This addendum is a working draft and has not been reviewed by a lawyer. It is not yet in force. Customers who need a signed DPA can request one at legal@foveahq.com.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and Buildberg Pty Ltd, operating Fovea ("Processor"). It applies when Fovea processes personal data contained in Customer Content on the Customer's behalf.
1. Roles
The Customer is the controller of personal data in Customer Content. Fovea is the processor and processes that data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the service's features.
2. Scope of processing
| Subject matter | Providing the Fovea creative library and analytics service |
| Duration | For the term of the subscription, plus the export and deletion period |
| Nature and purpose | Hosting, analysing (including AI tagging and transcription), searching, sharing and reporting on Customer Content |
| Types of personal data | Names, emails and roles of the Customer's users; likeness, voice and names of people appearing in creative (for example creators); identifiers in connected ad and store data |
| Data subjects | Customer's staff and contractors, creators and people featured in creative, the Customer's other invitees |
Fovea does not intend to process special categories of personal data. Customers should not upload such data.
3. Processor obligations
Fovea will:
- process personal data only on documented instructions, and tell the Customer if an instruction appears to break data protection law;
- ensure people authorised to process the data are bound by confidentiality;
- implement the security measures in section 6;
- assist the Customer, taking into account the nature of processing, with data subject requests, security, breach notification and impact assessments;
- notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content;
- delete or return personal data at the end of the service, unless law requires storage;
- make available information reasonably needed to demonstrate compliance with this DPA.
4. Subprocessors
The Customer authorises Fovea to use subprocessors. Fovea will impose data protection terms on each subprocessor that are no less protective than this DPA, and will give notice of new subprocessors so the Customer can object on reasonable grounds.
| Subprocessor | Purpose |
|---|---|
| Vercel | Hosting of the web application |
| Cloudflare | Media storage (R2), content delivery and image processing |
| Clerk | Authentication and organisation management |
| Stripe | Payments and billing |
| Resend | Transactional email |
| OpenRouter / Google (Gemini models) | AI analysis of creative |
| Mixpanel | Product analytics |
| Infrastructure provider (server hosting) | Application servers and database |
5. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference.
6. Security measures
- Logical isolation of each workspace's data, enforced on every request.
- Encryption in transit (HTTPS) and encryption at rest for connected-account tokens.
- Role-based access control inside each workspace, with revenue data protected by a separate permission.
- Public share links that expose only the shared creative, never performance data or internal fields.
- Restricted, logged administrative access to production systems.
- Regular backups of the application database.
7. Data subject requests
If Fovea receives a request from a data subject relating to Customer Content, it will forward the request to the Customer and will not respond directly except to confirm the forwarding, unless the Customer instructs otherwise.
8. Deletion
On termination, the Customer may export Customer Content during the grace period described in the Terms. Fovea will then delete Customer Content from production systems, with backups expiring on their normal rotation.
9. Order of precedence
If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.