Data processing addendum
Last updated 27 October 2026
1. The Parties
This addendum is between the customer named in the order or account (“the Customer”) and CRALIO LLC, a single-member limited liability company formed in the State of Wyoming, United States, under filing ID 2026-002065886, of 5830 E 2nd St, Ste 7000 #38271, Casper, WY 82609, United States (“Cralio”). It forms part of the terms of service, applies whether or not it is signed, and governs where the two conflict on the processing of personal data.
2. Scope and Roles
For the material the Customer uploads, the free text it writes into a job, and the people it invites to review its work, the Customer is the controller and Cralio the processor. For the Customer’s own account, billing and usage data Cralio is a controller in its own right, under the privacy policy. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have their GDPR meanings, and “Data Protection Law” means the GDPR, the UK GDPR and any other data protection law that applies. Annex I describes the processing.
3. Instructions and Warranties
We process personal data only on the Customer’s documented instructions: this addendum, the terms, the jobs the Customer submits, and anything further agreed in writing. The one exception is where the law requires otherwise: material we must preserve after a child-safety report is kept where no deletion reaches it (clause 10.4). If we think an instruction breaches Data Protection Law we will say so, and may suspend that processing.
The Customer warrants a lawful basis for what it instructs, and in particular the informed, written permission of every person whose face, voice or name is in what it sends — in a file or in the text of a job — and of anybody it describes in what it sends, and, for a creative ordered at a banner size, their explicit consent to its transfer to WaveSpeed (clause 7), as Terms §3 and the biometric notice set out.
4. Confidentiality
Everyone on our side authorised to process the Customer’s personal data is bound by confidentiality, and access is limited to those who need it to provide, support or secure the service.
5. Security
We maintain the technical and organisational measures in Annex III, described further on the security page. We may change them, but not so as to reduce the level of protection.
6. Sub-processors
The Customer authorises the sub-processors in Annex II by accepting our register of subprocessors. We choose sub-processors with care and bind each, by contract, to data-protection terms at least as protective as these, as Article 28(4) GDPR requires; how each is used is on the subprocessors page. The register is accepted as a whole, recorded against the account with a fingerprint of its exact words, and required before new work starts.
Adding or replacing one. We post the change on the register and in Annex II and email the account contact. New work starts only after the Customer has accepted the register naming the new sub-processor: the next submission is refused before anything is reserved or sent to a provider. The Customer may take as long as it likes to accept. Separately, it may object on reasonable data protection grounds within 14 days of the posting; if we cannot resolve the objection, it may end the affected part of the service and have back any prepaid fees for the unused period. Where a sub-processor stops being available and the service cannot run without a replacement, we may appoint one at once and post it the same day, and the 14 days run from that posting. A job already submitted is finished under the register in force when it was submitted.
7. International Transfers
Cralio is a company in the United States, so for a Customer in the EEA or the UK the first transfer is to us, at sign-up. The data itself is held in Europe: files and rendering in Amazon Web Services’ Stockholm region, the website and the API in Munich, and accounts, job records and the ledger in a database in Ireland. What each job sends, and where, is on the subprocessors page and in Annex II.
The mechanism. The transfer from the Customer to us is made under the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), incorporated into this addendum by reference and in force from the moment the agreement is. For any other detail about transfers, write to info@cralio.app.
Banner sizes. The onward transfer to WaveSpeed, which draws creatives ordered at a banner size, is made on explicit consent under GDPR Art. 49(1)(a): there is no adequacy decision or Standard Contractual Clauses for it. Each user is asked before their first banner-size order, with the risks stated; the consent is recorded with its version and a fingerprint of its words, and the Customer warrants that the people in those creatives have given the same consent. Without a current consent nothing is reserved or sent to WaveSpeed. A consent can be withdrawn in Settings; from then no new order, retry or edit is sent on it.
The elections:
- Clause 7 (docking) applies.
- Clause 9, Option 1 (specific prior authorisation) applies: the authorisation is the Customer’s acceptance of the register with the sub-processor on it, as clause 6 sets out.
