Carouza · Purple Labs Inc.
Data Processing Addendum
The terms on which we process personal data on your behalf, as Article 28 of the GDPR requires. It forms part of our Terms of Service and you do not need to sign anything separately.
Effective [TO BE COMPLETED: effective date] · Last updated [TO BE COMPLETED: last updated date]
1. Scope and how this applies
This Addendum forms part of the Terms of Service between you (the controller) and Purple Labs Inc. (the processor) and applies whenever we process personal data on your behalf in providing Carouza. It takes effect when you accept those terms; no separate signature is required. If you need a countersigned copy for your records, write to [TO BE COMPLETED: legal notices email address].
“Personal data”, “processing”, “controller”, “processor”, “sub-processor” and “data subject” have the meanings given in the GDPR. Where UK, Canadian federal (PIPEDA), British Columbia (PIPA) or Quebec (Law 25) law applies instead, equivalent concepts under those laws are read in.
2. Which of us is which
- You are the controller of the personal data in your account: your own contact details, anything about your customers or audience that you put into Carouza, and the content you create and publish.
- We are the processor of that data and act on your instructions.
- We are a controller in our own right for a narrow set of things: your account and billing relationship with us, our server logs and error reports, and the anonymised aggregate statistics described in clause 9. Our Privacy Policy covers those.
- Stripe is not our sub-processor for payments. Stripe is the seller of record for your subscription and is an independent controller of the payment data you give it. Its own terms and privacy notice govern that.
3. Our instructions
We process personal data only on your documented instructions. Your instructions are: these terms, this Addendum, and your use of the product’s features: generating a carousel, scheduling a post, requesting an export. We do not process your data for any other purpose.
If we believe an instruction breaches data protection law, we will tell you and may pause that processing until it is resolved. If we are ever legally required to process your data beyond your instructions, we will tell you first unless the law forbids it.
4. Confidentiality
Everyone with access to your personal data is bound by a duty of confidentiality, and access is limited to those who need it to run or support the service.
5. Security
We implement the technical and organisational measures set out in Annex II. Those are the measures that exist in the product today. If we change them, we will not reduce the overall level of security.
6. Sub-processors
You give general authorisation for us to engage sub-processors. The current list names what each one receives and where it sits, and it is published and kept current at /legal/subprocessors.
- We will give you at least 30 days’ notice before a new sub-processor starts processing your data, by email to your account address.
- You may object on reasonable data-protection grounds within that period. If we cannot resolve your objection, you may terminate your subscription and we will refund any prepaid, unused portion.
- Each sub-processor is engaged under written terms imposing obligations no less protective than those in this Addendum, and we remain responsible to you for their performance.
7. Helping you answer data subjects
The product does most of this for you. Export gives you a complete, portable copy of everything held for your business, and account deletion erases it. Both are self-serve and both are immediate, without needing us.
Where you do need us, we will assist you with requests for access, rectification, erasure, restriction, portability and objection, taking into account the nature of the processing. We will respond to your request for assistance within one calendar month, and sooner where a data subject’s own deadline requires it. If a data subject contacts us directly, we will not respond on your behalf; we will tell you.
We will also assist you, on the same basis, with data protection impact assessments and prior consultations under Articles 35 and 36.
8. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations: what happened, which categories and roughly how many records are affected, the likely consequences, and what we are doing about it. Where we do not have all of it at once, we will send what we have and follow up.
Notifying the supervisory authority and, where required, the data subjects is yours to do as controller. Where Quebec’s Law 25 applies, we will support your report to the Commission d’accès à l’information.
9. Anonymised statistics
We may derive anonymised, aggregate statistics from processing across all customers, and use them to calibrate the statistical model that produces predictions and insights. Those statistics contain no content, no identifiers and nothing that can be attributed back to you or to any data subject, and they cannot be reversed. Personal data and content are never used to serve another customer, in any form.
10. Return and deletion
You may export a complete copy at any time while your account exists. On deletion of your account, or on termination, we delete the personal data we process for you in the order described in our Privacy Policy: files first, then records, then your sign-in account. Deletion is immediate and there is no soft-deleted copy retained.
Two honest exceptions, both stated in the Privacy Policy: server logs and error reports are not stored per customer and cannot be filtered to one, and our AI providers hold their own records of the requests we sent them, on their own retention terms.
