Data Processing Addendum

Studio Makker LLC — Empress

Version: draft, not dated for publication.

This Data Processing Addendum ("DPA") is part of the Empress Platform Terms between Studio Makker LLC ("Studio Makker") and the customer ("Customer"). It applies when Studio Makker processes Customer Personal Data in providing the Service. Words defined in the Platform Terms have the same meaning here.

1. Definitions and scope

Customer Personal Data: personal information within Customer Content, including the content of Customer's sites and the records of their readers (accounts, sessions, sign-ins, form submissions, memberships).
Data Protection Laws: the laws that apply to the processing, including the California Consumer Privacy Act as amended ("CCPA") and its regulations, the privacy laws of other US states, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and the provincial laws that apply in its place, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and, only where section 9 applies, the GDPR.
"Business," "service provider," "sell," "share," "controller," "processor," "personal information" and "processing" have the meanings in the Data Protection Laws.
Other US state laws. Where a US state privacy law other than the CCPA requires a contract between a controller and a processor, sections 3 to 10 are that contract. In particular, Studio Makker will process Customer Personal Data only on Customer's instructions, keep it confidential, delete or return it as section 10 says, give Customer the information it reasonably needs to show its own compliance, and bind each sub-processor in writing to the same obligations.

2. Roles

For Customer Personal Data, Customer is the controller (a "business" under the CCPA, or the equivalent role under the other Data Protection Laws) and Studio Makker is its processor (a "service provider").
Agencies and others acting for a client. Where Customer uses the Service to process personal information for its own client or principal, Customer confirms that it has that client's authority to bind it to this DPA, that it will not instruct any processing that client has not authorized, and that it holds that client to terms no less protective than this DPA. Studio Makker's obligations under this DPA then run to that client as well as to Customer, and Studio Makker takes instructions only from Customer.
For the personal information of Customer's members (operator accounts) and of its billing contact, and for payment, invoice and consent records, Studio Makker is a controller and processes that information under its Privacy Policy , not this DPA.

3. Instructions and Customer's obligations

Studio Makker processes Customer Personal Data only on Customer's documented instructions. The Platform Terms, the Service's settings, and the actions Customer, its members and its agents take in the Service are those instructions. Studio Makker will tell Customer if it believes an instruction breaks a Data Protection Law. The subject matter, nature, purpose, duration and categories of data are in Annex 1.
Customer will:
1. give its sites' readers and visitors the notices, and obtain the consents, that the Data Protection Laws require for the processing it instructs;
2. have a lawful basis for that processing;
3. not collect sensitive personal information through the Service (for example health, financial-account, government-identifier or precise-location data) unless Studio Makker has agreed to it in writing, and be responsible for it if it does;
4. be responsible for the content and configuration of its sites, including the forms it publishes and the integrations it connects; and
5. tell Studio Makker of any consumer request under the CCPA that Studio Makker must act on, and give it the information it needs to act.

4. CCPA service-provider terms

Studio Makker certifies that it understands and will comply with these restrictions. It will not:

sell or share Customer Personal Data;
retain, use or disclose Customer Personal Data for any purpose other than the business purposes listed in Annex 1, including any commercial purpose other than those business purposes, except as the CCPA permits;
retain, use or disclose Customer Personal Data outside its direct business relationship with Customer;
combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits;
use Customer Personal Data to train, fine-tune or improve any artificial-intelligence or machine-learning model, its own or a sub-processor's. Customer Personal Data reaches a model only to answer the request Customer or its members make, through the AI sub-processor listed on the sub-processor page. Cloudflare's published terms for Workers AI state that it does not use inputs or outputs to train models. Studio Makker will not enable, or ask a sub-processor to carry out, training or fine-tuning on Customer Personal Data.

Studio Makker will comply with the CCPA's obligations that apply to service providers and give Customer Personal Data the same level of privacy protection the CCPA requires of Customer, including by cooperating with Customer in answering consumer requests (section 7.1) and keeping reasonable security (section 5 and Annex 2). It will notify Customer if it determines it can no longer meet these obligations. Customer may take reasonable and appropriate steps to ensure Studio Makker uses Customer Personal Data consistently with Customer's obligations under the CCPA, as section 8 describes. On notice, Customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data, including by ending its use of the Service.

5. Confidentiality and security

Studio Makker ensures that anyone it authorizes to process Customer Personal Data is bound to confidentiality. It maintains the security measures in Annex 2, which it may improve but not materially weaken.

6. Sub-processors

Customer authorizes the sub-processors listed on the sub-processor page . Studio Makker will give at least 30 days' notice before a new sub-processor processes Customer Personal Data, by updating that page and emailing every billing contact. Customer may object on reasonable data-protection grounds within that period by writing to privacy@tryempress.dev. If the parties cannot resolve the objection, Customer may cancel its plan under Platform Terms §5.4 before the new sub-processor starts, and Studio Makker refunds the unused part of any yearly fee Customer prepaid, pro rata by day from the day the cancellation takes effect (Platform Terms §4.12). Studio Makker binds each sub-processor in writing to data-protection terms no less protective than this DPA and remains responsible for its performance of them.

