← Legal Center

Data Processing Addendum

A framework for how Creafl processes personal data on behalf of business customers.

Last updated September 28, 2026

On this page
  1. 1. Status of this document
  2. 2. Scope
  3. 3. Definitions
  4. 4. Roles of the Parties
  5. 5. Processing Instructions
  6. 6. Confidentiality
  7. 7. Security
  8. 8. Subprocessors
  9. 9. Data Subject Requests
  10. 10. Security Incidents
  11. 11. Deletion and Return
  12. 12. International Transfers
  13. 13. Audits and Information
  14. 14. Liability
  15. 15. Duration
  16. 16. Appendix: Processing details
  17. 17. Contact

1. Status of this document

To be finalized before launch. This Addendum is a framework and requires final legal review before it is relied upon contractually.

2. Scope

This Addendum applies where Creafl processes personal data on behalf of a creator or business customer as part of the Service.

3. Definitions

Terms such as “personal data”, “processing”, “controller” and “processor” have the meanings given in applicable data-protection law.

4. Roles of the Parties

In many cases the creator decides how their audience and customer data is used, and Creafl processes it on their behalf. In other cases — such as account data and platform security — Creafl may act independently.

To be finalized before launch. Confirm the roles for each data flow.

5. Processing Instructions

Creafl processes customer personal data according to the customer's documented instructions, including those given through the Service settings.

6. Confidentiality

People authorised to process personal data are subject to confidentiality obligations.

7. Security

Creafl uses technical and organisational measures designed to protect personal data.

To be finalized before launch. Security measures annex.

8. Subprocessors

Creafl may use subprocessors to provide the Service. See our Subprocessors page.

9. Data Subject Requests

Creafl will provide reasonable help to customers responding to requests from individuals exercising their rights.

10. Security Incidents

Creafl will notify affected customers of a personal-data breach without undue delay.

To be finalized before launch. Notification timeframe.

11. Deletion and Return

At the end of the Service, Creafl will delete or return customer personal data, subject to legal retention requirements.

To be finalized before launch. Deletion timeframe.

12. International Transfers

To be finalized before launch. Transfer mechanisms used.

13. Audits and Information

Creafl will make available information reasonably necessary to demonstrate compliance with this Addendum.

To be finalized before launch. Audit process.

14. Liability

To be finalized before launch. Liability terms, subject to legal review.

15. Duration

This Addendum lasts for as long as Creafl processes customer personal data.

16. Appendix: Processing details

Subject matter: provision of the Creafl Service. Duration: the term of the customer's use of Creafl. Nature: hosting, storage, communication, analytics and related processing. Purpose: to provide the Service to the customer.

Categories of data subjects: the customer's website visitors, subscribers, leads and buyers, and social-platform users who interact with the customer.

Categories of personal data: identifiers and contact details (such as name, email, social handle), order information, messages and engagement data.

To be finalized before launch. Special categories of personal data, where applicable.

17. Contact

Questions about this Addendum can be sent to hello@creafl.com. You can also visit our Contact page.

Questions?

We're happy to help with anything in this document.

hello@creafl.com