TrueOwned Data Processing Agreement

1. Parties, scope and priority

This Data Processing Agreement ("DPA") forms part of the TrueOwned service contract between the business identified in the accepted account or order (the "Customer") and Lynx Group GmbH, Kaiserstuhlstrasse 2, 8154 Oberglatt, Switzerland (the "Processor" or "Lynx"). The Customer's identity, address and authorised contact are those recorded in the account's business details and in the record of the Customer's acceptance of this DPA, which Lynx keeps together with the accepted version. The Processor's privacy and incident contact is hello@trueowned.com. The Processor's representative in the European Union under Article 27 GDPR is Cloudkasten GmbH (rep4eu), Seestr. 20 G, 50374 Erftstadt, Germany.

"Applicable Data Protection Law" means the Swiss Federal Act on Data Protection (FADP) and its ordinances and, where they apply to the processing, the GDPR and the data protection laws of EU and EEA Member States. "Customer Personal Data" means personal data that the Processor processes on behalf of the Customer under the service contract. Terms defined in the GDPR have the same meaning here, and the equivalent Swiss concepts apply where relevant.

The Customer acts as controller, or as processor authorised by its own controller to appoint the Processor as subprocessor. References to the controller's instructions include lawful instructions passed on through the Customer. Each party complies with its own statutory duties.

This DPA prevails over conflicting terms of the service contract as regards Customer Personal Data. A binding transfer instrument prevails over both within its scope. This DPA does not cover processing for which Lynx is an independent controller, as described in its Privacy Notice.

2. Processing particulars and instructions

Schedule 1 sets out the subject matter, duration, nature and purposes of the processing, the types of personal data and the categories of data subjects. The Processor processes Customer Personal Data only on the Customer's documented lawful instructions, including with regard to transfers, unless the law applicable to the Processor requires otherwise. In that case the Processor informs the Customer before processing, unless that law prohibits such notice on important grounds of public interest.

The Customer's instructions are the accepted order, this DPA, the settings the Customer configures in its account and the Customer's requests to generate, edit, store, export or publish content. These instructions do not cover training AI models, advertising, selling personal data or any other reuse of Customer Personal Data for the Processor's own purposes. Further instructions must be documented and fall within the Service or a separately agreed scope. The Processor tells the Customer promptly if it believes an instruction infringes Applicable Data Protection Law and may suspend that instruction until it is clarified.

The Customer is responsible for having a lawful basis, for its authority to give instructions, for the notices and consents required and for the accuracy and lawfulness of the data it supplies. If it acts for another controller, it must obtain the necessary authorisation and pass on the relevant instructions and information. These duties do not reduce the Processor's own obligations.

3. Confidentiality and security

The Processor gives access to Customer Personal Data only to authorised personnel who need it to provide the Service, binds them to confidentiality or ensures they are under a suitable statutory duty of confidentiality, and gives them appropriate security and data-protection instructions. The duty of confidentiality continues after their access ends.

The Processor implements and maintains the technical and organisational measures in Schedule 2, appropriate to the risks, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. It reviews and tests these measures and may update them as long as the overall level of protection is not materially reduced. It provides the information the Customer reasonably needs to assess them. Schedule 2 does not claim any certification.

4. Subprocessors

The Customer gives general written authorisation for the subprocessors listed as approved subprocessors in the provider register, which forms Schedule 3. The Processor has a written contract with each subprocessor that imposes, in substance, the same data-protection obligations as this DPA, including confidentiality, security, instructions, assistance and lawful transfer conditions. The Processor remains responsible to the Customer for each subprocessor's performance of those obligations as required by Applicable Data Protection Law.

The Processor gives at least 30 days' notice before adding or replacing a subprocessor, by email to the Customer's account contact and by publishing a new version of the provider register. The notice names the entity, its function, its countries and the main safeguards. The Customer may object on reasonable data-protection grounds during that period. The Processor does not send Customer Personal Data to the new subprocessor before the notice period ends and any objection is resolved, unless the Customer gives specific written approval. An emergency does not remove the need for authorisation: in that case the Processor may suspend the affected function or ask for expedited specific approval.

The parties will look for a reasonable solution to a substantiated objection. If there is none, the Customer may terminate the affected function before the change takes effect and receives a proportionate refund for prepaid service that can no longer be provided, subject to mandatory law. The Processor keeps the provider register current and keeps earlier versions available.

AI text requests are routed by OpenRouter, Inc. only to the endpoints named in the provider register (Amazon Bedrock and Google Cloud Vertex AI), restricted to zero-data-retention endpoints that do not collect data for training. Any fallback stays within those endpoints. Adding another inference provider is a subprocessor change under this Section.

5. International transfers

The processing countries, including remote access, are stated for each subprocessor in the provider register. The Processor makes or permits an international transfer only on the Customer's documented instructions, which include the use of the subprocessors in the register, and only with the protection required by Applicable Data Protection Law. Transfers from the EU to Switzerland rely on the European Commission's adequacy decision for Switzerland. Onward transfers are assessed separately and do not rely only on the Processor's location in Switzerland.

