Data Processing Addendum (DPA)

This Data Processing Addendum (the "DPA") forms part of the agreement between the creator (the "Controller") and Marea Kiss LLC, operating Clonify (the "Processor"), and reflects the parties' obligations under article 28 of Regulation (EU) 2016/679 (GDPR). It is accepted when the Clonify account is created and applies from the first processing, including during a trial or on a free plan.

Article 1. Definitions

• Controller: the creator using Clonify, on a trial, free or paid plan, who determines the purposes and means of processing personal data of their visitors.
• Processor: Marea Kiss LLC, operating the Clonify service on behalf of the Controller.
• Data subject: any visitor to a clone published by the Controller.

Article 2. Subject matter and duration

The Processor processes personal data of the Controller's visitors solely to provide the Clonify service. This DPA remains in force as long as the Processor processes personal data on behalf of the Controller.

Article 3. Nature and purpose

Operating an AI clone of the Controller: storing uploaded content, transcribing audio/video, generating embeddings, running language models to produce replies, maintaining visitor sessions, building per-visitor memory profile, and providing analytics.

When the creator enables Meta Lead Ads, import submissions from the forms they select, create or update their contacts and display their answers and source in the CRM.

Article 4. Types of personal data and data subjects

Data subjects: visitors of the Controller's clone and people who submit the Meta Lead Ads forms selected by the Controller when that connection is enabled. Categories processed:

• Email address and optional name.
• Conversation transcripts with the clone.
• AI-derived memory profile.
• IP address, user agent, session cookies.
• Timestamp of acceptance of visitor terms.
• With Meta Lead Ads enabled: name, email, phone number, answers to form questions, submission date and source information about the Page, form, campaign, ad set, ad and platform provided by Meta.
• Messages exchanged with the clone on WhatsApp, Instagram or Discord, when the Controller connects those channels.
• Bookings and, when the Controller records a meeting, the recording and its transcript.
• Exam answers, grades and, if supervision is on, browser incidents.

Special categories of data (art. 9 GDPR) are not intentionally processed, with one exception the Controller decides on. If the Controller requires identity verification in an exam, Stripe compares the student's face with their ID document, which is biometric data. In that case the Processor only starts the verification after collecting the student's explicit consent on screen (art. 9.2.a GDPR), and keeps only the result and the verified name. The Controller decides whether to require it and must assess whether it needs a data protection impact assessment, with the Processor's assistance. The Controller must not configure the clone to elicit other special-category data.

Article 5. Rights and obligations of the Controller

• Provide lawful instructions; configuring the clone via the admin panel counts as documented instructions.
• Ensure a valid legal basis for the processing of visitors' data.
• Publish its own privacy notice when the clone is embedded on the Controller's own domain.
• Respond to data subject requests within legal deadlines.

Article 6. Obligations of the Processor

• Process personal data only on documented instructions.
• Ensure persons authorised to process the data are under confidentiality obligations.
• Implement the security measures described in Article 9.
• Engage sub-processors as described in Article 7.
• Notify the Controller of any personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available at that point (nature of the breach, categories and approximate number of data subjects and records affected, likely consequences and measures taken), completed as more becomes known.
• Assist the Controller in complying with articles 32-36 GDPR.

Article 7. Sub-processors

The Controller authorises the Processor to engage the following sub-processors, each bound by a written agreement imposing data protection obligations equivalent to this DPA:

The Processor will give the Controller at least 30 days' prior notice of any addition or replacement. The Controller may object on reasonable data protection grounds; if no agreement is reached, either party may terminate the affected portion.

Article 8. Data subject rights

Where a visitor exercises rights directly with the Processor, the Processor will forward the request to the Controller without undue delay and assist in fulfilling it. Direct visitor deletion requests addressed to privacy@clonify.com are processed by the Processor immediately.

Article 9. Security measures

• Multi-tenant isolation in the application layer via queryWithTenant primitive, complemented by lint rules.
• Encryption at rest provided by Neon (database) and Cloudflare R2 (file storage).
• Encryption in transit (TLS 1.2+) on every public endpoint.
• Rate limiting on sensitive endpoints (auth, OTP, chat) via Upstash.
• CORS pinning to authorised origins for the embeddable widget.
• OTP-based authentication for visitor identification.
• Role-based access control inside the admin panel.

Article 10. International transfers

The Processor is established in the United States, and the main database and application hosting are located in the US (Virginia). Several sub-processors are also located in the United States. Such transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914) and, where the recipient is self-certified, by the EU-US Data Privacy Framework.

Article 11. Artificial intelligence

• The Processor does not use personal data processed on behalf of the Controller to train AI models, its own or third parties', nor to improve the clone of another creator.
• The language models that generate replies are used through their API, under terms in which the provider does not use that data to train its models.
• The clone introduces itself to visitors as an AI on every channel (article 50 of Regulation (EU) 2024/1689). The Controller must not hide or remove that disclosure.

Article 12. Termination — return or deletion

On termination, the Processor applies a Shopify-style soft-delete schedule:

• Workspace enters "suspended" state for 90 days; Controller can export data and reactivate.
• After 90 days: visitor personal data permanently deleted.
• Minimal tenant skeleton (billing/fiscal records) kept 4 years for Spanish fiscal obligations.
• The Controller may request immediate deletion of all visitor data at any time.

Article 13. Audit rights

The Controller may audit the Processor's compliance with this DPA up to once per calendar year, on at least 30 days' written notice, during business hours and without unduly disrupting operations. The Processor may satisfy audit requests by providing existing certifications, attestations or written summaries of controls. Additional audits triggered by a documented breach or by a supervisory authority's binding instruction are allowed beyond the annual cap.

Clonify Studio

If the Controller uses Clonify Studio, this DPA covers the third-party personal data the Processor handles on its behalf: what it uploads to its Clonify account and what it sends through the tools paid with credits. In those tools, which are optional, the Processor forwards the request to the provider without keeping its content. In addition to the sub-processors in Article 7, Google LLC (images) and Features & Labels, Inc. (fal.ai, video and audio clean-up) are involved, only when the Controller uses them.

It does not cover what stays on the Controller's computer or what it sends to the AI it connects with its own account or keys, such as Anthropic or OpenAI. In those cases it contracts directly with that provider and decides what data to share. Details are in section A.10 of the Privacy Policy.

Acceptance

This DPA is accepted when the Clonify account is created and applies from the first processing, including during a trial or on a free plan. The most recent published version applies. Material amendments will be notified by email with at least 30 days' prior notice when reasonably possible.

Governing law

This DPA is governed by Spanish law and, as regards data protection, by the GDPR, without prejudice to any mandatory rules that apply to the Controller.