Data processing addendum

“Data Protection Law” means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the California Consumer Privacy Act as amended (“CCPA”) and other laws on personal data that apply to the processing. “Customer Personal Data” means personal data that CastGenX processes for Customer through the service, as described in Annex I. “Controller”, “processor”, “data subject”, “personal data breach”, “service provider” and similar terms have the meanings given in Data Protection Law. “SCCs” means the standard contractual clauses approved by European Commission Decision 2021/914.

Customer is the controller (or a processor acting for its own clients) of Customer Personal Data, and CastGenX is its processor (or subprocessor). For the purposes of the CCPA, CastGenX is Customer's service provider. CastGenX is a controller of the account, billing and usage data it needs to run its business, as described in the privacy policy; this DPA does not apply to that data.

Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for recording guests and other people and for giving them the information the law requires.

CastGenX processes Customer Personal Data only on Customer's documented instructions, which are: the terms and this DPA; the actions Customer and its users take in the service (for example producing, publishing or deleting an episode, inviting a guest or creating a private-feed link); and other reasonable written instructions consistent with them. CastGenX may process Customer Personal Data otherwise only where the law requires it, and will tell Customer first unless the law forbids that. CastGenX will tell Customer if it believes an instruction infringes Data Protection Law.

CastGenX ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide, support or secure the service.

CastGenX implements the technical and organisational measures in Annex II, appropriate to the risk, and may update them provided the overall level of protection does not decrease.

• Customer gives a general authorisation for CastGenX to engage the subprocessors listed on the subprocessors page.
• CastGenX will give at least 14 days' notice of a new subprocessor by updating that page [OWNER: and by email to customers who ask to be notified]. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may stop using the affected feature or terminate the service and receive a pro rata refund of prepaid fees for the remaining period.
• CastGenX imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains liable to Customer for its subprocessors' performance.
• Integrations Customer chooses to connect with its own credentials (its own provider API keys, its YouTube channel, podcast directories) act on Customer's behalf under Customer's own agreements with them and are not CastGenX subprocessors.

Where Customer Personal Data is transferred from the EEA, Switzerland or the UK to a country without an adequacy decision, the parties agree that:

• the SCCs are incorporated by reference, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with Clause 7 (docking) included, Clause 9 option 2 (general written authorisation, with the notice period in section 6), the optional wording in Clause 11 omitted, Clauses 17 and 18 governed by the law and courts of [OWNER: governing-law jurisdiction — to be confirmed by counsel] [OWNER: must be an EU member state], and Annexes I and II of this DPA completing the SCC annexes;
• for UK transfers, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Table 4 allowing either party to end it;
• for Swiss transfers, references to the GDPR are read as references to the FADP and the competent authority is the Swiss FDPIC;
• CastGenX relies on the EU-US Data Privacy Framework or SCCs with its subprocessors for onward transfers.

If the SCCs conflict with this DPA, the SCCs prevail.

• Data subject requests. The service lets Customer export, correct and delete Customer Personal Data itself. If CastGenX receives a request from a data subject about Customer Personal Data, it will pass it to Customer without undue delay and not answer it except on Customer's instructions.
• Impact assessments. CastGenX will give reasonable information to help Customer with data protection impact assessments and prior consultations with a supervisory authority.
• Records. CastGenX keeps the records of processing that Data Protection Law requires of a processor.

CastGenX will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. CastGenX will add information as it becomes available, take reasonable steps to contain the breach, and help Customer meet its own notification duties. Notice is sent to the workspace owner's account email.

Customer can export its data at any time (Settings → Profile → Export your data). Items Customer deletes go to the Trash and are purged after 30 days; deleting the account deletes Customer Personal Data straight away. After the service ends CastGenX deletes remaining Customer Personal Data within 30 days, unless the law requires it to keep it. Copies in backups are overwritten in the normal backup cycle [OWNER: confirm backup retention] and are not restored except to recover the service.

CastGenX will make available the information needed to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. If that is not enough, or a supervisory authority requires it, Customer may audit CastGenX (itself or through an independent auditor bound by confidentiality) once a year, with at least 30 days' notice, during business hours and without disrupting the service, at Customer's cost. Audits of subprocessors are carried out through the reports and certifications they provide.

CastGenX will not: sell or share Customer Personal Data (as those terms are defined in the CCPA); retain, use or disclose it for any purpose other than providing the service, or outside the direct business relationship with Customer; or combine it with personal data from other sources, except as the CCPA permits. CastGenX will comply with the CCPA, give the same level of privacy protection it requires, tell Customer if it can no longer meet these obligations, and allow Customer to take reasonable steps to stop and remedy unauthorised use. CastGenX certifies that it understands these restrictions.

Each party's liability under this DPA is subject to the limitations in the terms, except where Data Protection Law does not allow it. This DPA lasts as long as CastGenX processes Customer Personal Data. If this DPA conflicts with the terms, this DPA prevails for the processing of Customer Personal Data.

• Encryption in transit: HTTPS (TLS) for the site, studio, API, feeds and media, including white-label feed domains.
• Encryption of secrets: stored provider keys and OAuth tokens are encrypted with AES-256-GCM, bound to the user and service they belong to, with versioned keys. Public API keys, private-feed links, guest links and licence keys are stored only as SHA-256 hashes.
• Access control: sign-in through Clerk; the API accepts only tokens issued for the studio; every request is checked against the owner or workspace; a cloned voice is usable only by the person whose voice it is; account deletion needs a fresh sign-in; admin tools are limited to named staff.
• Media protection: private files are served through short-lived signed URLs; private shows' audio, art and transcripts sit behind per-listener tokens that can be revoked one by one.
• Infrastructure: the app, database and file storage run on our own server; internal services such as Redis are reachable only on the private network and need a password; containers run as non-root with pinned images; a content security policy and request size limits protect the web app and API.
• Abuse prevention: per-plan rate limits and quotas, bounded inputs, safe fetching of external URLs, and webhook signature checks.
• Data minimisation: each provider receives only what its step needs; model-training opt-outs and no-storage modes are turned on where offered; AI usage analytics are metadata-only; browser analytics and error reports load only with consent.
• Deletion: a 30-day Trash, immediate account deletion including the sign-in identity and cloned voices, and a retry sweep so no stored file is left behind.
• Monitoring and response: structured security event logs without secrets, error monitoring, documented incident steps, and a public vulnerability reporting address (security@castgenx.com).
• Secure development: automated tests, type checks and dependency audits in CI, automated dependency updates, and pinned build dependencies.
• Resilience: [OWNER: off-site encrypted database backups with restore tests are pending — confirm before signing]
• People and vendors: confidentiality obligations for anyone with access, and data processing terms with every subprocessor.

More detail is on the security page.