data processing addendum
last updated february 16, 2026
scope
this DPA applies where we process personal data on behalf of a customer acting as controller under GDPR Art 28
processing details
subject matter: provision of me, and services
duration: for the term of service provision
categories: account metadata, memory data, media references, support data
obligations
- process only documented instructions
- confidentiality and access controls
- security controls appropriate to risk
- subprocessor controls and flow-down terms
- assistance with data subject rights and breach notifications
subprocessors
core infrastructure may include Apple platform services and Cloudflare hosting/delivery services
transfers
where required, transfers are covered by appropriate safeguards including SCCs as applicable