Where no adequacy decision or recognised certification covers a transfer, the Processor ensures that the European Commission's standard contractual clauses, with the adaptations required for Swiss transfers, are in place with the importer before the transfer takes place, together with the supplementary measures in Schedule 2. For the subprocessors in the register, these are the clauses incorporated into their data processing agreements. The Processor makes information about the transfer mechanism available to the Customer on request, with lawful redactions. If lawful protection cannot be maintained, it suspends the affected transfer and agrees deletion, return or a lawful alternative with the Customer.

The Processor reviews any request from a public authority for Customer Personal Data and, where legally possible and appropriate, challenges requests that are disproportionate. It discloses only the minimum required and notifies the Customer unless the law prohibits this. It documents such requests and its responses and shares this information to the extent lawful.

6. Assistance and data subject rights

Taking into account the nature of the processing, the Processor helps the Customer with appropriate technical and organisational measures to respond to requests to exercise rights of access, correction, deletion, restriction, objection, data portability and other applicable rights. If such a request reaches the Processor, it forwards it to the Customer promptly and does not answer it on the merits unless instructed or legally required. It helps with reasonable searches, exports, corrections and deletions within the Customer's legal response period.

Taking into account the information available to it, the Processor helps the Customer with security, the assessment and notification of breaches, data protection impact assessments and prior consultation with supervisory authorities. It cooperates with competent authorities within its legal obligations and tells the Customer about matters affecting the Customer's data where lawful. Reasonable charges for exceptional assistance may be agreed in advance, but they never delay a legally required response and never apply to remedying the Processor's own breach.

7. Personal data breaches

The Processor notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event sends an initial notification within 48 hours, even if not all details are known yet. The notification describes, as far as known, the nature of the breach, the data and the categories and approximate numbers of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact for further information. Further information follows in phases without undue delay.

The Processor takes reasonable steps to contain and remedy the breach, preserves relevant evidence and supports the Customer's decisions on notifying authorities and individuals. The Customer remains responsible for its notifications as controller; the Processor keeps any duty imposed directly on it. A breach notification is not an admission of liability. Each party keeps a reachable incident contact up to date.

8. Return, deletion and end of the Service

After the affected Service ends, the Processor returns or deletes Customer Personal Data at the Customer's choice and deletes remaining copies, unless the law requires it to keep them:

• Export window: for 30 days after the account is closed or the contract ends, the Customer can export its sites and content; on request during that period the Processor restores access for this purpose.
• Deletion from active systems: within 30 days after the export window ends.
• Deletion on request during the Service: within 30 days of the Customer's instruction, or sooner where Applicable Data Protection Law requires.
• Scroll-video inputs: keyframe photographs and uploaded videos used for a render are deleted 30 days after the render unless the Customer keeps them as project assets.
• Backups: residual copies in backups are kept apart from ordinary processing and expire within 90 days. If a backup is restored, the Processor re-applies the deletions made since it was taken.

Data that the law requires the Processor to keep is limited to what is required, protected and deleted when the duty ends. The Processor instructs the relevant subprocessors accordingly and, on request, confirms completion of the deletion or explains a legally required exception. Billing records that Lynx keeps as controller under its Privacy Notice, such as the credit ledger and invoices, do not permit any retention of project content.

9. Accountability and audits

The Processor makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Customer or an independent auditor it mandates. Routine audits start with documentary evidence and are followed by a proportionate inspection where needed. They are arranged with reasonable notice and under confidentiality, with protection for security and for other customers' data. These arrangements must not prevent an effective audit, an urgent investigation or access by a supervisory authority. Audits are not limited to one per year where a breach, a material compliance concern or an authority requires further review.

The Processor keeps the required records of processing and security and provides reasonable evidence of compliance by its subprocessors and of its transfer safeguards. Audit costs may be shared reasonably, but the Processor bears the reasonable costs of remedying its own material non-compliance.

10. Liability, term and law

This DPA remains in force as long as the Processor processes Customer Personal Data, including permitted residual retention. The liability provisions of the service contract apply only as far as the law allows and do not limit the statutory rights of individuals, the parties' mandatory responsibility or binding transfer instruments. Each party mitigates its losses and cooperates in good faith. The Swiss law and Zurich courts provisions of the service contract apply, subject to those mandatory protections and to the governing law and jurisdiction terms of any controlling transfer instrument.

Schedule 1: Description of the processing

Subject matter: generation and editing of business websites, asset management, optional AI image and scroll-video generation, managed publishing and hosting, and exports and integrations directed by the Customer.

Duration and frequency: for as long as the Service is provided and the Customer gives instructions, plus the periods in Section 8. Data is sent to an AI provider each time the Customer uses the corresponding feature.

Nature of the processing: collection on instructions, transmission, storage, retrieval, formatting, AI inference, image-to-video transformation, creation of keyframes and intermediate frames, automated safety checks needed to deliver a feature, AI-origin marking, preview, publication, export, support, backup and deletion.

