MediaCreatorsMEDIACREATORS

Data Processing Agreement

Last Updated: September 18, 2026
Effective Date: September 21, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between MediaCreators, LLC ("MediaCreators," "we," "us," or "Processor") and the customer agreeing to these terms ("Customer," "you," or "Controller") for the provision of creator analytics, streaming community, and related SaaS services (the "Services").

This DPA applies where MediaCreators processes Personal Data on behalf of Customer in the course of providing the Services, and sets out the parties' obligations with respect to data protection.

This DPA applies automatically when Customer accepts the Terms of Service, signs an order form, or uses Services involving the processing of Personal Data. It does not require a separate signature.

1. Definitions

"Data Protection Laws" means all applicable laws relating to data protection and privacy, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018 and UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), Chile's Ley 19.628 on the Protection of Private Life and its reform by Ley 21.719 (effective December 1, 2026), and any other applicable data protection legislation.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by MediaCreators on behalf of Customer in connection with the Services.

"Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or erasure.

"Security Incident" means any unauthorized access to, or acquisition, use, or disclosure of Personal Data that compromises the security, confidentiality, or integrity of such data.

"Subprocessor" means any third party engaged by MediaCreators to process Personal Data on behalf of Customer.

2. Scope and Applicability

2.1 Scope of Processing

This DPA applies to the processing of Personal Data by MediaCreators on behalf of Customer as described in Annex 1 (Details of Processing).

2.2 Customer as Controller

For purposes of this DPA, Customer is the data controller with respect to Customer Personal Data, and MediaCreators is the data processor.

2.3 Compliance with Laws

Each party shall comply with its respective obligations under applicable Data Protection Laws. MediaCreators shall process Personal Data only in accordance with Customer's documented instructions and this DPA.

3. Processing of Personal Data

3.1 Customer Instructions

MediaCreators shall process Personal Data only on documented instructions from Customer, including with respect to transfers of Personal Data to a third country or international organization, unless required to do so by applicable law. In such case, MediaCreators shall inform Customer of that legal requirement before processing, unless prohibited by law.

3.2 Purpose Limitation

MediaCreators shall process Personal Data solely for the purposes of providing the Services as described in the Terms of Service and this DPA, and shall not process Personal Data for any other purpose without Customer's prior written consent.

3.3 Data Minimization

MediaCreators shall ensure that Personal Data processed is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

4. Confidentiality and Personnel

4.1 Confidentiality Obligations

MediaCreators shall ensure that any person authorized to process Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

4.2 Personnel Training

MediaCreators shall ensure that personnel processing Personal Data:

  • Are informed of the confidential nature of the Personal Data;
  • Have received appropriate training on their responsibilities; and
  • Are bound by appropriate confidentiality obligations.

4.3 Access Limitations

MediaCreators shall limit access to Personal Data to those personnel who require such access to perform obligations under this DPA.

5. Security Measures

5.1 Technical and Organizational Measures

MediaCreators shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures include:

a) Encryption:

  • All data in transit encrypted using TLS 1.2 or higher
  • Data at rest encrypted using AES-256 encryption
  • Database connections encrypted via PlanetScale Postgres secure transport

b) Access Controls:

  • Role-based access control (RBAC) for all systems
  • Multi-factor authentication (MFA) for all administrative access (via Better Auth)
  • Tenant-level data isolation at the database layer
  • Regular access reviews and audit logging
  • Principle of least privilege enforced across all services

c) Application Security:

  • Cloudflare WAF (Web Application Firewall) protecting all public endpoints
  • Bot detection and mitigation via Cloudflare Turnstile
  • OWASP Top 10 as baseline security reference for development
  • Secrets managed via platform-level encrypted secret stores (Cloudflare Workers secrets, Railway environment variables) — never stored in source code

d) Infrastructure Security:

  • Application deployed on Cloudflare Workers (edge compute) and Railway (container hosting)
  • DDoS protection and global anycast network via Cloudflare
  • Logical tenant separation enforced at application and database layers

e) Physical Security:

  • Data hosted with infrastructure providers (Cloudflare, PlanetScale, Railway) that maintain SOC 2 Type II and/or ISO 27001 certifications
  • Physical access controls and continuous monitoring by those providers

f) Business Continuity:

  • Automated database backups with point-in-time recovery (PlanetScale)
  • Disaster recovery procedures
  • Incident response plan with defined escalation paths

Note: MediaCreators does not currently hold SOC 2 Type II or ISO 27001 certifications. The measures above describe our actual implemented controls.

