Data Processing Addendum

This addendum applies where we process personal data on your behalf in providing Sable Mako to you. It is entered into between you, the customer named in the executed copy, and Champ X Digital FZ LLC, a company registered in the United Arab Emirates, which operates Sable Mako.

It takes effect on the date we countersign it and runs for as long as we process personal data on your behalf. Reading it on this page does not put it in force. If you need it in force, ask us for the executed copy.

Order of precedence

• On the protection of personal data, this addendum governs. Where it conflicts with our Terms of Service on how personal data is processed, secured, transferred, retained or deleted, this addendum wins.
• On everything commercial, the Terms govern and this addendum varies nothing. Fees, renewal, cancellation, refunds, service levels, liability and governing law are the Terms exactly as written. No clause below creates a payment obligation, a refund entitlement or a credit, and none is intended to be read as doing so.
• Our Privacy Policy stays the controller-facing notice. It describes what we do with the personal data we control in our own right. This addendum describes what we do with the personal data you control and we process for you. Where both describe the same processing, they are written to say the same thing, and a test in our codebase fails the build when the subprocessor lists stop matching.

A lawyer has not reviewed this clause. Does the precedence clause achieve what it is meant to, namely that this addendum controls data protection while leaving the Terms' commercial clauses untouched, and in particular that it cannot be read to create a refund entitlement that Terms section 8 denies? Separately: can a DPA published in full but not executed bind us by conduct, and should the page say so explicitly?

A lawyer has not reviewed this clause. Is the dual role over account identity described correctly, and is the split above the right one, rather than joint controllership? A European reviewer will test this row first, and it is the row a template gets wrong most often.

We use these terms with the meanings given in Article 4 of the EU General Data Protection Regulation, and we have not invented our own: personal data, processing, controller, processor, data subject, supervisory authority and personal data breach. Where an equivalent term in another applicable law means substantially the same thing, it is read the same way.

• Applicable data protection law means every data protection law that applies to our processing of personal data under this addendum, in the places you and your data subjects are.
• Customer personal data means personal data we process on your behalf under this addendum, as described in Annex I(B) at section 5.
• Subprocessor means a processor we engage to carry out processing activities on your behalf, listed in Annex III at section 8.

A lawyer has not reviewed this clause. Which laws should "applicable data protection law" name explicitly? Candidates are the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the UAE Personal Data Protection Law and the California privacy statutes. Naming the wrong set is worse than naming none, and the answer changes several clauses below.

We process customer personal data only on your documented instructions, including for transfers, unless a law we are subject to requires otherwise. Where that happens, we will tell you before we process, unless that law forbids us from telling you.

What counts as an instruction

• This addendum and our Terms of Service.
• Your use of the product: connecting an account, asking the assistant a question, running an audit.
• Every change you approve, which is the only way a change reaches an ad account.
• Every rule you save, which the agent then reads on every turn.
• A written request from the email address on your account, for example a deletion or a data-subject request.

We do not process customer personal data for our own purposes, we do not sell it, and we do not use it to train machine-learning models. There is no fine-tuning pipeline in the product and an accepted architecture decision record in our repository rejects one by name. What our model provider does with inputs sent through its API is governed by that provider's own terms, which our AI terms page links rather than characterises.

If we consider an instruction to infringe applicable data protection law, we will tell you without undue delay and may pause the processing concerned until it is resolved.

Categories of data subject

We connect to no customer data platform and no email service provider. We request no Meta pixel access, no Conversions API access, no page or post access, and no audience or targeting reads.

Categories of personal data, and where each one lives

Nature, purpose, frequency and duration

• Nature and purpose. To display your connected accounts, run the audit checks, run scheduled monitoring and send alerts, answer your questions through the assistant, propose changes for your approval, execute the changes you approve, verify them by reading the platform back, and to meter and bill your usage.
• Frequency. Continuous while you use the product, plus one automated metric read and one automated monitoring read per connected brand per local day. Both are picked up from 07:00 in the brand's own timezone. Neither makes a model call.
• Duration. For the life of your account, plus the deletion terms in section 11.

Everyone we allow to process customer personal data is bound by a duty of confidentiality, is given access only where operating the service requires it, and processes it only on your instructions.

Here is the part a template would not tell you. Sable Mako is operated by a one-person company. One person holds the administrator account at every provider in Annex III, and that person's access is the ultimate route to your data. There is no second administrator, no separation of duties, no second approver on a production change and no joiner-mover-leaver process, because there is nobody to join, move or leave.

• What that buys you. A short access list, no contractor with a database credential, no shared production login, and no credential of any kind committed to our source code. Application secrets live in the deployment environment.
• What it costs you. Every control that depends on two people is absent. If that is a blocker for your own compliance, tell us before you sign rather than after.
• Second factor on our administrator accounts. The application’s internal God View refuses every session that has not completed an enrolled second factor. Sensitive changes add a ten-minute freshness check, and the access review reports whether Clerk says a second factor is enrolled. This policy applies to God View, not to customer sign-in or each infrastructure provider’s console; ask us and we will give you the current position for each provider account in writing.
• Second factor on your sign-in. Your sign-in runs through Clerk and the factors available are the ones enabled in that provider’s configuration for our application. Our customer-access code neither requires a second factor nor reports one to your workspace, so the honest answer is that we do not control it and will tell you what is enabled when you ask.