Purposes: carrying out the website and generation workflows the Customer requests and operating the hosting and functions it selects. No AI model training and no advertising use.

Categories of data subjects: the Customer's staff and authorised users, to the extent their data is included in content or instructions; the Customer's clients, contacts and suppliers; identifiable people in uploaded text, photographs and videos; and visitors, enquirers and correspondents of a managed customer site where its enabled functions collect or log their data.

Types of personal data: names, professional contact and role information; text, photographs, videos and other project content; prompts and generated assets; website form fields chosen by the Customer and the submissions received through them; IP address, request, device and time-stamp data for managed hosting; job records, content references and hashes, and provenance records; and the authorisations needed for exports and integrations the Customer instructs. Raw secrets must not be included in AI prompts or public exports.

Special categories and criminal data: not intended or authorised in the standard self-service Service. Any exception requires a separate written agreement covering scope, legal basis, provider clearance and additional safeguards before submission. If such data is nevertheless received, each party's legal duties still apply.

Customer's obligations and rights: to determine lawful purposes and instructions; to provide notices and obtain permissions; to choose the functions it uses; and to receive assistance and information, object to subprocessor changes, audit, and have data returned or deleted under this DPA. The Customer's particulars, and those of any controller it acts for, are recorded in its account's business details and in the acceptance record of this DPA.

Approved subprocessors: Schedule 3.

Schedule 2: Technical and organisational measures

Access control and tenant separation

• Individual named accounts for every Lynx staff member and administrator; no shared logins.
• Least-privilege access: production systems, the database and provider dashboards are accessible only to the Lynx staff who operate the Service.
• Multi-factor authentication on all administrative accounts for infrastructure and providers (Hetzner, Cloudflare, OpenRouter, fal, Modal, AWS, Stripe, GitHub) and on Emorise Login administrator accounts.
• Access rights are granted and removed when a person joins, changes role or leaves, and reviewed every quarter.
• Every request to projects, sites, storage, credits and generation jobs is checked against the Customer's organisation in the application, so one Customer cannot reach another's data.
• Customer secrets and provider credentials are stored separately from generated code and are never placed in AI prompts. Access tokens for connected GitHub accounts and plugin secrets are stored encrypted in the database.

Transmission and storage

• All external connections use TLS (HTTPS), including connections to every AI provider.
• Object storage (Cloudflare R2), including database backups, is encrypted at rest by the provider. Server file backups are encrypted by the backup software before they leave the server.
• Unpublished uploads (brand photographs and logos, scroll-video keyframes, uploaded videos and design uploads) are kept in private storage without a public address and are read only through signed links valid for about 15 minutes or through the authenticated application. Only assets used by a published or exported site are publicly accessible.

Operational security

• Security updates applied promptly; dependencies reviewed for known vulnerabilities.
• Separate staging and production environments with separate databases and storage.
• Production changes are reviewed and deployed through a controlled release process.
• Security and access logs are restricted to operations staff and kept for at most 90 days, longer only for a specific incident under investigation.
• Rate limits, credit limits and abuse controls on AI functions; bot protection on site forms.
• Incident triage by named, reachable staff, with the 48-hour notification in Section 7.

Generation controls

• AI text requests go only through OpenRouter to the allowlisted Amazon Bedrock and Google Vertex AI endpoints for Claude 5.5, restricted to zero data retention with data collection denied; any fallback stays within that allowlist. The provider that served each request is recorded.
• AI image requests to fal send only the text prompt, with payload storage switched off and fal's output copy deleted after one hour.
• Scroll videos run in isolated, short-lived GPU containers at Modal; inputs are deleted within 30 days (Section 8).
• Only the context needed for a feature is sent; secrets are removed from logs; there are no undisclosed providers or fallbacks.
• AI Output is marked (C2PA Content Credentials and IPTC metadata on AI images, the ai-disclosure page tag and disclosure file on sites and exports, a visible label on scroll videos), and the marking is carried through every derived image size and export.

Resilience and deletion

• The production database is backed up every 4 hours to Cloudflare R2; backups are kept for at most 90 days.
• A restore is tested every quarter.
• Recovery objectives: data loss of at most 4 hours (recovery point), and restoration of the Service within 24 hours of a server loss (recovery time).
• Deletion and backup expiry follow Section 8 and a documented internal deletion procedure; obsolete copies are deleted.

Governance

• Confidentiality obligations and security instructions for all staff with access.
• Due diligence and a written data processing agreement for every subprocessor; review of each new purpose, provider or country before use.
• Review of the effectiveness of these measures at least once a year and after any significant incident.
• Documented procedures for data subject requests, breach handling and deletion.

Schedule 3: Approved subprocessors

The provider register, in its current version, is Schedule 3. Only the entries listed there as approved subprocessors are authorised under Section 4. The register names each entity, its function, the data it receives, its processing and remote-access countries, its retention, its contract and its transfer safeguard, and separates services the Customer chooses itself and independent controllers.