Data Processing Addendum (DPA)

Version 1.0 · Effective: October 11, 2026.

How to read this document

For individual users, SMC is the controller of their data and no DPA is needed between SMC and the user; the Privacy Policy applies. This document has two parts:

• Part A is a DPA that SMC offers to business customers who process personal data of others through Stylium (for example a stylist, boutique or team using a future Pro API or business account). Under it, SMC is the processor and the customer is the controller.
• Part B is SMC's register of the providers that process data on SMC's behalf, with the agreement each must have in place. It is published as our sub-processor list.

---

Part A — Data Processing Addendum

This DPA forms part of the agreement ("Agreement") between the customer named in the order or account ("Customer") and Space Made Code LLC, a Delaware limited liability company ("SMC"), for the Stylium service. It applies where SMC processes Customer Personal Data on Customer's behalf.

1. Definitions

"Data Protection Laws" means the GDPR (EU 2016/679), the UK GDPR and Data Protection Act 2018, Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), US state privacy laws (including the CCPA as amended) and other laws that apply to the processing. "Customer Personal Data" means personal data SMC processes for Customer under the Agreement. "Sub-processor" means a third party SMC engages to process Customer Personal Data. Other terms have the meaning given in the GDPR.

2. Roles and instructions

2.1 Customer is the controller and SMC is the processor (or, where Customer is itself a processor, SMC is a sub-processor).

2.2 SMC processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use of the Service settings. SMC will tell Customer if it believes an instruction breaches Data Protection Laws.

2.3 SMC does not sell or share Customer Personal Data, does not use it for its own purposes (including AI model training), and does not combine it with data from other sources except as needed to provide the Service. For the CCPA, SMC acts as a "service provider".

3. Confidentiality

SMC ensures that anyone authorised to process Customer Personal Data is bound by confidentiality.

4. Security

SMC implements the technical and organisational measures in Annex II and keeps them at a level appropriate to the risk.

5. Sub-processors

5.1 Customer gives general authorisation for the Sub-processors listed in Part B.

5.2 SMC will give at least 30 days' notice of a new Sub-processor by updating the list and emailing subscribed customers. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.

5.3 SMC imposes data protection obligations on each Sub-processor that are no less protective than this DPA and remains liable for its Sub-processors.

6. Assistance

6.1 SMC provides tools (export, deletion, correction) and reasonable help so Customer can respond to data subject requests. If SMC receives a request directly, it forwards it to Customer without responding, unless legally required.

6.2 SMC provides reasonable information to help Customer with data protection impact assessments and prior consultations.

7. Personal data breaches

SMC notifies Customer without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information available and updates as they become available, and takes reasonable steps to contain it.

8. Deletion and return

At the end of the Agreement, SMC deletes Customer Personal Data within 30 days (and from backups within [BACKUP RETENTION]), after giving Customer the opportunity to export it, unless the law requires retention.

9. Audits

SMC makes available information necessary to demonstrate compliance, including security documentation and sub-processor certifications. Customer may conduct an audit, at its cost, no more than once a year with 30 days' notice, or after a breach or a regulator's request.

10. International transfers

10.1 SMC is located in the United States. Where Customer Personal Data is transferred from the EEA, Switzerland or the UK to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor), are incorporated by reference, with: clause 7 docking clause included; clause 9 option 2 (general authorisation, 30 days); clause 11 optional language omitted; clauses 17 and 18 — law and courts of Ireland. The UK International Data Transfer Addendum applies to UK transfers. The Annexes to this DPA complete the SCC annexes.

10.2 For transfers from Türkiye, the parties sign the standard contract published by the Turkish Personal Data Protection Board and the party required by law notifies it to the Authority within five business days of signature.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws do not allow it. If this DPA conflicts with the Agreement, this DPA prevails; if the SCCs conflict with this DPA, the SCCs prevail.

Annex I — Description of processing

Annex II — Technical and organisational measures

• Access control: database accessed only from SMC servers using a service role; row-level security on every table; ownership enforced by user ID; administrative access limited to SMC's owner with multi-factor authentication [confirm MFA on Supabase, Vercel, Clerk, Stripe, GitHub, Google Workspace].
• Storage: photos in private storage buckets, served only to their owner through short-lived signed links.
• Encryption: TLS in transit; encryption at rest provided by Supabase/AWS.
• Minimisation: AI requests contain only what the task needs; no names, emails or piece names; no photo, prompt or output content in logs.
• Integrity: webhook signatures verified; input validation; rate limits; upload safety screening.
• Availability: managed hosting with provider backups [confirm Supabase backup plan]; health monitoring and AI spend caps.
• Deletion: self-service deletion; automated purging of AI records (90 days), safety records (24 hours) and expired data.
• Incident response: documented procedure (see [Data Breach Response and Notification Procedure]).
• Supplier management: DPAs with all sub-processors (Part B).

---

Part B — Sub-processor and provider register

Apple and Google (for App Store / Google Play purchases) are independent controllers, not sub-processors.