- Clause 11’s optional redress-body wording does not apply.
- Clause 13: the competent supervisory authority is that of the EU member state where the Customer is established.
- Clause 17: the Clauses are governed by the law of Ireland. Clause 18(b): disputes go to the courts of Ireland.
- The Annexes of the Clauses are the three Annexes of this addendum: their Annex I is our Annex I, their Annex II, the security measures, is our Annex III, and their Annex III is the list of sub-processors, which is this addendum’s Annex II.
- For the United Kingdom, the Information Commissioner’s International Data Transfer Addendum (version B1.0) applies, with this addendum as its Tables 1 to 4 and no additional protections selected.
8. Assistance and Return
If a data subject contacts us about the Customer’s data, we pass the request to the Customer without undue delay and help it respond. The Customer can delete a job and its files from the dashboard at any time the job is not running, read its job records on the dashboard and in the gallery for as long as their files are stored, and read every credit movement under Credits › Balance for as long as the account exists. It can download its files at any time before they are deleted, and on request we export what we hold. We help with impact assessments and prior consultations in proportion to what we know of the processing, and may charge reasonable costs, agreed in advance, for help beyond what the product provides.
9. Personal Data Breach
We notify the Customer without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting its data, describing, so far as known: what happened and when, the categories and approximate number of people and records, the likely consequences, what we have done or propose, and a contact point. We send what we have and follow up rather than delay the first notice. We will not name the Customer publicly without its consent unless the law requires it.
10. Deletion
10.1 Finished work is deleted on the workspace’s retention window, as the retention table sets out, or on a window of up to 30 days agreed with the Customer; work in a live review link is kept until the link ends, up to 30 days after delivery. While a safety report about an account is investigated, its work is not deleted on schedule, for up to 30 days. Only material the law requires us to preserve is kept beyond that (10.4).
10.2 An account is erased from Settings, or by us on request. Erasure removes the person’s profile, email settings and messages, acceptance records, uploads, memberships and sign-in, and, in the workspaces that person owns, the jobs and their files, typefaces, glossary, subtitle styles, the prompts saved in Generate, presets, approved wording, client names, invitations and review links with what reviewers said. In a workspace somebody else owns, the work and the files it was made from stay with that workspace, the person’s identifier is removed from them, and the review links they shared there stop working. Erasure is refused while a subscription is active or unpaid, a job is running, others remain in the workspace, or any hold on the account is open; while a safety case is open we say only that the account is under review. If a step fails, we finish the erasure by hand.
10.3 On termination we run that erasure within 30 days. What remains afterwards: the credit ledger, without the person’s name, notes or file names, and the audit log of administrative actions, both anonymised; a deletion record, with keyed fingerprints of the email address and of the card that paid, so a deleted account cannot claim the welcome credits again; a record of each provider refusal under a keyed fingerprint of the workspace; which document versions were accepted; safety-case and takedown records; our pointer to the Customer’s Stripe customer record; database backups already taken, kept for about 30 days and never more than about 90; and material preserved under 10.4. The prompts saved in Generate are deleted.
10.4 Where United States law requires material to be preserved — a report under 18 U.S.C. § 2258A is the case that arises here — a copy is kept where no deletion reaches it, for at least one year from the report and until a person removes it, and erasure is refused while the safety case is open.
10.5 Files are never in a backup. A sub-processor’s own copy follows its retention in Annex II. We certify deletion in writing on request.
11. Audits
We make available the information reasonably needed to show we comply with this addendum. The Customer may audit once in any 12 months, on 30 days’ written notice, in business hours, under confidentiality, without access to other customers’ data or to production systems. A regulator may audit as the law allows.
12. Liability, Term and Changes
Liability under this addendum is subject to the limits in the terms of service. It takes effect when the agreement does and lasts while we process personal data for the Customer. We will not change this addendum so as to reduce the protection it gives without the Customer’s agreement; any other change is published here with a new date and applies from then. For a signed copy, write to info@cralio.app with the company’s details and where breach notices should go; signing records the addendum rather than starting it. For anything not covered here, write to the same address.
