Data Processing Terms (United States)

1. Definitions and Roles

1.1 Definitions.“Privacy Laws” means the US state privacy laws applicable to the processing under these terms, including the California Consumer Privacy Act as amended by the CPRA (“CCPA”) and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Texas, and other states as applicable. “Business,” “Consumer,” “Personal Information,” “Process,” “Sell,” “Share,” “Service Provider,” “Third Party,” and “Sensitive Personal Information” have the meanings given in the CCPA; equivalent terms under other Privacy Laws (including “controller” and “processor”) have their corresponding meanings.

1.2“Customer Personal Information” means Personal Information contained in Sources, Inputs, or otherwise Processed by Vidify on the Customer’s behalf under the Agreement. Details are in Annex I.

1.3“Subprocessor” means a third party engaged by Vidify to Process Customer Personal Information. The current register is Annex III, published at vidifyads.com/subprocessors.

1.4 Roles. The Customer is the Business/controller and Vidify is the Service Provider/processor as to Customer Personal Information. Where the Customer is itself a service provider or processor for its own customers, Vidify acts as a subprocessor and the equivalent obligations apply.

1.5 Excluded processing. Account, billing, product-telemetry, and website-analytics data Processed by Vidify for its own business purposes is Processed by Vidify as a Business/controller under the Privacy Policy and is not subject to these terms.

2. Permitted Processing; Service Provider Commitments

2.1 Instructions.Vidify will Process Customer Personal Information only to perform the Services and only on the Customer’s documented instructions, including as set out in the Agreement, these terms, and the Customer’s configuration and use of the Service (for example, the Sources the Customer directs Vidify to ingest and the features the Customer selects).

2.2 Service Provider restrictions. With respect to Customer Personal Information, Vidify:

(a) will not Sell or Share it;

(b) will not retain, use, or disclose it for any purpose other than performing the Services specified in the Agreement, including for any commercial purpose other than performing the Services, and will not retain, use, or disclose it outside the direct business relationship between the parties;

(c) will not combine it with Personal Information received from or on behalf of another person, except as permitted by the CCPA and its regulations;

(d) will comply with the obligations applicable to it under the Privacy Laws and provide the same level of privacy protection as the Privacy Laws require of a Business; and

(e) will notify the Customer if it determines it can no longer meet its obligations under the Privacy Laws.

2.3 Certification. Vidify understands the restrictions in Section 2.2 and will comply with them.

2.4 Customer’s right to remediate.The Customer may take reasonable and appropriate steps to help ensure Vidify’s Processing is consistent with the Customer’s obligations under the Privacy Laws, and to stop and remediate any unauthorized Processing, as provided in Section 10.

2.5 Relationship to Section 3. The Customer acknowledges that the Service operates by transmitting Inputs to the third-party AI providers identified in Annex III, and that certain of those providers retain rights described in Section 3. Section 2.2(b) is qualified accordingly.

3. Third-Party AI Providers and Model Training

3.1 Vidify’s own models. Vidify will not use Customer Personal Information to train its own general-purpose or shared AI models. Vidify may use de-identified and/or aggregated data to develop and improve its models and the Service.

3.2 Third-party providers.To generate Outputs, Vidify transmits Inputs to the third-party AI and media-generation providers listed in Annex III. The providers in the production path operate under no-training commitments, except where Annex III records a position as still under confirmation. Annex III records each provider’s position. Where a provider retains training rights, Vidify cannot restrict that use on the Customer’s behalf, and the Customer’s use of the corresponding features constitutes instruction to transmit data on those terms.

4. Subprocessors

4.1 Authorization. The Customer authorizes Vidify to engage the Subprocessors listed in Annex III.

4.2 Flow-down.Vidify will impose obligations on each Subprocessor by written contract that are substantively equivalent to those in these terms and that meet the Privacy Laws’ requirements for subcontractors, and remains responsible for its Subprocessors’ performance. Exception: certain AI providers identified in Annex III contract only on their own standard terms, which reserve rights to use submitted data for their own model development; for those providers Vidify cannot impose equivalent obligations, and Section 3.2 governs.

4.3 Changes. Vidify will maintain the register at vidifyads.com/subprocessors and give notice of the addition or replacement of a Subprocessor at least thirty (30) days in advance. The Customer may object on reasonable data-protection grounds, and the parties will work in good faith to resolve the objection, failing which the Customer may disable the affected feature or terminate the affected Service.

4.4 Country-of-concern routing. Certain optional model routes reach Subprocessors or downstream operators associated with a country of concern under 28 C.F.R. Part 202. Where the Customer selects such a model, Vidify will:

(a) transmit only the prompt and the specific media asset required for that generation, and will not transmit account identifiers, user names or email addresses, billing data, product telemetry, or the Customer’s sourced brand report;

(b) not enable facial-recognition, voice-identification, or other biometric enrollment or template-generation capability on those routes;

(c) maintain records sufficient to monitor volumes against the bulk thresholds in 28 C.F.R. § 202.205, and implement a Data Security Program meeting the applicable CISA security requirements before any threshold is met; and

(d) make available a Customer-level control to disable these routes.

5. Security

5.1 Vidify will implement and maintain the technical and organizational measures in Annex II, appropriate to the nature of the Personal Information and the risks involved, consistent with the reasonable-security requirements of the Privacy Laws.