7. Requests, incidents and assistance

Requests from individuals. Studio Makker will pass to Customer any request it receives from an individual about Customer Personal Data and will not answer it except to direct the person to Customer. The Service lets Customer find, export, correct and delete reader records itself; Studio Makker will help further where Customer cannot do so in the Service.
Security incidents. Studio Makker will notify Customer without undue delay, and no later than 72 hours after becoming aware of a breach of security affecting Customer Personal Data. The notice will describe, as far as then known, what happened and when, the data and people affected, the likely consequences, the steps taken or planned, and the measures Customer may want to take. Studio Makker will update it as it learns more and give Customer the information it reasonably needs to meet its own notification duties in time.
Assessments. Studio Makker will give reasonable help with data protection assessments that concern the Service.
Requests from public authorities. If a public authority makes a legally binding request for Customer Personal Data, Studio Makker will tell Customer unless the law forbids it, challenge a request that is overbroad or unlawful, and disclose only what the request legally requires.

8. Information and audits

Studio Makker will make available the information reasonably needed to show compliance with this DPA, by written answers to a reasonable questionnaire once a year. After a security incident affecting Customer Personal Data, or where Customer reasonably suspects unauthorized use, Customer may also carry out a remote assessment on reasonable notice. Any on-site audit requires a separate written agreement on scope and timing, and is at Customer's cost.

9. GDPR terms, dormant unless activated by a signed order form

Empress is offered to businesses in the United States and Canada, except Quebec. Self-serve signup refuses an address outside those two countries, and a Quebec address; that refusal is a control at the door, not only a term here. This section is drafted but has no effect unless Studio Makker chooses to accept a customer in the European Economic Area, the United Kingdom or Switzerland, and does so in a signed order form that names this section. When it does:

Article 28(3) of the GDPR applies, and sections 3 to 8 are read as its terms: processing on documented instructions (Art. 28(3)(a)); confidentiality (b); security under Article 32 (c); sub-processors on the conditions of Art. 28(2) and (4) (d); assistance with data subject rights (e) and with Articles 32 to 36 (f); deletion or return at the end (g, section 10); and information and audits (h, section 8).
Transfers out of the EEA are made under the Standard Contractual Clauses of Commission Decision (EU) 2021/914, Module Two (controller to processor), and, for the United Kingdom, the UK International Data Transfer Addendum to them. Annex 1 serves as their Annex I, Annex 2 as their Annex II, and the sub-processor page as their Annex III.
The order form names the governing law (Clause 17), the courts (Clause 18) and the competent supervisory authority (Annex I.C). For a Swiss customer, the order form adds the adjustments the Swiss Federal Act on Data Protection requires to the Clauses.

[verify: counsel to confirm the section 9 mechanics before any order form activates it.]

10. Return and deletion at the end

Return. Until teardown, including while the console is read-only, an owner can start a full export from the console or the connector (Platform Terms §8.6 and §22). It holds the workspace and every site, including all Customer Personal Data Studio Makker holds for Customer, with a manifest and restore instructions, and is delivered within 5 business days of the request as a download link that expires 7 days after it is sent; an owner may request a fresh export at any time while the workspace exists (Platform Terms §8.6). That export is how Studio Makker returns Customer Personal Data.
Deletion. Teardown under Platform Terms §8 deletes the Customer Personal Data Studio Makker holds for Customer. Customer may ask for teardown to run sooner. Copies in backups are deleted as those backups expire (Platform Terms §8.8). Studio Makker will confirm deletion in writing on request.
What is kept. Studio Makker keeps Customer Personal Data after teardown only where the law requires it, and will tell Customer on request what it keeps and why.
BYO. On a workspace that runs on Customer's own Cloudflare account, the Customer Personal Data in that account stays under Customer's control, and the released sites keep running there (Platform Terms §8.6 and §14).

11. Liability and precedence

On the processing of Customer Personal Data, this DPA controls over the rest of the Platform Terms. Liability under this DPA is still subject to the limits and exclusions of Platform Terms §17, including the cap in §17.2: the fees paid or owed in the twelve months before the event giving rise to the first claim, never less than US$100.

Annex 1 — the processing

Business purposes (the only ones): (a) hosting and serving Customer's sites; (b) storing and editing their content and media; (c) authenticating their readers and managing reader accounts, sessions and memberships; (d) receiving the form submissions their visitors send and notifying the people Customer chooses; (e) running the assistant and agents at Customer's or its members' request; (f) producing the full export; (g) support Customer asks for; (h) keeping the Service secure, preventing abuse and debugging faults
Duration: The plan's term, then until teardown
Data subjects: Customer's site readers, members, subscribers and visitors; people named in site content
Categories of data: Names, email addresses, reader accounts and sessions (with IP address and user agent), form submissions, membership status, and content Customer publishes
Sensitive data: None intended; see section 3.2.3
Where it is processed: On Cloudflare's network. Storage is not pinned to a region. Pooled workspaces: on Studio Makker's Cloudflare account. BYO: site data in Customer's own Cloudflare account. Sub-processor locations are on the sub-processor page

Annex 2 — security measures

Encryption: in transit (TLS) and at rest (by Cloudflare).
Sign-in: passkey-only sign-in for members; role-based permissions and approval gates for sensitive actions.
Separation: per-site separation of databases and storage; on BYO, account-level separation per customer.
Personnel and production access: write access to production is held by as few people as possible and every privileged action is logged; automated tools that diagnose production use a read-only credential. Anyone Studio Makker authorizes is bound to confidentiality and given only the access the task needs.
Continuity: if Studio Makker can no longer run the Service, it gives at least 60 days' written notice; every owner can take the full export (Platform Terms §8.6), a workspace on its own Cloudflare account keeps the site-code licence (§14), and the unused part of any yearly prepay is refunded pro rata by day (§4.12).
Payment data: card and bank data kept off Studio Makker's systems by Stripe's hosted form.
Records of consent: salted hashes rather than raw IP addresses in acceptance and consent records; the salt is set in every environment before the first charge.
Incidents: suspected breaches are handled under section 7.2.