The DPA,
ready to countersign.
Most ateliers do not need a separate DPA — our Terms of Service include all GDPR-required clauses. For enterprises, agencies, and regulated industries, the template below covers everything your legal team will ask for. Sign it once, email it once.
What this document covers
Subject matter, duration, nature and purpose of processing. Categories of data subjects and personal data. Obligations and rights of the controller. Sub-processors (Hetzner, Replicate, OpenAI, Stripe, Brevo, Migadu, Google — listed below).
Sub-processors we use
Hetzner Online GmbH (Nuremberg, Germany) — servers, database and file storage.
Replicate, Inc. (United States) — runs the image and video models; generation inputs are deleted automatically after about an hour.
OpenAI (United States) — garment description and automatic quality check of generated frames.
Stripe — payment processing.
Brevo (France) — transactional email and the Journal newsletter.
Migadu (Switzerland) — our mailboxes.
Google Ireland — Google Analytics 4, only with the visitor's consent.
We will notify you 30 days before any new sub-processor. Full list, with contact and DPA on file, is in Annex II of the template.