Customer acknowledges that security is a shared responsibility. Customer is responsible for protecting credentials, API keys, and systems under Customer's control, configuring the Services and permissions appropriately, and notifying MediaCreators of suspected compromise. The Services cannot eliminate every risk.

5.2 Security Assessment

Upon Customer's written request (not more than once per year), MediaCreators shall provide Customer with documentation demonstrating MediaCreators's compliance with its security obligations under this DPA.

6. Subprocessors

6.1 Authorization

Customer provides general authorization for MediaCreators to engage Subprocessors to process Personal Data. The current list of Subprocessors is set forth in Annex 2 and available at /legal/subprocessors.

6.2 Subprocessor Requirements

Before engaging any Subprocessor, MediaCreators shall:

  • Conduct appropriate due diligence to ensure the Subprocessor can provide the required level of protection;
  • Enter into a written agreement with the Subprocessor imposing data protection obligations no less protective than those in this DPA; and
  • Remain fully liable to Customer for the Subprocessor's performance.

6.3 Notification of Changes

MediaCreators shall notify Customer at least thirty (30) days before authorizing any new Subprocessor. Customer may object to the appointment of a new Subprocessor within fourteen (14) days of notification by providing written notice with reasonable grounds for the objection. The parties shall negotiate in good faith to resolve any objection. If no resolution is reached within thirty (30) days of Customer's objection, either party may terminate the affected component of the Services with thirty (30) days' notice, and Customer shall receive a pro-rata refund of any prepaid fees for the terminated component.

7. Data Subject Rights

7.1 Assistance with Requests

MediaCreators shall, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures to fulfill Customer's obligation to respond to requests from data subjects to exercise their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

7.2 Notification

If MediaCreators receives a request from a data subject relating to Customer Personal Data, MediaCreators shall promptly notify Customer and shall not respond to such request without Customer's prior written authorization, unless required by law.

8. Security Incidents

8.1 Notification

MediaCreators shall notify Customer without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a Security Incident affecting Customer Personal Data.

8.2 Incident Details

Such notification shall include:

  • A description of the nature of the Security Incident;
  • The categories and approximate number of data subjects concerned;
  • The categories and approximate number of Personal Data records concerned;
  • The name and contact details of MediaCreators's data protection contact;
  • A description of the likely consequences of the Security Incident; and
  • A description of the measures taken or proposed to address the Security Incident.

8.3 Cooperation

MediaCreators shall cooperate with Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of each Security Incident.

9. Data Protection Impact Assessments

Where required by Data Protection Laws, MediaCreators shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to MediaCreators.

10. International Data Transfers

10.1 Authorized Transfers

Customer authorizes MediaCreators and its Subprocessors to process Personal Data in the United States and other countries where they operate, subject to the safeguards in this DPA.

10.2 Standard Contractual Clauses (EEA)

For transfers from the EEA that require a recognized transfer mechanism under the GDPR, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) ("SCCs") are incorporated by reference as follows:

  • Module Two applies where Customer is a Controller and MediaCreators is a Processor.
  • Module Three applies where Customer is a Processor and MediaCreators is a Subprocessor.
  • The optional docking clause in Clause 7 applies.
  • Option 2 in Clause 9(a) applies, with the notice period in Section 6.3 of this DPA.
  • The optional language in Clause 11 does not apply.
  • The supervisory authority under Clause 13 is determined based on the relevant data exporter and Data Subjects.
  • The governing law for Clause 17 is the law of Ireland.
  • The courts for Clause 18 are the courts of Ireland.
  • Annexes 1 and 2 of this DPA and Schedule 3 complete the relevant annexes to the SCCs.

10.3 UK International Data Transfer Addendum

For transfers subject to the UK GDPR, the SCCs as completed above apply as modified by the then-current mandatory UK International Data Transfer Addendum issued by the UK Information Commissioner, with Customer as exporter and MediaCreators as importer.

