Last updated · Version 2026-07-30
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Clarity and Confidence Academy Ltd. ("Processor", "we") and the account holder ("Controller", "you"). It applies whenever you use DebriefStudio to process personal data relating to other people — crew, clients, contributors, or contacts named in your briefs. Accepting the Terms constitutes acceptance of this DPA; no signature is required.
1. Roles
You are the controller of the personal data contained in your project inputs and outputs. We process that data solely on your documented instructions, which are given through your use of the product's features. For your own account and billing data we are the controller — see the Privacy Policy.
2. Subject matter and duration
Subject matter: generation, storage, and delivery of production briefs, emails, and crew documents. Duration: for as long as your account exists, plus the retention periods stated in the Privacy Policy.
3. Nature and purpose of processing
Storage, structuring, transmission to AI sub-processors for text generation, retrieval, export, and erasure — all for the purpose of producing your briefs.
4. Categories of data and data subjects
Data subjects: your crew, clients, collaborators, and any individuals named in the material you upload.
Categories: names, roles, contact details, rates or budget figures, and any free-text information you choose to include. You must not upload special-category data (health, biometric, political, religious, trade-union, sexual-orientation data) or criminal-offence data.
5. Our obligations
We will (a) process personal data only on your instructions; (b) ensure that everyone authorised to access it is bound by confidentiality; (c) implement appropriate technical and organisational measures under Art. 32; (d) assist you with data-subject requests and with Art. 32–36 obligations; (e) notify you without undue delay, and in any case within 48 hours, of any personal data breach affecting your data; and (f) on termination, delete your data as described in the Privacy Policy.
6. Security measures
Encryption in transit (TLS) and at rest; row-level access control so no account can read another's data; private file storage with per-user paths; least privilege on administrative access; EU-region primary data storage; optional Confidential mode that redacts identifying terms in your browser before any data reaches an AI model.
7. Sub-processors
You give general authorisation for the sub-processors below. We will give at least 30 days' notice by email before adding or replacing one, and you may terminate your subscription if you object.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | European Union | No transfer outside the EEA for stored project data |
| Lovable (hosting & AI gateway) | Application hosting and routing of AI requests | European Union / United States | Standard Contractual Clauses |
| Google (Gemini via the AI gateway) | Generation of brief, email, and crew-brief text | United States | Standard Contractual Clauses; inputs not used for model training |
| Stripe | Payment processing and invoicing | United States / Ireland | Standard Contractual Clauses |
8. International transfers
Where a sub-processor processes data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Decision 2021/914), which are incorporated into this DPA by reference, together with supplementary technical measures.
9. Data-subject requests
You can service access, portability, and erasure requests yourself using the export and delete tools in the product. If a data subject contacts us directly, we will refer them to you and assist where required.
10. Audit
On reasonable written request, and no more than once a year, we will provide the information necessary to demonstrate compliance with Art. 28.
11. Return and deletion
Export your data at any time from Settings → Account. On account deletion, your project data and uploaded files are erased, with backups rolling off within 30 days.