Data Processing Addendum
1. Parties, roles and precedence
This Addendum is between Salt & Gorse Ltd, company 15581747, registered at Bosnoweth, Higher Argal, Budock Water, Cornwall TR11 5PE, trading as Storybrdr ("we", the processor) and you, the customer (the controller). It forms part of the Terms of Service. Where this Addendum and the Terms conflict on data protection, this Addendum wins.
2. What this covers
| Subject matter | Hosting and processing creative production material uploaded to Storybrdr. |
| Duration | For as long as you have an account, plus the deletion periods in clause 9. |
| Nature and purpose | Storage, display, thumbnail and rendition generation, export to PDF, CSV and PPTX, sharing via links you create, descriptive tagging and script breakdown for your use, backup. |
| Types of personal data | Images and audio that may depict or record identifiable individuals; names and email addresses of guests who comment or approve; free-text notes that may name people; script text that may name cast, crew and characters. |
| Categories of data subject | Your own staff and collaborators; guests you invite to review boards; third parties appearing in uploaded reference photography (actors, models, crew, members of the public); people named in scripts and production notes. |
3. Documented instructions
We process your content only on your documented instructions, which comprise the Terms, this Addendum and your use of the product's features. If we believe an instruction breaches data protection law, we will tell you.
The safety check described in the Privacy Policy is not carried out on your instructions. We carry it out as controller in our own right, for the purpose of preventing unlawful material being hosted, and it applies to all uploads. You acknowledge this and it is not a breach of this clause.
4. Confidentiality
Everyone with access to your content is under a binding duty of confidence. Today that is one person, the founder, and every support access to customer content is logged.
5. Security
We protect your content with measures appropriate to the risk, including: encryption in transit and at rest; hashed passwords; workspace-scoped access checks on every query; deny-by-default visibility for anything shared with clients; support access only through time-limited, customer-granted, logged access; and daily automated deletion routines that honour the retention periods in clause 9.
6. Sub-processors
You give general written authorisation for the sub-processors listed in the Privacy Policy: Vercel, Neon, Cloudflare, Stripe, Resend, Sentry and Anthropic. Each is bound by terms no less protective than this Addendum. We will email account holders at least 30 days before adding or replacing a sub-processor. You may object; if we cannot resolve your objection, you may terminate and we will refund the unused part of what you have paid.
7. Helping with data subject rights
We will pass on to you any request we receive that relates to your content, and will assist you with access, correction, deletion and portability requests, taking into account the nature of the processing. Assistance is manual today and delivered within one month.
8. Breach notification and assessments
We will notify you of a personal data breach affecting your content without undue delay, and in any event within 48 hours of becoming aware of it, so you have time inside your own 72-hour clock. We will assist you, as far as the nature of the processing allows, with your own security obligations, impact assessments and consultations under Articles 32 to 36.
9. Deletion and return
You can export boards and shot lists at any time, including after your subscription lapses. Content you delete is recoverable for 30 days and then permanently deleted, including its files. When your account closes, we delete the account and its content within one month, keeping only what the law requires us to keep. Our database keeps a rolling seven-day history, so the last copy of deleted data ages out within seven days of its deletion.
10. Audit and information
We will make available the information reasonably needed to demonstrate compliance with Article 28, and will answer one written questionnaire per year. Where you have substantiated a breach of this Addendum, you may audit, at your cost, on reasonable notice and without access to other customers' data.
11. International transfers
Anthropic (US) receives images and pasted scripts as described in the Privacy Policy; Vercel and Resend (US/EU) run the application and its email. You authorise these transfers. The UK Addendum to the standard contractual clauses applies to each. Our transfer risk assessment is available on request at support@storybrdr.com.
12. Liability
The liability provisions in section 11 of the Terms apply to this Addendum. Nothing in this clause limits anyone's rights under data protection law itself.