10.4 Swiss Transfers

For transfers subject to Swiss data protection law, the SCCs apply with references to the GDPR understood to include the Swiss Federal Act on Data Protection where necessary; the competent authority is the Swiss Federal Data Protection and Information Commissioner.

10.5 Current Safeguards

MediaCreators's primary data processing occurs in the United States. For transfers from the EEA/UK/Switzerland to the US, MediaCreators relies on Standard Contractual Clauses and additional technical safeguards including encryption in transit and at rest.

11. Audits and Inspections

11.1 Audit Rights

MediaCreators shall make available to Customer all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by Customer or a third-party auditor mandated by Customer.

11.2 Audit Procedures

Audits shall be conducted:

  • No more than once per calendar year, unless required by a supervisory authority or following a Security Incident;
  • Upon at least thirty (30) days' prior written notice;
  • During normal business hours with minimal disruption to operations;
  • Subject to confidentiality obligations regarding any proprietary information accessed.

11.3 Audit Reports

In lieu of an on-site audit, Customer may request MediaCreators to provide copies of relevant third-party audit reports (e.g., SOC 2 Type II) and certifications.

12. Government Requests

Unless prohibited by law, MediaCreators shall notify Customer of a legally binding government request for Personal Data and shall direct the requesting authority to Customer where appropriate. MediaCreators shall review requests for legal validity, disclose only information legally required, and challenge requests where there are reasonable grounds to do so.

13. AI and Automated Processing

Customer instructs MediaCreators to process Personal Data as needed to provide AI-assisted features selected by Customer (including Creator Business Score, automated analytics, and content estimates), including transmission to providers identified in Annex 2.

MediaCreators will not use Customer Personal Data to train general-purpose AI or machine learning models. Any AI processing is limited to providing and improving the specific features Customer uses.

MediaCreators will not authorize an AI Subprocessor to use Personal Data to train that Subprocessor's general models except where required by a feature or provider selected by Customer. MediaCreators will use commercially reasonable provider settings intended to limit provider training where available.

MediaCreators does not use automated decision-making that produces legal or similarly significant effects on behalf of Customer unless the relevant Service documentation identifies that functionality. Customer is responsible for human review and for determining whether an automated use is lawful and appropriate.

14. Data Retention and Deletion

14.1 Retention Period

MediaCreators shall retain Personal Data only for as long as necessary to provide the Services and fulfill obligations under this DPA.

14.2 Return or Deletion

Upon termination or expiration of the Services, MediaCreators shall, at Customer's election:

  • Return all Personal Data to Customer in a commonly used format; or
  • Delete all Personal Data and certify such deletion in writing.

14.3 Deletion Timeline

Deletion shall be completed within ninety (90) days of termination, except where retention is required by applicable law. MediaCreators shall inform Customer of any such legal requirement.

14.4 Backup Copies

MediaCreators may retain Personal Data in backup systems for the period necessary to complete normal backup cycles, after which such data shall be deleted in accordance with standard backup deletion procedures.

14.5 Retention During Exception Periods

Personal Data retained under Sections 14.3 or 14.4 shall be:

  • Stored in a restricted-access state with processing limited to the specific legal or operational purpose requiring retention;
  • Subject to all security measures and confidentiality obligations of this DPA;
  • Deleted promptly when the retention purpose no longer applies.

MediaCreators shall inform Customer of the specific categories and estimated duration of any exceptional retention.

15. Liability and Indemnification

15.1 Liability Cap

Each party's liability arising out of or related to this DPA shall be subject to the limitations of liability set forth in the Terms of Service, except as expressly provided otherwise.

15.2 Indemnification

MediaCreators shall indemnify Customer for any damages arising from MediaCreators's breach of this DPA or applicable Data Protection Laws, to the extent such damages are not caused by Customer's instructions or Customer's own breach of Data Protection Laws.

16. Term and Termination

16.1 Term

This DPA shall remain in effect for the duration of the Terms of Service and for as long as MediaCreators processes Personal Data on behalf of Customer.