What we have not built

You give us general authorisation to engage the subprocessors below. Each is bound by a written contract with data protection obligations no less protective than this addendum, and we remain liable to you for their performance.

Adding or replacing a subprocessor

• We will publish any new or replacement subprocessor on this page and email the data-protection notice address on your account at least 30 days before it starts processing customer personal data.
• If you object on reasonable data protection grounds within those 30 days, tell us in writing and we will try to offer a change that meets the objection.
• If we cannot, you may terminate the affected part of the service, or the whole of it, by telling us in writing before the new subprocessor starts processing.
• Termination under this clause is governed by section 8 of our Terms of Service, which this addendum does not vary. We are saying that plainly rather than promising you a refund here, because a refund promise in this document would contradict the Terms and leave you holding two agreements that disagree about your money. If you need a refund term for this scenario, ask for it in writing before you sign and we will answer in writing.

A lawyer has not reviewed this clause. With the refund removed, is a 30-day notice with an objection right and a right to terminate the affected part sufficient under Article 28(2) and (4)? If a customer's own template demands a refund on subprocessor objection, is agreeing to it in a signed copy the right answer, and does agreeing to it in one contract require changing the Terms?

• Data subject requests. Taking account of the nature of the processing, we will help you meet your obligations to data subjects exercising their rights of access, rectification, erasure, restriction, portability and objection. Forward the request to support@sablemako.com and we will respond within 30 days, which is the same period our privacy policy commits to. If a data subject contacts us directly, we will not answer them on your behalf; we will tell them to contact you, and tell you it happened.
• Impact assessments. We will give you the information in Annex II, and any further detail we hold, so you can carry out a data protection impact assessment or a prior consultation with a supervisory authority. Section 12 sets out the form that takes.
• Breach notification. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting customer personal data. The notification will describe what happened, the categories and approximate number of data subjects and records affected as far as we can tell, the likely consequences, and what we have done and are doing about it. Where we cannot give you all of that at once, we will send it in stages and say so.
• Deletion and return. Section 11.

A lawyer has not reviewed this clause. Is "without undue delay and in any event within 72 hours of becoming aware" the right commitment for a one-person company? Article 33(2) requires a processor to notify the controller without undue delay and sets no hour count, so the 72 hours is a commitment we are choosing to make. It should be confirmed as achievable before it is signed, given there is no on-call rota behind it.

If you are in the European Economic Area, the United Kingdom or Switzerland, using Sable Mako means personal data is transferred to the United States, which those jurisdictions do not treat as offering equivalent protection by default. We rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) as the transfer mechanism, together with the UK International Data Transfer Addendum for UK data and the Swiss addendum for Swiss data. Every subprocessor in Annex III is bound by the same clauses through its own data processing agreement with us.

Our own staff access from the United Arab Emirates is a different thing and we describe it differently. Standard Contractual Clauses are contracts between separate parties, so we do not claim them for our own staff. That access runs under our internal safeguards: limited to what operating the service requires, protected by the measures in Annex II, and treated exactly as if it took place inside the EEA.

This mirrors section 9 of our Privacy Policy deliberately, and a test in our codebase asserts that the privacy policy never claims the clauses cover our own staff. Where the executed copy of this addendum incorporates the clauses themselves, Annex I(B) at section 5, Annex II at section 7 and Annex III at section 8 populate their annexes.

A lawyer has not reviewed this clause. Which Standard Contractual Clauses module applies, and are the clauses the right mechanism at all? We are a UAE company processing on behalf of what may be an EU controller, on infrastructure in the United States. Module 2 and Module 3 do different things, and a non-EU processor's position under Article 3(2) is genuinely contested. Getting this wrong makes this whole section decorative. This is the single most valuable hour of advice on this page.

Deletion on request

• A solo workspace owner can open Settings → Your data, review the organisations, brands, stored records, files, active subscriptions and pending invitations in scope, type the exact confirmation phrase and request full account closure. Shared workspaces, logins that also belong to someone else’s workspace, incomplete previews and platform writes still in flight are refused rather than erased. Email support@sablemako.com from the address on the account for those cases. We complete deletion and any necessary follow-up within 30 days.
• Disconnecting a platform immediately destroys our stored credential and stops new reads. It does not automatically delete metrics already imported, chat history, or approval and action receipts. Those records remain in the workspace until full account deletion so past recommendations and changes stay explainable.
• The owner confirms a server-derived preview. The product installs a closure fence and recounts the scope before anything irreversible, so a workspace change that raced the review requires a fresh confirmation. A table that cannot be counted reports as incomplete rather than as empty.
• Order matters and it is fixed in code. Any live subscription is cancelled first, because a failed cancellation on a deleted account would keep charging you. Stored creative files come next, then the live database records, and the sign-in identity goes last. Each completed stage is retained so a retry resumes safely rather than repeating the workflow from the beginning.
• What survives, and why. Our payment webhook ledger keeps the event id and type with your organisation id removed. It holds no personal data once unlinked, and it is what stops a redelivered payment event being processed a second time. A minimal closure record keeps the sign-in identity, aggregate counts, stage and timestamps for no longer than 30 days so delayed identity traffic cannot recreate an erased workspace and unfinished cleanup remains visible. It contains no email, organisation or platform identifier, credential, metric or message content and is then purged automatically. Stripe may retain billing records under its own legal obligations.
• What we cannot do for you. We cannot revoke the grant at Meta, Google or Shopify. Do that from Google Account permissions, your Meta business integration settings, or the apps page of your Shopify admin. Revoking there stops all further fetching immediately and makes our stored credential useless. Section 10 of our Privacy Policy has the steps.

