Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Selfstorming Terms of Service between Selfstorm s.r.o., Priama cesta 14, 841 10 Bratislava, Slovak Republic, Identification no. 57 138 036 ("Selfstorming", the processor) and the customer using the Service ("you", the controller).

It applies whenever the content you enter into the Service contains personal data for which you or your organisation are the controller, for example names of your clients' staff in a brief. You accept this DPA by accepting the Terms of Service. It is concluded in electronic form under Article 28(9) GDPR, so no separate signature is needed.

1. Subject Matter and Details of Processing

• Customer Content: everything you enter or upload into the Service (briefs, brand information, documents, prompts) and the outputs generated from it.
• Purpose and nature: storing Customer Content and processing it to provide the Service, including AI generation, research and analysis.
• Data subjects: your staff, your clients and their staff, and any other people you mention in Customer Content.
• Categories of data: names, job titles, business contact details and any other personal data you choose to include. Please do not enter special categories of data (Article 9 GDPR) or data about criminal convictions.
• Duration: for as long as your account exists, followed by deletion as described in section 8.

2. Instructions

Selfstorming processes Customer Content only on your documented instructions. The Terms of Service, this DPA and your use and configuration of the Service are your complete instructions. We will tell you if we believe an instruction infringes data protection law, and we process Customer Content for other purposes only where EU or Member State law requires it, in which case we inform you unless that law prohibits it.

3. Confidentiality

Everyone at Selfstorming authorised to access Customer Content is bound by confidentiality. Access is limited to what is needed to run and support the Service.

4. No Training on Customer Content

Customer Content is never used to train or fine-tune any AI model, by Selfstorming or by any sub-processor. All AI providers are used through their paid API terms, which exclude API inputs and outputs from model training. Customer Content is never shown to other users. We may use aggregated, de-identified usage signals (for example how often generated ideas are saved) to improve our own prompts and product.

5. Sub-processors

You give general authorisation for Selfstorming to engage the sub-processors listed below. Each is bound by a written agreement with data protection obligations no less protective than this DPA, and Selfstorming remains responsible for their performance.

We will update this list and notify subscribers by email at least 14 days before a new sub-processor starts processing Customer Content. If you object on reasonable data protection grounds and we cannot address the objection, you may cancel your subscription and receive a pro-rata refund of any prepaid fees.

6. International Transfers

Customer Content is stored in the EU (Frankfurt). Where a sub-processor processes personal data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework adequacy decision where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914).

7. Security Measures (Article 32)

• Encryption in transit (HTTPS/TLS) for all traffic and encryption at rest for the database and file storage.
• Row-level security in the database, so each account can only access its own Customer Content.
• Sign-in through Google or Supabase Auth; we do not store passwords in our own systems.
• Secret keys and service credentials kept server-side only, never exposed to the browser.
• Administrative access to production systems limited to named personnel.
• Regular automated backups, and monitoring and error tracking of the application.
• Payment card data handled exclusively by Stripe (PCI DSS certified); we never see or store card numbers.

8. Retention, Deletion and Return

• Customer Content is kept while your account exists, so you can return to your sessions. Ending a paid subscription does not delete it.
• You can export your outputs from the Service at any time.
• When you ask us to delete your account at hello@selfstorming.com, we delete your account and all Customer Content within 30 days. Backups containing it are overwritten within a further 30 days.
• We keep billing records only as long as accounting law requires; they contain no Customer Content.

9. Assistance

Taking into account the nature of the processing, we help you respond to data subject requests (access, correction, deletion and others) and meet your obligations under Articles 32 to 36 GDPR, including security, breach notification, impact assessments and prior consultation.

10. Personal Data Breaches

We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Content. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and is sent to the email address of your account.

11. Information and Audits

We make available the information needed to demonstrate compliance with Article 28 GDPR, starting with this DPA and written answers to reasonable security questionnaires. If that is not sufficient, you may audit our compliance once a year with at least 30 days' written notice, at your own cost and under confidentiality, or at any time a supervisory authority requires it.

12. General

In case of conflict between this DPA and the Terms of Service on the protection of personal data, this DPA prevails. Liability under this DPA is subject to the Terms of Service, except where GDPR does not permit it to be limited. This DPA is governed by the laws of the Slovak Republic. Data protection requests go to hello@selfstorming.com.