Annex I — Description of the Processing
| Parties | Data exporter: the Customer, as controller, at the address in its account. Data importer: CRALIO LLC, as processor, 5830 E 2nd St, Ste 7000 #38271, Casper, WY 82609, United States; contact info@cralio.app. |
| Subject matter | Localizing and generating advertising material on the Customer’s instruction. |
| Duration | While the agreement runs, then until the retention windows below have passed; clause 10.3 lists what remains after an erasure. |
| Nature and purpose | Storage, transcription, translation, synthetic speech, lip-sync, image redrawing, music generation, generating video and stills from prompts and images, recutting a video to another shape, rendering and delivery. |
| Types of personal data | Faces and voices in video; names, likenesses and other personal data in a creative’s copy; faces or products in images attached to Generate; free text written into a job; the name, comments and a keyed hash of the IP address of each reviewer the Customer invites. |
| Categories of data subject | Every identifiable person whose face, voice or name is in what the Customer sends, in a file or in the text of a job, anybody the Customer describes in either, and the people it invites to review its work. |
| Special category data | Dubbing and lip-sync involve a provider measuring a voice or a face, which several laws treat as biometric data. Cralio computes and stores no biometric template; see the biometric notice. |
| Retention | As the retention table on the security page sets out: the workspace’s window, or in a live review link, until the link ends, up to 30 days after delivery. While a safety report about an account is investigated, its work is not deleted on schedule, for up to 30 days. Files are never in a backup. The one exception is the row below. |
| Material the law requires us to preserve | Kept apart from every other rule: it survives the retention window, the deletion of the job and the account being closed; it is kept at least one year after a report under 18 U.S.C. § 2258A and removed only by a person; see clause 10.4. |
| Transfers | As set out in clause 7 and Annex II. |
| Frequency of the transfer | Continuous: on each job the Customer submits. |
| Competent supervisory authority | The supervisory authority of the EU member state where the Customer is established. |
Annex II — Sub-processors
Rendered from the register; the subprocessors page carries the same rows with a link to each company’s terms.
| Who | What for | Where | What it receives | May train on it | How long it keeps it |
|---|---|---|---|---|---|
| Contabo GmbH | Hosting for cralio.app and api.cralio.app | Germany (Munich) | Everything you type, on its way to the database; video uploads, fonts and approved-wording files on their way to storage; and an attached image read back from storage when you ask for a prompt rewrite. It also runs our scheduled tasks and backups and holds the application's configuration. | Runs no model | Logs until the server's fixed-size log store overwrites them, usually after several months; the web server's request log about two weeks; each job's processing log up to 30 days. Your files only for the length of a request. |
| Amazon Web Services | Storage, processing and queueing | Sweden (Stockholm) | Everything you upload, the finished files, transcripts and subtitle files, and the wording you typed as part of each request. Rendering runs here. Audio extracted for transcription stays on the rendering machine and is deleted when the step ends. | Runs no model | Your files: your plan's window, and in any case about 30 days after they were made, except typefaces (your plan's window after their last use) and material we must preserve by law. Database backups, never files: a daily copy kept for about 30 days and never more than about 90. Rendering logs for a limited period. |
| Reading, redrawing and checking static creatives; music, titles and covers; clips and stills from a prompt; rewriting a prompt | United States | For a creative: the image, the wording read off it and its translations, your glossary, your approved wording and the corrections you have made before, then the delivered image to check its words, and again for a second opinion or an edit. For a track: your prompt, style and lyrics, and the drawn cover, to read its lettering. For Generate: your prompt and attached images, with the model settings you chose, and again for a prompt rewrite. | No | Prompts and outputs are logged for up to 55 days for abuse monitoring. A generated clip is held in our project until Google expires it. | |
| HeyGen | Dubbing, lip-sync, and the translation behind translated subtitles | United States | The source video, fetched once over a link that expires, for dubbing, lip-sync and translated subtitles. Subtitles in the video's own language, Statics, Music, Generate and Reframe never reach it. | Yes, by default | Its own policy. A deleted account's data stays in its backups for about 60 days. |
