Data Processing Agreement (DPA)

Last Updated: 2025-09-30

1. Introduction and Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer," "Data Controller," or "you") and Auctori ("Processor," "we," or "us") and governs the processing of Personal Data in connection with the Service.

This DPA applies when:

You use Auctori to process Personal Data
You are subject to GDPR, UK GDPR, or other data protection laws
The relationship involves data controller-to-processor obligations

Effective Date: The date you first use the Service or sign up for an account

Legal Framework: This DPA is designed to meet requirements under:

EU General Data Protection Regulation (GDPR)
UK GDPR
Swiss Federal Act on Data Protection (FADP)
Other applicable data protection laws

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws.

Data Protection Laws: All applicable laws and regulations relating to the processing of Personal Data, including GDPR, UK GDPR, CCPA, and other relevant legislation.

Processing: Any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

Data Subject: An identified or identifiable natural person whose Personal Data is processed.

Controller: The entity that determines the purposes and means of processing Personal Data (you, the Customer).

Processor: The entity that processes Personal Data on behalf of the Controller (Auctori).

Sub-processor: A third-party processor engaged by Auctori to process Personal Data.

Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

3. Roles and Responsibilities

3.1 Controller Responsibilities (Customer)

As the Data Controller, you:

Determine the purposes and means of processing Personal Data
Ensure you have a lawful basis for processing under Data Protection Laws
Obtain necessary consents from Data Subjects
Respond to Data Subject requests regarding their Personal Data
Ensure instructions to us comply with Data Protection Laws
Maintain records of processing activities as required by law

3.2 Processor Responsibilities (Auctori)

As the Data Processor, we:

Process Personal Data only on your documented instructions
Ensure persons authorized to process Personal Data are bound by confidentiality
Implement appropriate technical and organizational measures
Assist you in responding to Data Subject requests
Assist you in ensuring compliance with security obligations
Delete or return Personal Data upon termination
Make available information necessary to demonstrate compliance
Allow for and contribute to audits and inspections

3.3 Joint Understanding

Both parties acknowledge that:

You are the Controller of Personal Data you input into the Service
We are the Processor acting on your behalf
Our Privacy Policy governs our role as Controller for account and usage data
This DPA governs our role as Processor for your content data

4. Nature and Purpose of Processing

4.1 Subject Matter

Processing of Personal Data necessary to provide the Auctori Service as described in the Terms of Service.

4.2 Duration

Processing occurs for the duration of the Service agreement and as necessary for retention obligations.

4.3 Nature of Processing

Operations include:

Storage and hosting of Personal Data
Retrieval and display to authorized users
Generation and export of EPUB files
Backup and disaster recovery
Security and access control

4.4 Purpose of Processing

Provide book creation and management features
Enable storyboard and planning tools
Generate EPUB exports for KDP publishing
Maintain series continuity and context
Facilitate template-based content creation

4.5 Categories of Data Subjects

Authors and writers using the Service
Individuals mentioned in book content (characters, if based on real persons)
Other individuals whose Personal Data you input into the Service

4.6 Types of Personal Data Processed

Customer Account Data (we are Controller):

Email address, name, profile picture
Google OAuth identifier
Subscription and billing information
Usage logs and analytics

Customer Content Data (we are Processor):

Manuscript content and book text
Character names and descriptions
Plot outlines and story notes
Any Personal Data you include in your content
Metadata and context bundles

Note: We process account data as Controller under our Privacy Policy and content data as Processor under this DPA.

5. Customer Instructions

5.1 Instructions

We will process Personal Data only in accordance with your documented instructions, which include:

Terms of Service: The Service agreement constitutes instructions to process data as necessary to provide the Service
Service Usage: Your use of Service features (create, edit, export) constitutes instructions
API Calls: Programmatic interactions with our API
Written Instructions: Additional written instructions you provide to us
Settings and Preferences: Configuration choices you make in the Service

5.2 Instruction Compliance

We will immediately inform you if we believe an instruction violates Data Protection Laws
We will not process Personal Data in any manner inconsistent with your instructions
If we cannot comply with an instruction, we will inform you and may suspend processing

5.3 Changes to Instructions

You may change instructions by updating Service settings or contacting us
Material changes may require written confirmation
We will implement reasonable instruction changes within a reasonable timeframe

6. Security Measures

6.1 Technical and Organizational Measures

We implement appropriate security measures to protect Personal Data:

Encryption:

TLS/HTTPS for data in transit
Optional end-to-end encryption using libsodium and git-crypt
Bcrypt password hashing
Per-user Data Encryption Keys (DEKs) wrapped with Key Encryption Key (KEK)

