Data Processing Addendum
For customers who need data processing terms in place, typically because their own compliance obligations require them. These terms apply automatically where you use supaintro to process personal data as a controller, and form part of the terms of service.
Last updated
1. Roles
Where you use supaintro to process personal data, you are the controller and Vyan Labs, a sole proprietorship of Sourish Sarmah ("we") is the processor. We process that data only on your documented instructions, which for these purposes means these terms, the terms of service, and your use of the product's features.
For our own account and billing data, we act as a controller in our own right. That processing is described in the privacy policy and is not covered by this addendum.
2. Scope of processing
| Detail | |
|---|---|
| Subject matter | Generating launch videos from customer-supplied inputs |
| Duration | For as long as your account or projects exist, plus retention periods in the privacy policy |
| Nature and purpose | Storage, analysis, model inference, rendering, and delivery of video output |
| Types of personal data | Account identifiers, and any personal data you choose to include in project inputs |
| Categories of data subject | Your personnel, and any individuals appearing in material you supply |
3. Confidentiality
We ensure that anyone authorised to process your data is bound by an appropriate duty of confidentiality, and we limit access to those who need it to operate the service.
4. Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, hashed credentials, access control on production systems, and logical separation of customer data. Measures may change as the service evolves, but not in a way that materially reduces the level of protection.
5. Subprocessors
You give general authorisation for the subprocessors listed on the subprocessors page, which is maintained as part of the service configuration. We impose data protection obligations on each of them no less protective than these terms, and we remain liable to you for their performance.
We will give notice before adding a new subprocessor. If you have a reasonable objection on data protection grounds, tell us and we will work to address it; if we cannot, you may terminate the affected part of the service and receive a refund of any unused paid allowance.
6. Data subject requests
Where a data subject contacts us directly about data we process on your behalf, we will refer them to you rather than respond. We will assist you in responding to access, correction, deletion, portability, objection, and restriction requests, taking into account the nature of the processing. Requests for assistance go to support@vyanlabs.in.
7. International transfers
We operate from India and several subprocessors are in the United States. Where personal data originating in the UK or EEA is transferred, we rely on Standard Contractual Clauses or another lawful transfer mechanism, incorporated into our agreements with each subprocessor and, where you require it, into our agreement with you.
8. Personal data breach
We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting data processed on your behalf. The notification will describe the nature of the breach, the likely consequences, and the measures taken or proposed, to the extent that information is available.
9. Audits
We will make available the information reasonably necessary to demonstrate compliance with these terms and will contribute to audits conducted by you or an auditor you appoint. Given the size of the operation, we ask that audits be limited to once a year unless a breach has occurred, that they be scheduled reasonably in advance, and that documentation be accepted where it answers the question.
10. Deletion and return
You may delete projects at any time from within the application. On termination, or on written request, we will delete personal data processed on your behalf within 30 days, except where retention is required by law, and except for copies in backups which are deleted when those backups expire on their normal rotation.
11. Model training
We do not use customer data to train machine-learning models, and we do not permit our subprocessors to use it to train theirs.
12. Liability and precedence
Liability under this addendum is subject to the limitations in the terms of service. Where this addendum conflicts with those terms on a data protection matter, this addendum prevails.
Getting a signed copy
These terms apply without signature. If your procurement process requires an executed document, or you need your own DPA or Standard Contractual Clauses reviewed, write to support@vyanlabs.in and we will handle it. Postal address: Guwahati, Assam, India.