11. Audits
We will make available the information needed to demonstrate compliance with Article 28, including the annexes below and answers to a reasonable security questionnaire. You may audit no more than once a year, on 30 days’ written notice, at your cost, during business hours, without disrupting the service and under confidentiality. You may audit more often if a supervisory authority requires it, or following a breach affecting your data.
We do not hold third-party security certifications and we do not offer an audit report in place of these rights.
12. International transfers
Your data is stored in the European Union. We are established in Canada, which holds a current adequacy decision from the European Commission for commercial organisations subject to PIPEDA, so transfers from the EEA to us require no standard contractual clauses. Where a sub-processor is outside the EEA, the transfer relies on the transfer mechanism in that vendor’s own data processing terms.
Our Article 27 representative in the European Union is [TO BE COMPLETED: Art 27 EU representative, name of the appointed firm], [TO BE COMPLETED: Art 27 EU representative, address in an EU member state].
13. Term, conflicts and governing law
- This Addendum lasts as long as we process personal data on your behalf.
- If this Addendum conflicts with the Terms of Service on the processing of personal data, this Addendum wins.
- It is governed by the laws of British Columbia, without displacing any mandatory requirement of the data protection law that applies to you.
Annex I: details of the processing
| Subject matter | Providing Carouza to you. |
| Duration | For as long as your account exists, plus the time it takes to complete deletion. |
| Nature and purpose | Storage; generating and editing carousel copy and captions using AI models; rendering slides; publishing to social accounts you connect; retrieving and analysing the resulting engagement metrics; sending service email, and marketing email where you consented to it. |
| Categories of data subject | You and any colleague you give access to; individuals appearing in or identifiable from content you upload or publish; the audience of the accounts you connect, to the extent the platform returns aggregate figures about them. |
| Categories of personal data | Names and email addresses; sign-in identifiers; business profile information; content you create or upload, including photographs; captions and hashtags; connected account handles; engagement metrics for your published posts; billing identifiers. |
| Special categories | None requested and none required. Do not upload special-category data; the product has no controls designed for it. |
| Frequency | Continuous, for as long as you use the service. |
| Sub-processors | 8 vendors, listed with their purpose and location at /legal/subprocessors. |
Annex II: technical and organisational measures
Separation between customers
Postgres row-level security on every table, keyed on business membership, so isolation is enforced by the database rather than by application code remembering to filter. Background jobs that generate, publish and learn run inside those same policies rather than under an administrative role. Uploaded files are stored under a per-business path prefix that the same policies enforce.
Access control
Authentication is passwordless: a one-time code by email, or Google sign-in. No password is created or stored. Sensitive account actions require recent re-authentication. The single credential capable of bypassing row-level security is confined to one server-only module, is never exposed to the browser or to client bundles, and a lint rule fails the build if any other file imports it.
Minimisation in telemetry
Error reports carry a user identifier and nothing else about the person: no IP address, no cookies, no request bodies. A deny-list scrubber removes slide copy, captions, hashtags, briefs, prompts, notes, business profiles, email addresses, phone numbers and addresses before an event leaves our servers, and performance tracing is disabled because it would carry prompts. Query strings are stripped from recorded URLs.
Storage and links
Data at rest sits in the European Union. Image buckets are public by design, because social platforms and browser canvases must fetch from them; paths carry unguessable identifiers and hold no confidential material. Data export archives are private and reachable only through a link that expires one hour after it is issued, is never embedded in a page, and is served with no-store caching.
Deletion
Account deletion removes files before records, enumerates storage buckets live so a bucket added later cannot be missed, and reads the storage back to confirm it is empty rather than trusting the delete call’s reply. A failure at any stage aborts before any record is removed, so a partial deletion cannot leave unattributable files behind.
Input handling
Untrusted input, meaning website text, uploaded content and briefs, is fenced and labelled as data before reaching an AI model. Outbound fetches of customer-supplied addresses are refused if they resolve into private networks, follow redirects only to addresses that pass the same check, and are size- and time-capped.
Operations
Encryption in transit and at rest is provided by our hosting, database and storage providers as a property of their platforms. Errors are monitored continuously and scheduled work is watched by a heartbeat that alerts a human when it stops.