Access Control:

Row-Level Security (RLS) policies in PostgreSQL
Role-based access control (RBAC)
Session management with secure cookies
Two-factor authentication (TOTP) for sensitive operations
Audit logging of security-relevant events

Infrastructure Security:

Secure server hosting with Hetzner
Regular security patches and updates
Firewall and network segmentation
DDoS protection
Intrusion detection

Application Security:

Helmet.js security headers
CORS policies and origin validation
CSRF protection
Input validation and sanitization
SQL injection prevention via Prisma ORM
XSS protection

Organizational Security:

Employee confidentiality obligations
Background checks for personnel with data access
Security awareness training
Incident response procedures
Regular security audits

6.2 Security Standards

We maintain security practices aligned with:

ISO 27001 principles
OWASP security guidelines
Industry best practices for web application security

6.3 Security Updates

We regularly review and update security measures to:

Address emerging threats
Incorporate new security technologies
Comply with evolving regulations
Respond to security assessments

6.4 Security Documentation

Upon request, we will provide:

High-level description of security measures
Relevant security certifications (if any)
SOC 2 reports (if available)
Security questionnaire responses

7. Sub-processors

7.1 Authorized Sub-processors

You authorize us to engage the following sub-processors:

| Sub-processor | Service | Data Processed | Location | |---------------|---------|----------------|----------| | Google LLC | OAuth Authentication | Email, name, profile picture, Google ID | United States | | Stripe, Inc. | Payment Processing | Email, billing info, transaction data | United States | | Hetzner Online GmbH | Infrastructure Hosting | All Service data | Germany | | Amazon Web Services (AWS) | Optional Asset Storage (S3-compatible) | Uploaded files if S3 enabled | Configurable |

7.2 Sub-processor Obligations

We ensure that sub-processors:

Are bound by written agreements with data protection obligations no less protective than this DPA
Implement appropriate technical and organizational measures
Comply with Data Protection Laws
Allow for audits and inspections

7.3 Sub-processor Changes

Notice of New Sub-processors:

We will provide at least 30 days' notice before adding or replacing sub-processors
Notice will be provided via email or Service notification

Objection Rights:

You may object to a new sub-processor on reasonable grounds related to data protection
Objections must be raised within 30 days of notice
If you object, we will work to find an alternative solution
If no solution can be found, you may terminate the agreement

Current Sub-processor List:

Maintained at: https://auctori.app/legal/subprocessors
Updated as changes occur

7.4 Sub-processor Liability

We remain fully liable to you for the performance of any sub-processor's obligations.

8. Data Subject Rights

8.1 Assistance with Data Subject Requests

We will assist you in responding to Data Subject requests to exercise their rights:

Right to Access: We will provide access to Personal Data we process on your behalf

Right to Rectification: We will correct inaccurate Personal Data upon instruction

Right to Erasure: We will delete Personal Data upon instruction

Right to Restriction: We will restrict processing upon instruction

Right to Data Portability: We will export Personal Data in portable format upon instruction

Right to Object: We will cease processing upon instruction where this right applies

8.2 Request Handling

Requests Received by Us:

If we receive a Data Subject request, we will forward it to you without undue delay
We will not respond directly unless instructed by you

Requests Received by You:

You are responsible for responding to Data Subject requests
We will assist you in fulfilling requests within 30 days of your instruction
We may charge reasonable fees for extensive or repetitive requests

8.3 Tools and Features

We provide tools to facilitate Data Subject rights:

Account settings for data access and correction
Export functionality for data portability
Deletion options in account settings
API endpoints for programmatic data management

9. Data Breaches

9.1 Breach Notification

If we become aware of a Data Breach, we will:

Notify You Without Undue Delay:

Notification within 72 hours of becoming aware
Via email to your registered account email
Include available information about the breach

Provide Breach Information:

Nature of the breach
Categories and approximate number of Data Subjects affected
Categories and approximate number of Personal Data records affected
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact point for more information

Cooperate with Investigation:

Assist in breach investigation
Provide relevant logs and information
Support your notification obligations to Data Subjects and authorities

9.2 Breach Response

We will:

Take immediate steps to contain and mitigate the breach
Preserve evidence for investigation
Implement corrective measures to prevent recurrence
Document the breach and response actions

9.3 Your Obligations

Upon notification, you must:

Assess whether notification to Data Subjects is required
Notify supervisory authorities if required under Data Protection Laws
Cooperate with our breach investigation
Not make public statements about the breach without our consent (except as legally required)

10. Data Transfers

10.1 International Transfers

Personal Data may be transferred to and processed in countries outside the EEA, UK, or Switzerland.