16.2 Survival

Provisions of this DPA that by their nature should survive termination shall survive, including Sections 4 (Confidentiality), 8 (Security Incidents), 14 (Data Retention and Deletion), and 15 (Liability and Indemnification).

17. Miscellaneous

17.1 Conflicts

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.

17.2 Amendments

This DPA may be amended only by a written agreement signed by both parties, except that MediaCreators may update the Subprocessor list and security measures as necessary to comply with Data Protection Laws or improve security.

17.3 Governing Law

This DPA shall be governed by the same law that governs the Terms of Service.

17.4 Contact Information

For questions about this DPA or to exercise rights hereunder:

  • Email: legal@mediacreators.io
  • Address: MediaCreators, LLC, 2810 N Church St, STE 89584, Wilmington, DE 19802, USA
  • Phone: +1 (740) 990-2600

18. CCPA-Specific Obligations

Where the California Consumer Privacy Act (CCPA/CPRA) applies to the processing of Personal Data, MediaCreators acts as a "service provider" (as defined in the CCPA) with respect to Customer Personal Data and agrees to the following:

18.1 Restrictions on Use

MediaCreators shall not:

  • Sell or share Customer Personal Data;
  • Retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA and the Terms of Service;
  • Retain, use, or disclose Customer Personal Data outside the direct business relationship between MediaCreators and Customer;
  • Combine Customer Personal Data with personal information received from other sources, except as expressly permitted by the CCPA.

18.2 Compliance Certification

MediaCreators certifies that it understands and will comply with the restrictions in Section 18.1. If MediaCreators determines that it can no longer meet its obligations under this Section, it shall promptly notify Customer.

18.3 Right to Take Remedial Action

Upon notification under Section 18.2, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

18.4 Subprocessor Obligations

MediaCreators shall ensure that any Subprocessor engaged to process Customer Personal Data subject to the CCPA is bound by equivalent restrictions as those in Section 18.1.

Annex 1: Details of Processing

Categories of Data Subjects

  • Customer's employees and authorized users
  • Creators and their community members / fans who use the Services
  • Public creator channel identifiers referenced for intelligence and estimate features

Categories of Personal Data

  • Account information (name, email, company)
  • User preferences and settings
  • Usage, analytics, and support communications
  • Payment-related identifiers processed via payment providers
  • Authorized and public YouTube / social channel data as described in the Privacy Policy

Processing Activities

  • Storage and management of user accounts
  • Streaming community, membership, and content delivery operations
  • Analytics and Creator Business Score / estimate features
  • API request handling and authentication
  • Customer support communications

Duration of Processing

Personal Data will be processed for the duration of the Services agreement and deleted within 90 days of termination, except as required by law.

Sensitive Data

MediaCreators does not intentionally collect or process special categories of personal data (health, biometric, genetic, religious, political data) on behalf of Customer.

Annex 2: Subprocessors

Subprocessor Purpose Location
PlanetScale Managed PostgreSQL database USA
Cloudflare CDN, edge delivery, Workers, security Global
Railway Application hosting for backend services USA
Mux Video hosting and streaming USA
Stripe Payment processing USA
PostHog Product analytics and session replay USA / EU
Resend Transactional email delivery USA
Google OAuth Authentication USA
YouTube API Services YouTube account linking and analytics ingestion USA
Cal.com Scheduling / booking USA
Datadog Infrastructure monitoring and observability USA
BetterStack Uptime monitoring and status EU / USA
Google Maps Maps and location display where used USA

For the most current list of Subprocessors, visit: /legal/subprocessors

Schedule 3: SCC Annex Information

Annex I.A — The parties and roles are identified in Annex 1 of this DPA. By entering into the Terms of Service, each party is deemed to sign the SCCs as of the effective date of this DPA.

Annex I.B — The transfer and processing details are described in Annex 1 of this DPA.

Annex I.C — The competent supervisory authority is determined under Clause 13 of the SCCs and Section 10.2 of this DPA.

Annex II — The technical and organizational measures are described in Section 5.1 of this DPA.

Annex III — The authorized Subprocessors are listed in Annex 2 of this DPA and at /legal/subprocessors.

By using the Services, Customer acknowledges and agrees to this Data Processing Agreement.