Data processing agreement

This is an English translation provided for convenience. In case of any discrepancy, the French version prevails.

BRIXEL processes for the customer, as a processor (Article 28 GDPR), the personal data contained in its media, its voices and its posts. This agreement is annexed to the terms of use.

1. Purpose

This agreement sets out the conditions under which BRIXEL (the “processor”) processes, on behalf of the customer (the “controller”), the personal data contained in the content the customer entrusts to the Service. This processing is described in Annex 1. The data of the customer’s own account (identity, sign-in, billing) is governed by the privacy policy, BRIXEL then being its data controller.

2. Instructions

BRIXEL processes this data only on the customer’s documented instructions: the terms of use, this agreement and the customer’s actions in the Service (uploading, having media analyzed, generating, cloning a voice, publishing, deleting). BRIXEL informs the customer without delay if an instruction seems to it to infringe the regulations. The data is never used to train AI models, nor for any purpose other than providing the Service.

3. Confidentiality

Only authorized BRIXEL personnel, bound by confidentiality, access the data, and only to provide the Service, assist the customer or diagnose an incident. This access is logged.

4. Security

BRIXEL implements the technical and organizational measures described in Annex 2, and adapts them to the state of the art.

5. Sub-processors

The customer authorizes BRIXEL to use the sub-processors listed in Annex 3. BRIXEL informs the customer of any addition or replacement at least 30 days in advance, by email or in the app; the customer may object on legitimate grounds and, failing agreement, terminate without charge. BRIXEL imposes on each sub-processor data protection obligations equivalent to those of this agreement and remains liable to the customer for their compliance.

6. Transfers outside the Union

A transfer takes place only to a country covered by an adequacy decision, or with appropriate safeguards: the European Commission’s standard contractual clauses, or the recipient’s Data Privacy Framework certification. Annex 3 states, for each sub-processor, the country and the safeguard.

7. Assistance

The Service lets the customer answer people’s requests itself: deleting a media file, a post or a voice, exporting its data. Beyond that, BRIXEL helps the customer, to a reasonable extent, to respond to requests to exercise rights, to carry out its impact assessments and to consult the supervisory authority. BRIXEL forwards to the customer any request received directly from a data subject.

8. Data breaches

BRIXEL notifies the customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences and the measures taken or proposed.

9. End of processing

At the end of the contract, the customer can export its data. BRIXEL then deletes the customer’s data within 30 days, except data that a legal obligation requires to be kept, for the duration of that obligation.

10. Audit

BRIXEL makes available to the customer the information needed to demonstrate compliance with this agreement. The customer may have an audit carried out once a year, at its own expense, by an independent auditor bound by confidentiality, with 30 days’ notice and without access to other customers’ data.

11. The customer’s obligations

The customer has a legal basis for every piece of data it entrusts to the Service. It informs the people concerned, obtains the image rights releases and the written consent of the people whose voice it clones, and discloses the deepfakes it publishes. It entrusts no sensitive data within the meaning of Article 9 GDPR to the Service unless necessary.

12. Term and governing law

This agreement applies for as long as BRIXEL processes data for the customer. The limitation of liability, the governing law and the competent jurisdiction are those of the terms of use.

Annex 1 — Description of the processing

Annex 2 — Security measures

• Encryption of all communications (HTTPS/TLS, HSTS).
• Social network access tokens encrypted at rest, never exposed to the browser; passwords hashed (Argon2).
• Media in private storage, accessible only through temporary signed links; a link given to a platform expires after one hour.
• Data partitioned by account, checked on every request; administrator access limited and logged.
• Database backups every 6 hours, encrypted, copied to Frankfurt with versioning and a write-only key; restoration tested.
• Administration interfaces closed to the public; requests to internal addresses blocked; SVG files served without script execution; rate limiting on sensitive endpoints.
• Minimization: no voiceprint kept; the raw recording made for a cloning is erased as soon as the voice is ready.
• Transparency: every rendered image and video carries an AI marking in its metadata.

Annex 3 — Sub-processors

The social networks on which the customer publishes receive its content on its instructions, as separate data controllers: they are not sub-processors.