Current Transfer Destinations:

Primary hosting: Germany (Hetzner)
Sub-processors: United States (Google, Stripe, AWS if enabled)

10.2 Transfer Mechanisms

For transfers outside the EEA/UK/Switzerland, we rely on:

Standard Contractual Clauses (SCCs):

We have executed or will execute SCCs approved by the European Commission
Current version: 2021 EU SCCs (Module Two: Controller-to-Processor)
Available upon request

Adequacy Decisions:

Where the European Commission has recognized adequate protection
Currently: No adequacy decision for United States (post-Schrems II)

Supplementary Measures:

Encryption in transit and at rest
Strong access controls and authentication
Regular security assessments
Contractual commitments from sub-processors
Transparency about government access requests

10.3 UK and Swiss Transfers

UK Addendum:

We adopt the International Data Transfer Addendum to the EU SCCs (UK Addendum)
Issued by the UK Information Commissioner's Office

Swiss Law:

Transfers comply with Swiss Federal Act on Data Protection
SCCs adapted for Swiss law requirements where necessary

10.4 Customer Responsibilities

If you are established in the EEA, UK, or Switzerland:

You acknowledge and agree to the international transfers described
You ensure your instructions do not conflict with Data Protection Laws
You have informed Data Subjects of the transfers

11. Audits and Compliance

11.1 Audit Rights

You have the right to:

Request information demonstrating our compliance with this DPA
Conduct audits and inspections of our processing activities

11.2 Audit Process

Documentation Requests:

We will provide compliance documentation upon reasonable request
Including security policies, certifications, and attestations

Inspections:

You may inspect our facilities and systems with 30 days' advance notice
Inspections must be conducted during business hours
Must not disrupt our operations or other customers
Subject to confidentiality obligations

Third-Party Audits:

You may appoint an independent third-party auditor
Auditor must be mutually agreed upon
Must sign confidentiality agreement
Audit reports shared with both parties

11.3 Audit Costs

You bear the costs of audits and inspections
Limited to one audit per 12-month period (unless required by Data Protection Laws or following a Data Breach)

11.4 Certifications

We may obtain third-party security certifications:

SOC 2 Type II (if available)
ISO 27001 (if available)
Certificates provided upon request in lieu of inspection

12. Data Deletion and Return

12.1 Upon Termination

At the end of the Service agreement:

Your Choice:

Export your data using Service tools before termination
Request return of all Personal Data in portable format
Request deletion of all Personal Data

Our Actions:

Delete or return Personal Data within 30 days of termination
Provide certification of deletion upon request
Exception: Data we are required to retain for legal compliance

12.2 Deletion Process

Data in Production Systems:

Immediate removal from active databases
Overwrite data where technically feasible

Data in Backups:

Backups containing Personal Data will be deleted according to retention schedules (up to 90 days)
Cannot selectively delete from encrypted backups without affecting other customers

Data at Sub-processors:

Issue deletion instructions to sub-processors
Obtain confirmation of deletion

12.3 Legal Retention

We may retain Personal Data if:

Required by law or regulation (e.g., tax records, audit logs)
Necessary to defend legal claims
Subject to legal hold or preservation order

Retained data will:

Be limited to what is legally required
Remain protected by security measures
Be deleted once retention period expires

13. Liability and Indemnification

13.1 Processor Liability

Under GDPR Article 82:

We are liable for damages caused by processing that violates GDPR
We are not liable if we prove we are not responsible for the event giving rise to damage
Our liability is limited as specified in the Terms of Service

13.2 Limitation of Liability

To the maximum extent permitted by law:

Our liability under this DPA is subject to the limitations in the Terms of Service
Excludes indirect, incidental, consequential, or punitive damages
Total liability capped at amounts paid in the last 12 months

13.3 Indemnification

Our Indemnification:

We indemnify you against claims arising from our breach of this DPA
Subject to: (1) prompt notice, (2) sole control of defense, (3) reasonable cooperation

Your Indemnification:

You indemnify us against claims arising from your instructions that violate Data Protection Laws
Subject to: (1) prompt notice, (2) sole control of defense, (3) reasonable cooperation

14. Term and Termination

14.1 Term

This DPA takes effect when you first use the Service and continues until:

You delete your account
We terminate the Service agreement
By mutual written agreement

14.2 Termination for Cause

Either party may terminate this DPA if:

The other party materially breaches this DPA
Breach remains uncured for 30 days after written notice
Required by Data Protection Laws or supervisory authority

