Data Processing Agreement

1. The parties and their roles

Processor: Nathan Lewis, trading as Bold Boy, Eerste Jan van der Heijdenstraat 108-H, 1072 VB Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 52479536, VAT number [To confirm: VAT number] [To confirm: that this is the registered address; boldboy.nl's footer shows a different one] ("SwapThat").

Controller: the company that uses SwapThat (the "Customer"), as named in its SwapThat account.

The Customer is the controller for the personal data in the content it uploads, and SwapThat processes that data on its instructions. The Customer is responsible for having a legal basis for it, and for informing the people shown.

SwapThat is not a processor for everything it does. For running the accounts, keeping the service secure and keeping its own administration, SwapThat decides for itself why and how data is processed, and is an independent controller for that. Those activities are described in SwapThat's Privacy Policy and are outside this agreement.

This agreement is accepted electronically, by a person with the Approver role, who confirms that they are authorised to bind the Customer. The acceptance is recorded with the version, the person and the time.

2. Subject matter, duration, nature and purpose

Subject matter: providing the SwapThat service — storing the Customer's images, generating and editing images with AI providers on the Customer's instruction, analysing an uploaded photograph to describe its styling, and keeping the records the service needs.

Duration: for as long as the Customer uses SwapThat, and afterwards only for as long as the retention periods in annex 3 run.

Nature and purpose: storage, copying, resizing, analysis, transmission to the providers in annex 2, and deletion, only in order to provide the service.

SwapThat processes the data only on the Customer's documented instructions. Using the service is such an instruction: uploading an image and selecting Generate instructs SwapThat to do exactly what the screen describes. SwapThat tells the Customer if an instruction appears to breach data protection law.

3. Categories of data and of data subjects

Categories of personal data:

• photographs that show identifiable people, uploaded as model photographs, product photographs or references, and the results generated from them;
• the instructions and notes the Customer writes, where they contain personal data;
• the names and business email addresses of the Customer's own team members, as far as they appear in the content.

Categories of data subjects: the models and other people shown in the Customer's images, and the Customer's team members.

Special categories of data: none are intended, and the Customer must not upload them. A photograph is not by itself a special category: article 9 GDPR concerns biometric data processed in order to identify someone uniquely, and SwapThat does no facial recognition, no matching and no identification. The Customer must not upload images that reveal health, religion, political opinions, trade union membership, sex life or sexual orientation, and must not upload images of children without the permission of their parents or guardians.

No automated decision-making within the meaning of article 22 GDPR takes place. SwapThat produces images; it makes no decision about a person.

4. Security measures

SwapThat takes the technical and organisational measures required by article 32 GDPR. The measures in force are listed in annex 1 and in the Security section of the Privacy Policy, and they include separation of each company's data inside the database itself, private storage with short-lived access links, two-factor authentication and logging for administrators, unalterable audit records, secrets held in a secret store, and a spending cap with an emergency pause.

SwapThat may change a measure, provided the level of protection is not reduced.

Everyone at SwapThat who may access the data is bound to confidentiality, and access is limited to what is needed for support the Customer has asked for, for security, for an abuse report or for a legal obligation.

5. Subprocessors

The Customer authorises the subprocessors listed in annex 2. They are the providers that host the service, store the images, generate the images and send the service email.

SwapThat imposes on each subprocessor data protection obligations that are no less protective than this agreement, and remains fully responsible to the Customer for what a subprocessor does.

SwapThat gives the Customer at least 30 days' notice, by email and in the application, before adding or replacing a subprocessor that processes the Customer's content. The Customer may object on reasonable data protection grounds within those 30 days. If the objection cannot be resolved, the Customer may end the agreement for the affected part of the service, without penalty, and unused purchased credits are then refunded for that part.

[To confirm: the refund in the sentence above is a proposal; it is the fair answer to "you changed a provider I objected to", but it is a commercial decision.]

