Data processing agreement
This data processing agreement ("DPA") is between the customer that accepts it ("you", the controller) and Programmable, LLC, 3607 10th St NW, Washington, DC 20010, United States ("we", the processor). It forms part of the Terms of service and applies whenever we process personal data on your behalf while providing Programmable. To accept it, email [email protected] from your account's address with your company name; we'll countersign and return a copy. It applies from that date, and to processing that has already taken place under your account.
1. What we process for you
- Subject matter and purpose: turning the briefs, source text, screenshots, images and frames you provide into animations, storyboards and exports; keeping your projects, team and marketplace listings; delivering what you make where you ask (downloads, embeds, shares).
- Personal data: whatever the material you upload or import contains (people in screenshots, names in source text, customer details in a brief), your team members' names and emails, and the contact details of people who respond to your shared pages. No special categories (health, religion, politics and the like) and no data about children, unless the law allows it and you have the safeguards it requires.
- Data subjects: your staff and team members, your customers and prospects, and the people who appear in the material you bring.
- Duration: the life of your projects and account; deleted within 30 days of deletion or of closing your account, except billing records kept as tax law requires.
2. Our obligations as processor
- We process personal data only on your documented instructions, which are the Terms, this DPA, and what you ask the service to do (including the AI features you use and the connections you make). We'll tell you if we think an instruction breaks the law.
- We keep the personal data we process for you confidential, and everyone who works on the service is bound by confidentiality.
- We keep the security measures in section 5, and won't reduce them during the term.
- We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the service allows; you can export and delete your projects yourself.
- We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we're doing.
- On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it.
- We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.
3. Your obligations as controller
You are responsible for having a lawful basis for the personal data in the material you bring, for the rights and permissions needed to use it (including the people shown in it), for the AI providers and keys you choose to use with it, for honouring the rights of the people concerned, and for what you publish or share. You warrant that your instructions to us are lawful.
4. Subprocessors
You authorise the subprocessors below. We'll email account owners at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can't resolve it, end the affected service.
| Subprocessor | Purpose | What they receive |
|---|---|---|
| Anthropic | AI writing, research, storyboards, code generation and quality review (Claude models) | Prompts, briefs, imported source text, screenshots and rendered frames sent for review |
| OpenAI | Back-up AI writing and review when Claude is unavailable, AI-generated character artwork and style images, and text-to-speech voiceover for exports | Prompts, briefs, source text and rendered frames (when used as the back-up), character descriptions, reference images and the caption text read aloud |
| Google (Gemini API) | Back-up AI writing and review when Claude and OpenAI are unavailable, and optional video generation features | Prompts, briefs, source text and rendered frames (when used as the back-up), and reference frames |
| Google (Sign in with Google) | Optional sign-in with a Google account | Name, email address, its verification status and a Google account identifier, received from Google when you choose to sign in this way |
| Stripe | Payments, subscriptions and invoices | Billing details and payment information (card data is handled by Stripe, not stored by us) |
| Resend | Account and notification email | Email address and message content |
| OVHcloud | Hosting the service, its database and our sign-in service (servers in Virginia, United States) | All data stored in the service |
| Cloudflare | DNS, TLS and protection in front of the service | Request metadata such as IP addresses and pages requested |
| Backblaze | Storing uploaded images and encrypted database backups | Uploaded screenshots and images; backup copies of stored data |
| Figma (only when you connect it) | Importing frames you choose from your Figma files | Your Figma access token and the frames you import |
| Firecrawl (optional) | Enhanced reading of websites you ask us to import, when enabled | Website addresses you submit |
| Wikimedia Commons and other public sources | Finding openly licensed images and research sources | Search terms derived from your brief (no account data) |
An AI provider key you add yourself (Anthropic, OpenAI or Google) is used from your browser under your own agreement with that provider and is not a subprocessor relationship with us.
5. Security measures
- Encryption in transit everywhere (TLS, with Cloudflare in front of our servers); connected-service tokens and backups encrypted at rest; integration keys stored as hashes.
- Per-account access controls on every record; salted password hashing for accounts that use a password.
- Every generated animation runs in a sandbox isolated from our site and yours.
- Production servers run in a hardened container with no shell access from the web; only named staff can reach them, by key.
- Rate limiting on the APIs; error reports with personal data removed before they leave the server.
6. Where data is processed
The service and its database are hosted in the United States (OVHcloud, Virginia); backups are stored in the United States (Backblaze); our subprocessors are listed in section 4. Where you are established in the EU, the EEA or the UK, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.
7. General
If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 6 says otherwise. Questions: [email protected].