Data Processing Agreement

Last updated: February 24, 2026

1. Scope

This Data Processing Agreement (“DPA”) supplements the Terms of Service and applies where ScriptMotion processes personal data on behalf of the Customer as a data processor under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and UK GDPR.

2. Definitions

“Personal Data”, “Processing”, “Data Controller”, “Data Processor”, and “Data Subject” have the meanings given in the GDPR. “Customer” refers to the entity that has agreed to the Terms of Service.

3. Roles and Responsibilities

The Customer acts as the Data Controller. ScriptMotion acts as the Data Processor. ScriptMotion processes personal data only on documented instructions from the Customer, unless required by applicable law.

4. Sub-processors

ScriptMotion uses the following categories of sub-processors: cloud infrastructure (Supabase/AWS), payment processing (Stripe), AI model providers (Google, OpenAI, Runway, Kling AI), and voice synthesis (ElevenLabs). A current list of sub-processors is available upon request.

5. Security Measures

ScriptMotion implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, regular testing, and incident response procedures.

6. Data Subject Rights

ScriptMotion will assist the Customer in responding to Data Subject requests (access, rectification, erasure, portability, restriction, objection) through appropriate technical and organizational measures.

7. Data Breach Notification

ScriptMotion will notify the Customer without undue delay after becoming aware of a personal data breach. Notification will include the nature of the breach, categories of data affected, and measures taken or proposed.

8. International Transfers

Where personal data is transferred outside the EEA, ScriptMotion ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions.

9. Term and Deletion

This DPA remains in effect for the duration of the service agreement. Upon termination, ScriptMotion will delete or return all personal data within 90 days, unless retention is required by law.

10. Contact

For DPA-related inquiries, contact dpa@scriptmotion.ai.