6. Transfers outside the European Economic Area

The Customer's account data is stored in the European Union (Frankfurt) and its images are stored in the European Union.

Some subprocessors are established outside the EEA, may access the data from outside it, or may process it outside it. Annex 2 states, for each one, where the data is stored, where it is processed, and on what basis any transfer is made.

Every transfer is made on the basis of the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), or of an adequacy decision where one applies. Where SwapThat acts as processor and the subprocessor is therefore a sub-processor, module 3 of those clauses applies. SwapThat has assessed each transfer against the law of the destination country and keeps the assessment; the Customer may ask for a copy.

The AI providers that generate the images may process them outside the European Union. SwapThat says so plainly in its Privacy Policy, and is working to confine that processing to the EU; the Customer will be told when it is.

7. Helping the Customer meet its own duties

Requests from data subjects: the Customer handles them, because it is the controller. The Customer can itself see, download, correct and delete any image in the application, which is usually the quickest way to answer a request. Where a request reaches SwapThat directly, SwapThat does not answer it itself: it passes it to the Customer without undue delay, and helps the Customer answer it.

SwapThat helps the Customer, as far as it reasonably can, with its obligations under articles 32 to 36 GDPR — security, breach notification, data protection impact assessments and prior consultation — and gives the Customer the information it needs for them.

Assistance is free for a reasonable volume of requests. SwapThat may charge its reasonable costs for assistance that goes well beyond that, and tells the Customer before it does.

8. Personal data breaches

SwapThat notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and in any event within 48 hours, so that the Customer can meet its own 72-hour deadline under article 33 GDPR.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where not everything is known yet, SwapThat sends what it has and follows it with more, rather than waiting.

SwapThat does not notify the supervisory authority or the data subjects on the Customer's behalf, unless the Customer asks it to in writing. It is for the Customer, as controller, to decide whether to notify.

SwapThat documents every breach, notified or not, and follows the written procedure in its compliance records.

9. Information and audit

On request, SwapThat gives the Customer the information it reasonably needs to show that this agreement is being complied with: its list of security measures, its retention schedule, its subprocessor register and its transfer assessments.

The Customer may audit SwapThat's compliance, itself or through an auditor it appoints who is not a competitor of SwapThat, once in any twelve-month period, during business hours, after at least 30 days' written notice, and without disrupting the service or exposing another customer's data. Either party may call an additional audit after a personal data breach.

The Customer bears the cost of an audit it calls, unless the audit finds a material breach of this agreement by SwapThat, in which case SwapThat bears its own costs.

[To confirm: whether SwapThat will obtain an independent certification or report, such as ISO 27001 or SOC 2, which would normally replace an on-site audit. None exists today, and at this scale a documented review is the honest answer.]

10. Retention, return and deletion

SwapThat keeps the Customer's personal data only for the periods in annex 3, and deletes it automatically when they run out.

The Customer can delete any image itself at any time, and can download its results at any time, so no separate return procedure is needed.

When the agreement ends, SwapThat deletes the Customer's images and campaigns 30 days after the account is closed. The Customer may ask for them to be deleted sooner, or for a copy, during those 30 days.

SwapThat keeps the records it must keep by law — in particular its credits, invoices and the accounting records that relate to them, for the 7 years required by article 52 of the Dutch General Tax Act. Those records contain no images. SwapThat may also keep data that is subject to a legal hold, for a dispute, a complaint or a legal request, for as long as the hold lasts, and tells the Customer that it has.

Deletion is automated, logged and tested: SwapThat removes the image file from storage first and the record of it afterwards, and keeps a log of how much was deleted in which category, without file names or email addresses.

11. Liability and duration

The liability provisions of the Terms & Conditions apply to this agreement, except where article 82 GDPR provides otherwise. Nothing here limits a data subject's rights.

This agreement runs for as long as SwapThat processes personal data for the Customer, and the provisions on retention, deletion, confidentiality and assistance survive its end for as long as they need to.

