Data Processing Addendum

Effective Date: 2026-10-24 Version: 1.0

This Data Processing Addendum ("DPA") explains, in plain words, how Ecliptio Ltd processes personal data on behalf of its business customers when they use Ecliptio Studio. It is the contract required by Article 28 of the EU General Data Protection Regulation (GDPR).

1. Who this DPA applies to

1.1 This DPA applies when a business, an organisation or a professional (the "Customer") uses Ecliptio Studio (the "Platform") to process personal data for which the Customer is the controller, or for which the Customer is itself a processor on behalf of its own clients. In this DPA, "Ecliptio", "we" and "us" mean Ecliptio Ltd, a company registered in Malta (Company Registration Number C111698), Northlink Business Centre Level 2, Triq Burmarrad, Naxxar, NXR 6345, Malta.

1.2 This DPA forms part of our Terms of Service and applies automatically to every Workspace of a business Customer, without any further step. If the Customer wants a copy signed by both parties, it can ask for one at privacy@eclipt.io.

1.3 "Customer Personal Data" means the personal data contained in the content that the Customer and its team upload, generate, receive or store in its Workspaces: for example the details of its own customers and contacts, the messages in its mailboxes, the comments on its connected social profiles, the people in its photos, and the data of the websites and apps it builds and hosts on the Platform. Words such as "controller", "processor", "personal data breach" and "data subject" have the meaning given to them by the GDPR.

1.4 This DPA does not cover the data that Ecliptio processes as a controller to run its own business, such as the accounts of the people who sign in, billing, security logs and the Platform's own analytics. That processing is described in our Privacy Policy.

1.5 If this DPA and the Terms of Service say different things about Customer Personal Data, this DPA prevails.

2. Roles

2.1 The Customer is the controller of Customer Personal Data (or a processor acting for its own clients) and Ecliptio is its processor (or sub-processor).

2.2 The Customer decides why and how Customer Personal Data is processed and is responsible for having a lawful basis for it, for informing the people concerned, and for obtaining any consent that is needed. In particular, before switching on «People in photos» for a project, the Customer must have the explicit consent of the people to be recognised (GDPR Article 9(2)(a)), because the face fingerprints computed by this feature are biometric data.

3. What we process, and why

3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I.

3.2 We process Customer Personal Data only on the Customer's documented instructions. The Customer's instructions are: the Terms of Service, this DPA, and the way the Customer and its team set up and use the Platform (for example the features they switch on, the AI configuration they choose, the accounts they connect and the content they ask the assistant to work on). We tell the Customer if, in our opinion, an instruction breaks the GDPR or other data protection law.

3.3 We may process Customer Personal Data without an instruction only where the law of the EU or of an EU member state requires us to. In that case we tell the Customer before we do it, unless that law forbids us to.

3.4 We do not sell Customer Personal Data, we do not use it for advertising, we do not use the content of one customer for another customer, and the models we run ourselves are not trained on it. What our external AI providers may do is described in Section 6.4.

4. Confidentiality

4.1 Only people who need access to provide, maintain and repair the Platform can access Customer Personal Data, and they are bound by an obligation of confidentiality.

4.2 Our staff access the content of a Workspace only where necessary to provide support that the Customer asked for, to run, maintain and repair the Platform and the work the Customer asked us to do, to investigate abuse or a security problem, or where the law requires it. For support, an authorised staff member can sign in to an account as its user, for up to 8 hours at a time; each such access is recorded with the staff member's email address. While signed in as a user, staff cannot download data or delete a Workspace or an account.

4.3 When our staff use an AI assistant for this work, the AI providers listed in Annex III can receive the data it reads.

5. Security

5.1 We apply the technical and organisational measures described in Annex II. They describe the Platform as it is today, including what is not yet in place, so that the Customer can judge whether they are appropriate for its data.

5.2 We may change these measures over time, but not in a way that lowers the overall level of protection. We publish the current version of Annex II on this page.

6. Sub-processors

6.1 The Customer gives us a general authorisation to use the sub-processors listed in Annex III. They are the same services listed in Section 5.1 of our Privacy Policy. Which ones receive a Customer's data depends on the features and AI configuration that the Customer uses.

6.2 Services that the Customer chooses and connects itself (its own AI keys or subscriptions, its own storage, its own servers or inference endpoints, its own accounts on other services) are not our sub-processors: we pass data to them only on the Customer's instruction, and the Customer's relationship with them is governed by their terms.

