Data Processing Addendum

Version 2026-10-09

This Data Processing Addendum ("DPA") forms part of the agreement between Craftkite ("Craftkite", "processor") and the customer that accepts it ("Customer", "controller") for the use of Craftkite (the "Service"). It applies when Craftkite processes personal data on the Customer's behalf, under the EU General Data Protection Regulation (GDPR), the UK GDPR, Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and other data protection laws that apply ("Data Protection Law").

1. Roles and scope

1. The Customer is the controller of personal data it, its members or the end users of its published apps put into the Service ("Customer Personal Data"). Craftkite is its processor.
2. Craftkite is a controller for account, billing and security data it needs to run its own business, as described in the Privacy Policy. This DPA does not cover that data.
3. Annex 1 describes the processing.

2. Instructions

Craftkite processes Customer Personal Data only on the Customer's documented instructions: the agreement, this DPA, and the Customer's use and configuration of the Service. Craftkite will tell the Customer if it believes an instruction breaks Data Protection Law, unless the law forbids it.

3. Confidentiality and staff access

1. Craftkite ensures that everyone authorised to process Customer Personal Data is bound by confidentiality.
2. Craftkite personnel access Customer Personal Data and the Customer's content (prompts, project files, previews, app data) only where needed to resolve a support request of the Customer, an abuse report, a legal obligation or a security incident. Each access requires a documented reason, is limited in time and scope (one account or one project), is recorded in an append-only audit trail with every item read, and is shown to the Customer in Account → Privacy. Personal data in staff tools is masked by default.
3. Craftkite does not use Customer Personal Data or Customer content to train AI models, to build examples, templates or evaluations, or for analytics, and shares content in its community gallery only when the Customer submits it with explicit consent, which the Customer can withdraw.

4. Security

Craftkite implements the technical and organisational measures in Annex 2 and keeps them appropriate to the risk. Craftkite may update them as long as the overall level of protection does not decrease.

5. Subprocessors

1. The Customer gives general authorisation for the subprocessors listed on the Subprocessors page.
2. Craftkite announces new subprocessors on that page at least 30 days before they start processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
3. Craftkite imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance.

6. International transfers

Where Customer Personal Data is transferred outside the EEA, the UK, Switzerland or Türkiye to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3, as applicable), the UK International Data Transfer Addendum, and for Türkiye the standard contracts published by the Personal Data Protection Authority, which are incorporated by reference. Where Data Protection Law requires the data subject's explicit consent for a transfer, the Customer is responsible for obtaining it from its own users.

7. Assistance and data subject requests

Craftkite helps the Customer, taking into account the nature of the processing, to answer requests from data subjects and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation. The Service lets the Customer export and delete its data itself.

8. Personal data breaches

Craftkite notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations.

9. Deletion and return

When the agreement ends, the Customer may export its data for 30 days. Craftkite then deletes Customer Personal Data, including backups within their normal rotation, unless the law requires it to be kept.

10. Audits

Craftkite makes available the information needed to show compliance with this DPA, including its security policies and, when available, independent audit reports (such as SOC 2). Where that is not enough, the Customer may carry out an audit once a year with 30 days' notice, during business hours, at its own cost and under confidentiality.

11. Liability and precedence

Each party's liability under this DPA is subject to the limits in the agreement. If this DPA conflicts with the agreement, this DPA prevails for the processing of Customer Personal Data. If a translation of this DPA differs from the English version, the English version prevails.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS) and of secrets at rest; app secrets in an encrypted vault.
• Each project runs in an isolated sandbox with a restricted network; each app database is separate.
• Role-based access for Craftkite staff, mandatory two-factor authentication for administrators, an IP allow list for the admin console and an append-only security audit log.
• Workspace roles (owner, admin, editor, viewer) and single sign-on (SAML or OpenID Connect) for enterprise workspaces.
• Backups, monitoring and incident response as described in Craftkite's security policies.
• AI model providers are contractually required not to train on Customer data; requests carry the providers' no-storage options where offered (OpenAI store: false) and no member identifiers.
• Break-glass access for staff: reason, time limit, scope, per-read audit and transparency to the Customer; personal data masked in staff tools with audited reveal; full personal-data exports for super administrators only.
• Private previews: shown to the project's members or through signed links that expire.
• Retention limits for logs, attachments, screenshots, support tickets and email logs, enforced by a scheduled purge; error reports and analytics stripped of personal data and content.