If you cancel and never ask

There is no age-based purge for customer workspace content, so cancelling a subscription stops scheduled service but deletes no workspace data: it stays until you ask us to erase it. Short-lived rate-limit counters and the minimal closure progress record have bounded cleanup, but they are not a retention policy for customer content. If a maximum workspace-content retention period matters to you, ask for one in writing before you sign and we will answer in writing.

Retention at our providers

We configure no log or backup retention beyond the defaults our hosting and database providers publish. Vercel decides how long its runtime logs are kept, and publishes it: Vercel runtime logs. Neon decides how long its automated backup history is kept, and publishes it: Neon point-in-time restore.

Getting a copy

A workspace owner can download a machine-readable JSON file from Settings containing the account record and database records for organisations the login owns. The endpoint derives organisation and brand scope from the authenticated owner, reads one point-in-time database snapshot, and removes provider credentials, invitation authenticators, private storage locations and delete handles before rows leave the database. The browser path is limited to 20 MiB and three attempts in 24 hours. Stored creative metadata is included; larger bundles and creative file bytes are supplied separately through an access-controlled support process. Member-specific requests are also reviewed by support because chat messages are not author-attributed today. The final format and delivery timeline for an assisted package are agreed with you in that exchange. If you need a specific format or deadline written into this addendum before you sign, say so and we will agree it in writing.

At the end of our provision of the service, we delete or return customer personal data at your choice, unless a law we are subject to requires us to keep it.

On written request, once in any twelve-month period, we will complete a security questionnaire and give you the information in Annex II in whatever detail you need to satisfy your own obligations. We hold no SOC 2 report and no ISO certificate to offer in place of it, and we will not claim one is in progress.

Where applicable data protection law or a supervisory authority requires an inspection that a questionnaire cannot satisfy, we will cooperate with it: on 30 days' written notice, during business hours, at your cost, subject to confidentiality, no more than once in any twelve-month period unless a law or an authority requires otherwise, and conducted so that it does not compromise the data of our other customers.

A lawyer has not reviewed this clause. Is the questionnaire-first narrowing above acceptable to the enterprise customers we would be signing with, and is it consistent with Article 28(3)(h)? A customer's own template usually asks for on-site audits on short notice, which is unperformable for a company with no office. The standard narrowing language a lawyer supplies is cheaper than negotiating this clause once per customer.

• Term. This addendum takes effect when we countersign it and continues for as long as we process customer personal data on your behalf. Clauses that by their nature should survive it do.
• Liability. Our liability under this addendum is subject to the limitation of liability in section 10 of our Terms of Service, which caps our total liability at the fees you paid us in the 12 months before the event giving rise to the claim. This addendum does not raise that cap and does not create a separate one.
• Your data remains yours. You keep every right in the data we fetch from your connected platforms and in the content you submit. Disconnecting ends our authorization to fetch new data. Our limited licence for history already stored continues only to preserve it, show it to you, answer your requests, and delete it under the Privacy Policy; it ends when that stored data is deleted. That is section 12 of the Terms, restated rather than extended.
• Governing law. The laws of the United Arab Emirates, and the courts of the United Arab Emirates, exactly as section 15 of the Terms provides. Mandatory requirements of applicable data protection law apply regardless of that choice.

A lawyer has not reviewed this clause. Two questions, and they are the two with real money behind them. First: should a DPA inherit the main agreement's 12-month cap, or should data protection claims be carved out of it? This is the single clause on the page with unbounded downside for a one-person company, and a customer's redline will target it. Second: how does a UAE governing-law clause interact with the mandatory Article 28 terms a European customer's counsel will insist on, and what is the one-paragraph answer to give them?

Email support@sablemako.com from the address on your account with your legal entity name, your registered address, the name and title of your signatory, and the email address you want data-protection notices sent to. We return a countersigned PDF of this text, unchanged unless we have agreed changes in writing.

If your own template has to be the paper, send it and we will read it. We will tell you which clauses we can sign as they stand, which we would want to change, and which we cannot perform. A clause we cannot perform gets said out loud before signature rather than discovered at the first incident.