Data Processing Addendum
How Surf Studio processes personal data in what you give it, in force from 13 November 2026.
Version of 13 November 2026, in force from that day. It is part of the Surf Studio Terms of Service between you and Surf Platforms Inc., trading as Surf Studio ("Studio").
1. When it applies
It applies when what you give Studio, such as your prompts, contains personal data of other people, and data protection law treats you as the controller of that data and Studio as your processor. Data about you as Studio's user is covered by the Privacy Policy instead.
2. What Studio processes
- Subject matter: the personal data in your prompts and in the films Studio makes from them.
- Purpose: to make, store and show you your films. Studio does nothing else with it.
- Duration: while your account is open, until you delete the film or the account.
- People: whoever your prompts mention.
- Kinds of data: whatever you type. Do not type sensitive data, such as health data, into a prompt.
3. Studio's duties
Studio will:
- process the data only on your instructions, which are these Terms and how you use Studio, unless the law requires otherwise, and tell you if it thinks an instruction breaks the law;
- make sure the people who can reach the data are bound to keep it confidential;
- keep it secure: encrypted in transit, access limited to the workspace's members by the database's own rules, and model keys encrypted with AES-256-GCM;
- use only the sub-processors on the Sub-processor List, under written terms that protect the data, and add a new one only as that list's Changes section says; you may object, and if Studio cannot meet the objection you may delete your account;
- help you answer requests from the people the data is about, and with security and impact assessments, as far as Studio can;
- tell you without undue delay, and within 72 hours where it can, after it learns of a breach of the data;
- delete the data when you delete it, or delete your account, unless the law requires Studio to keep it;
- give you the information you need to show that this addendum is followed, and answer your reasonable written questions about it.
4. Your model account
If your workspace runs on your own model account, the provider you chose receives your prompts under your own agreement with it. That provider is not Studio's sub-processor.
5. Transfers
Studio processes the data in the United States. Where EU or UK law requires a transfer mechanism for data you send to Studio, the EU Standard Contractual Clauses (module two, or module three where you are yourself a processor) and the UK International Data Transfer Addendum apply, are incorporated by reference, and take precedence if they conflict with this addendum. Ireland's law and courts govern the Clauses.
6. Contact
legal@surfplatforms.com, or Surf Platforms Inc., Legal Notices, 5434 Manderston Drive, San Jose, CA 95138, United States.