14.3 Effect of Termination

Upon termination:

Processing of Personal Data ceases
Data deletion or return provisions apply (Section 12)
Provisions that should survive termination remain in effect
Confidentiality obligations continue

14.4 Survival

The following provisions survive termination:

Confidentiality (Section 15)
Liability and Indemnification (Section 13)
Data Deletion and Return (Section 12)
Governing Law (Section 16)

15. Confidentiality

15.1 Confidential Information

Both parties agree to:

Keep Personal Data confidential
Use Personal Data only as permitted by this DPA
Not disclose Personal Data except to authorized personnel and sub-processors

15.2 Personnel

We ensure that personnel authorized to process Personal Data:

Are bound by confidentiality obligations
Receive appropriate training on Data Protection Laws
Have access only to data necessary for their role

15.3 Exceptions

Confidentiality obligations do not apply to information that:

Is publicly available through no fault of the recipient
Is required to be disclosed by law or court order
Is independently developed without use of confidential information

15.4 Legal Disclosure

If required to disclose Personal Data by law:

We will notify you in advance where legally permitted
We will limit disclosure to what is legally required
We will object to disclosure on your behalf if requested

16. Governing Law and Dispute Resolution

16.1 Governing Law

This DPA is governed by:

For EEA customers: Laws of Ireland (or your choice of EEA member state)
For UK customers: Laws of England and Wales
For Swiss customers: Laws of Switzerland
For other customers: As specified in Terms of Service

16.2 Dispute Resolution

Supervisory Authority Cooperation:

We will cooperate with competent supervisory authorities
We will comply with supervisory authority decisions

Disputes Between Parties:

Disputes will be resolved according to the dispute resolution provisions in the Terms of Service
Courts of the governing law jurisdiction have exclusive jurisdiction

16.3 Supervisory Authority

EEA Lead Supervisory Authority:

Determined based on our establishment location
Not applicable

UK Supervisory Authority:

Information Commissioner's Office (ICO)

Swiss Supervisory Authority:

Federal Data Protection and Information Commissioner (FDPIC)

17. General Provisions

17.1 Precedence

In case of conflict between this DPA and:

17.2 Amendments

This DPA may be amended to comply with Data Protection Laws
Material changes will be notified via email or Service notification
Continued use constitutes acceptance unless you object
If you object, you may terminate as specified in Section 14.2

17.3 Severability

If any provision is found invalid or unenforceable:

Remaining provisions remain in full force
Invalid provision replaced with valid provision achieving similar economic effect

17.4 Entire Agreement

This DPA, together with the Terms of Service and Privacy Policy, constitutes the entire agreement on data processing.

17.5 Assignment

You may not assign this DPA without our written consent
We may assign this DPA to successors or affiliates with notice

17.6 Waiver

Failure to enforce any provision does not waive our right to enforce it later.

17.7 Language

This DPA is executed in English. Translations may be provided for convenience, but the English version prevails.

18. Contact Information

For DPA-related inquiries:

Data Protection Officer (if applicable):
Email: Not applicable
Address: Not applicable

General Contact:
Email: [email protected]
Address: 155 Willowbrook Boulevard, #5024, Wayne, New Jersey 07470

EU Representative (if required under Art. 27 GDPR):
Not applicable

UK Representative (if required under UK GDPR):
Not applicable

19. Acknowledgment and Agreement

By using the Service, you acknowledge that:

You have read and understood this DPA
You agree to be bound by its terms
You have authority to enter into this DPA on behalf of your organization (if applicable)
You understand your responsibilities as Data Controller
You understand our role as Data Processor

Customer (Data Controller):
[Accepted by use of Service]

Auctori (Data Processor):
Meh Games Inc.
Date: 2025-09-30

Annex I: Details of Processing

A. List of Parties

Data Controller:

Name: Customer (individual or organization using the Service)
Address: As provided in account information
Contact: Account email address

Data Processor:

Name: Auctori / Meh Games Inc.
Address: 155 Willowbrook Boulevard, #5024, Wayne, New Jersey 07470
Contact: [email protected]

B. Description of Transfer

See Section 4 of this DPA (Nature and Purpose of Processing)

C. Competent Supervisory Authority

Determined by the Data Controller's establishment location under GDPR Article 56

Annex II: Technical and Organizational Measures

See Section 6 of this DPA (Security Measures)

Detailed technical specifications available upon request under Section 11 (Audits and Compliance).

Annex III: List of Sub-processors

See Section 7.1 of this DPA (Authorized Sub-processors)

Updated list maintained at: https://auctori.app/legal/subprocessors