Data Processing Agreement

This agreement forms part of the Terms of Service between PersonaFix Pte Ltd ("we") and a customer that uses the service for its business ("you"). It applies when you give us personal data about other people through the service, for example product photos or advertisements that show people. It does not apply to an account you use for yourself; the Privacy Policy covers that.

1. Roles

You decide why and how that personal data is used. We process it for you. Under Singapore's Personal Data Protection Act 2012 we are your data intermediary; under the GDPR, where it applies, you are the controller and we are your processor.

2. Your instructions

We process the data only to provide the service you use and as these terms and your settings direct. If we think an instruction breaks data protection law, we will tell you.

3. Your responsibilities

You confirm that you have a lawful basis for giving us the data, that you have told the people concerned what you need to tell them, and that you have any consent the law requires. You will not give us other sensitive data, such as health data, government identity numbers or data about anyone under 18. Photos, video and audio of real people are covered by Terms section 1 and our Biometric Privacy Notice.

4. Security

We protect the data with the measures on our Security page. Staff and contractors who can reach it are bound to keep it confidential. We may improve these measures but will not reduce the overall protection.

5. Breaches

If we become aware of a breach affecting your data, we will tell you without undue delay, and in any case within 48 hours, with what we know, what we have done and what you may need to do. We will help you meet any duty you have to notify a regulator or the people affected.

6. Sub-processors

You allow us to use the providers listed in our Privacy Policy, section 4. Each is bound by a written agreement with data protection duties. We remain responsible for them. We will email you at least 15 days before adding or replacing a provider. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account and we will return the unused part of any paid period.

7. Model training

We do not use your data to train or improve any AI model. The providers we use for generation have told us they do not train on data sent through their APIs, as described in our Privacy Policy. One legacy provider, PiAPI, gives no such commitment; it is not offered in the product and serves only storyboards saved before 30 August 2026.

8. Transfers

The database and application run in Singapore. Some providers process data in the United States or elsewhere. For data protected by the GDPR or UK GDPR, those transfers rely on the European Commission's Standard Contractual Clauses and the UK Addendum in our providers' agreements. For data protected by the PDPA, we ensure the recipient gives a comparable standard of protection. Ask Support for a copy of what is relied on.

9. Requests from individuals

If someone asks us to exercise their rights over data you gave us, we will pass the request to you and not answer it ourselves unless the law requires it. Your account's export and deletion tools let you answer most requests yourself; we will help with the rest.

10. Audits

Once a year, or when a regulator requires it, we will answer reasonable written questions about how we comply with this agreement. On-site audits need our agreement and reasonable notice.

11. Deletion

When you delete an item, a product or your account, we delete the related data as the Privacy Policy describes, except records the law requires us to keep. Export your data before you close your account; after closing, we cannot return it.

12. Liability and conflict

The limits of liability in the Terms of Service apply to this agreement. If this agreement and the Terms of Service conflict about personal data, this agreement wins.