5.2 Vidify will ensure that personnel authorized to Process Customer Personal Information are bound by confidentiality obligations and Process it only as instructed.

6. Sensitive and Biometric Information

6.1 Voice; no voiceprints.Sources and Inputs may contain audio of real people speaking, which Vidify Processes (including by transcription) to provide the Service and which certain editing modes retain in the resulting Output. Vidify never performs speaker identification. It does not create voiceprints or other voice templates, does not use voice to recognize or verify any individual’s identity, and does not offer voice cloning or voice conversion. No voice template capable of identifying an individual is created or enrolled.

6.2 Other sensitive information. The Customer will not submit Sensitive Personal Information unless it has established the required legal basis and provided any required notice or opt-out, and has informed Vidify so appropriate safeguards apply.

7. Consumer Rights Requests

7.1 Vidify will provide reasonable assistance, taking into account the nature of the Processing and the information available to it, to enable the Customer to respond to verifiable Consumer requests to know, access, correct, delete, or limit the use of Personal Information, and to opt out of Sale or Sharing.

7.2 If Vidify receives such a request directly, it will without undue delay direct the Consumer to the Customer and, unless legally prohibited, inform the Customer.

8. Security Incidents

8.1 Vidify will notify the Customer without unreasonable delay after becoming aware of a breach of the security of Customer Personal Information, and will provide the information reasonably available to it to assist the Customer in meeting its obligations under applicable state breach-notification laws.

8.2 Notice under this Section is not an acknowledgment of fault or liability.

9. Deletion and Return

On termination of the Service, Vidify will, at the Customer’s election, delete or return Customer Personal Information and delete existing copies, unless retention is required by law.

10. Demonstrating Compliance

Vidify will make available information reasonably necessary to demonstrate compliance with these terms, including its current security documentation, the Annex III register, and any third-party security assessments it holds.

11. Data Location

Vidify Processes Customer Personal Information in the United States.

12. General

12.1 Precedence. These terms are incorporated into the Agreement. In the event of conflict on data-protection matters, these terms control over the Terms of Service; a mutually executed order form controls over these terms.

12.2 Liability. These terms are subject to the limitations of liability in the Agreement.

12.3 Term. These terms take effect on the Effective Date and continue for as long as Vidify Processes Customer Personal Information.

12.4 International expansion.

Annex I — Description of Processing

Subject matter:Generation of advertising creative for the Customer’s software product.

Duration: The term of the Agreement, until deletion or return under Section 9.

Nature and purpose: Ingestion and analysis of Customer-directed Sources; generation, quality analysis, and delivery of Outputs; personalization based on Verdicts; support and security.

Categories of Personal Information:Names, images, likenesses, recorded voices, and other Personal Information of individuals appearing in the Customer’s product materials, media, or public sources the Customer directs Vidify to research; transcripts derived from that media; and, in audio-retaining editing modes, retained source audio carried into Outputs. No voiceprints or voice templates are created and no speaker identification is performed (§ 6.1).

Categories of Consumers:The Customer’s personnel and authorized users; individuals depicted or named in the Customer’s Sources; individuals appearing in public sources the Customer directs Vidify to research.

Frequency: Continuous while the Service is used.

Annex II — Security Measures

• Encryption of data in transit and at rest, including encrypted object storage and encrypted database backups.
• Access controls, authentication, and secret/key management; least-privilege access.
• Short-lived signed links for media access; minimization of persistent exposure.
• Ephemeral, account-scoped agent execution environments.
• Error-monitoring configured to strip request bodies, headers, cookies, query strings, raw error messages, and AI inputs/outputs; analytics configured with masking and consent gating.
• Logging, monitoring, and vulnerability management.
• Personnel confidentiality obligations.
• Data retention and deletion controls, including backup-deletion timelines.
• Incident response and breach-notification procedures.

Annex III — Subprocessor Register

Current as of the effective date above. We will update this register when a provider or its position changes, and will give notice of additions or replacements as set out in Section 4.3. “Training position” records whether the provider is permitted, under its own terms, to use data submitted to it to develop or improve its models. The operational detail behind each entry is published at vidifyads.com/subprocessors.

Infrastructure and operations

• Railway— Hosting, databases, workers, scheduled backups. United States.
• Cloudflare— R2 object storage for media and encrypted backups; signed links. United States.
• Clerk— Authentication, identity, sessions, account webhooks. United States.
• Stripe— Checkout, subscriptions, invoices, disputes, card processing. United States.
• Resend— Transactional and lifecycle email; unsubscribe preferences. United States.
• Sentry— Sanitized application-error reporting. United States.
• PostHog— Product analytics, feature flags, masked session replay. United States.
• Modal— Agent sandboxes — receives the account-scoped workspace, memory, asset metadata, commands, and files required to perform an agent turn. United States.

AI, media generation, and research

• OpenAI— Primary agent models; all media transcription.
• Google (Gemini)— Brand research, search grounding, image and video generation and editing, media understanding, ad planning, quality and approval analysis.
• Speechify— Text-to-speech.
• fal.ai— Image, video, and audio generation and editing; avatars; lip-sync; text-to-speech.
• fal.ai partner models— Generation routed by fal.ai to underlying model operators, including Kling/Kuaishou, ByteDance, and ElevenLabs.

Research and browsing

• Apify— Crawls public websites and publicly available social and advertising-library material.