data only to provide the Service: generating carousels, saving your work, processing payments, and supporting your account. Processing continues for the lifetime of your account plus any retention windows described in our Privacy Policy.
3. Sub-processors
We use the following sub-processors, each bound by equivalent data protection terms:
- Anthropic — AI text generation (US)
- Fal.ai — AI image & video generation (US)
- Stripe — payments (US, global)
- Resend — transactional email (US)
- Replit — application hosting & database (US)
We will notify you at least 30 days before adding or replacing a sub-processor.
4. Security measures
We implement reasonable technical and organizational measures, including encryption in transit (TLS 1.2+), encrypted-at-rest databases, least-privilege access controls, and routine backups. Production access is limited to named engineers under contractual confidentiality.
5. International transfers
Where personal data is transferred outside the EEA / UK, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as applicable.
6. Data subject requests
You can export or delete your carousel data from within the Service at any time. We will assist with verified requests from your end users at no additional charge for reasonable volumes.
7. Breach notification
We will notify you without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.
8. Contact & signing
To countersign this DPA for your organization, email legal@carousel.studio. By using the Service, you agree to the terms above as a base-rate DPA.