This agreement is governed by Dutch law, and disputes go to the competent court in Amsterdam.

Where this agreement and the Terms & Conditions conflict on the processing of personal data, this agreement prevails.

Annex 1 — Security measures

• Every connection encrypted in transit (TLS/HTTPS).
• Images stored in a private bucket with no public access, in the European Union; access only through links that expire after 15 minutes, issued after a permission check.
• Each company's data separated by row-level security in the database, checked on every request, so one company's credentials cannot read another's rows.
• Role-based access inside a company: Member and Approver.
• Two-factor authentication required for SwapThat's own administrators, with every action logged together with the reason given.
• Audit records and reviews cannot be altered or deleted by anyone, enforced in the database.
• Secrets and API keys in the providers' secret stores, never in source code; source code in a private repository.
• A monthly spending cap with alerts and an emergency pause, limiting the damage a stolen key could do.
• Error messages and logs filtered so that keys and provider responses cannot leak.
• Automated, logged and tested deletion, with a dry-run mode so a clean-up can be checked before it runs.
• Backups of the database and the images. [To confirm: the backup window, and a tested restore, before launch.]

Annex 2 — Authorised subprocessors

• Supabase Pte. Ltd. — database and authentication. Stored and processed in Frankfurt, Germany (EU); the provider is established in Singapore. Transfers under the standard contractual clauses.
• Cloudflare, Inc. — image storage (R2). Stored in Western Europe (EU); the provider is established in the United States. Transfers under the EU-U.S. Data Privacy Framework, with the standard contractual clauses as a fallback.
• Google — the generation service and its queue (Cloud Run, Cloud Tasks, Secret Manager). Stored and processed in Frankfurt, Germany (EU). Transfers under adequacy where it applies, otherwise the standard contractual clauses.
• OpenAI Ireland Ltd. — image generation with GPT Image 2 and GPT Image 2.5 Sunburst. Processed outside the EU today; OpenAI's EU region needs its approval for image models and has not yet been requested. Transfers under the standard contractual clauses. Does not train on the data; keeps abuse logs for up to 30 days.
• Google — image generation with Nano Banana Pro, and the analysis of an uploaded photograph (Gemini API). No regional commitment: Google states the data may be stored or cached in any country where it operates. Transfers under its processor addendum and the standard contractual clauses. Does not use the data to improve its products on the paid tier; logs it for a limited period, up to 55 days.
• Sinch Email (Mailgun) — service email only; no images and no generated content. Mailgun's European region; European customers' data on infrastructure in Germany and Belgium. Transfers under the standard contractual clauses. Open and click tracking switched off.
• Vercel — hosts the website (server functions in Frankfurt, Germany, EU; pages served from the network location nearest the visitor). Processes request data such as IP addresses; images pass through only as short-lived signed links. [To confirm: Vercel's DPA and transfer mechanism.]

SwapThat's full register, with the legal entity, purpose, data categories, retention, training policy, DPA status, transfer mechanism and evidence for each provider, is available to the Customer on request.

Annex 3 — Retention periods

• Images and results: while the account is active, until the Customer deletes them.
• A deleted image: removed from active storage within 24 hours; from backups within 30 days.
• Images and campaigns after the account closes: 30 days.
• An unfinished upload: 24 hours.
• The technical record of a generation request: 30 days after the image finished.
• The generator's working state between steps: 30 days.
• Invitations after they are accepted, withdrawn or expired: 12 months.
• Completed or declined credit requests: 12 months.
• Administrator audit records that are not about money: 12 months.
• Sign-in and security logs: 90 days.
• Backups: 30 days.
• Credits, invoices and the accounting records that relate to them: 7 years (article 52 of the Dutch General Tax Act). No images.
• Support correspondence: 12 months after the matter is closed.

These are the periods SwapThat's automated clean-up enforces. SwapThat may shorten them, and tells the Customer before extending any of them.