| Luma | Recutting a finished video to another aspect ratio | United States | The video you asked to have recut, fetched once over a link that expires, a sentence describing the shot (yours, or one we write from your settings), and the shape and resolution you chose. Nothing from Video, Statics, Music or other Generate tools. | No | Its API terms name no period. The recut comes back over a link of theirs that expires. |
| WaveSpeed | Drawing a creative at an exact banner size | Not published by WaveSpeed; its contracting companies are in Singapore and Hong Kong Transfer: Only on your explicit consent, asked before the first banner-size order. | The creative, uploaded to its storage, and the wording to draw, with layout instructions, only for creatives ordered at a banner size. Nothing from Video, Music or Generate. | Yes, by default | Deletes uploaded images after 7 days and keeps results for up to 7 days. We delete each finished request there as soon as the image is ours. |
| OpenAI | Speech-to-text | United States | Audio extracted from the video, for transcription. No picture. | No | Up to 30 days of abuse-monitoring logs. |
| Supabase | Accounts, job records and the credit ledger | Ireland; Supabase Inc. in the United States may access it remotely | Your account, balance and job records, including the words you typed on a job; your glossary, saved prompts, presets, approved wording and client names; review links and what reviewers leave (name, comments, a keyed hash of the IP address); the email we send you; the credit ledger; your acceptances of our documents; waiting-list entries. It also sends the emails that confirm your address and reset your password. No video or audio. | Runs no model | For the life of the account; after an erasure, only what the privacy policy lists as kept. A waiting-list address until 90 days after its one message is sent. |
| Stripe | Payments | United States and Ireland | Your account email address, our reference for your workspace and plan, what you pay, and the card details you give Stripe directly, which never touch our servers. | Runs no model | As their own terms and financial law require. |
| Google Workspace (Gmail) | The transactional email we send you | Ireland, with onward transfer to the United States under Google's terms | Your email address and the messages we send: a welcome when you register, an invitation if a colleague adds you, a payment received, a card declined, automatic top-up switching itself off, a video finished, a batch finished, a job failed, a file about to expire, credits running low or run out, Platform news, a notice if we remove a file after a copyright notice, an email at least 30 days before a plan price changes, a confirmation when you withdraw from or cancel a contract, with the name and statement you sent, a notice when one of our legal documents changes, a reviewer's message when somebody you shared work with rejects or comments on a creative, with their comment and the name they typed, and, for a waiting-list address, the single message it was left for. Notices about your work name the file they are about. No file of yours is ever attached. | Runs no model | As their own terms provide. |
| Telegram | Our own alerts | Outside the EU | A reason code, counts and amounts about the service, and a reference to our own record. No personal data. | Runs no model | Telegram's own. |
| Slack | Our own alerts | United States | A reason code, counts and amounts about the service, and a reference to our own record. No personal data. | Runs no model | Slack's own. |
Annex III — Technical and Organisational Measures
- Encryption. Files are encrypted in transit and, by the storage service, at rest (AES-256).
- Separation. Uploads and typefaces are stored apart for each account, deliveries for each job, and every request for a file is checked against the account making it. Download links expire after an hour. No customer file has a public address, except work the Customer shares through a review link, which anyone holding the link can view until it expires or is revoked.
- Accountability. Administrative actions are written to a record the application can add to but not change or delete, naming the person, the account and the time.
- Availability. The database is copied daily; a copy is kept for about 30 days and never more than about 90. Files are never in a backup.
- Rate control. Submissions, quotes, upload preparations, billing actions, erasure confirmations and waiting-list sign-ups are rate limited per caller.
- Alerting. Operator alerts carry a reason code, counts and amounts about the service and a reference to our own record, and no personal data.
- Deletion. A failed deletion is recorded on the job, retried every hour, and raised to us if it keeps failing.