6.3 Before we add or replace a sub-processor, we update Annex III on this page and tell the owner of each Workspace of a business Customer by email, at least 14 days before the change applies to their data. The Customer can object in writing to privacy@eclipt.io within that period, giving its reasons. We will then try in good faith to find a solution, for example by not using that sub-processor for the Customer's Workspace. If we cannot find one, the Customer can stop using the affected feature or end its subscription, without any penalty.

6.4 Each sub-processor processes the data under its own terms and privacy policy, and we remain responsible to the Customer for its work. This is what we know about uses of the data that go beyond providing the service:

• AI providers handle the requests they receive under their own terms, which can allow them to keep requests for a limited time, to review them for safety and to use what such a review flags, including to improve their models. Through OpenRouter, with Ecliptio's account, only providers that do not use the data to train their models are used.
• Exa (web search) states in its privacy policy that it may use search queries to improve its services, including to train its models, and Runware's terms do not state whether it may use generation prompts for training.

7. International transfers

7.1 Customer Personal Data is stored and processed mainly in the European Union (Germany and Italy) and on Ecliptio's own machines in Malta (Annex I). Some sub-processors are in, or reach the data from, countries outside the European Economic Area, as shown in Annex III.

7.2 Where such a transfer takes place, it relies on the basis shown for that sub-processor in Annex III: the EU Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision (EU) 2021/914), the EU-US Data Privacy Framework, or an adequacy decision. Where Annex III shows no transfer basis, the transfer takes place under the provider's own terms.

7.3 If the Customer is established outside the EEA and the law requires it, the SCCs (Module 4, processor to controller) apply between the Customer and Ecliptio and are incorporated into this DPA by reference.

8. Helping the Customer with the rights of data subjects

8.1 The Platform lets the Customer answer most requests itself:

• Access and portability: the owner and the admins of a Workspace can download all its data at any time, in Workspace settings › Workspace data, as a ZIP archive in open formats (JSON, CSV, Markdown and the original files). Each person can also download their own data from their profile. Archives can be downloaded for 7 days; passwords, keys and access tokens appear only by name, never by value.
• Rectification: content can be changed directly in the Platform.
• Erasure: content can be deleted directly in the Platform; the owner can delete a whole Workspace in its settings, and each person can delete their own account in their profile. A deletion of a Workspace or an account takes place 30 days after the request, and can be cancelled until then. Deleted data can remain in our encrypted backups until they expire (Section 11).

8.2 For anything the Customer cannot do itself, we help it within a reasonable time when it writes to privacy@eclipt.io, so that it can answer the data subject within the time limits of the GDPR.

8.3 If a data subject contacts us directly about Customer Personal Data, we pass the request on to the Customer without undue delay and do not answer it ourselves, except to tell the person that we have passed it on, unless the Customer asks us to.

9. Other help we give the Customer

Taking into account the nature of the processing and the information available to us, we help the Customer with its obligations on security, on notifying personal data breaches, on data protection impact assessments and on prior consultation with a supervisory authority (GDPR Articles 32 to 36), mainly by giving it the information in this DPA and by answering its reasonable questions.

10. Personal data breaches

10.1 If we become aware of a personal data breach affecting Customer Personal Data, we tell the Customer without undue delay, by email to the owner of each affected Workspace.

10.2 We tell the Customer, as far as we know it at that time: what happened; the categories and the approximate number of people and records concerned; the likely consequences; what we have done or will do to deal with the breach and to limit its effects; and who the Customer can contact for more information. Where we cannot give all this information at once, we give it in steps as soon as we have it.

10.3 Telling the Customer about a breach is not an admission of fault or liability.

11. Deletion and return at the end

11.1 The Customer can download all the data of its Workspaces at any time (Section 8.1), including before ending its subscription or deleting a Workspace.

11.2 When the Customer deletes a Workspace, or asks us to delete it at the end of its use of the Platform, we delete Customer Personal Data as described in Section 6 of our Privacy Policy: the deletion takes place 30 days after the request, and then everything that belongs to the Workspace is deleted together, including its files and their older versions, the websites and apps we host for it with their databases, its conversations, documents, memories, connections and mailboxes.

11.3 Two exceptions apply. Deleted data can remain in our encrypted nightly backups until the backups that contain it expire, within about 6 months; and it can remain in one-off copies that we make before some maintenance work, until we delete them. We do not use these copies for any other purpose than restoring the Platform after a failure. Data that the law requires us to keep, such as invoices, is kept for the period the law requires.

12. Information and audits

12.1 We make available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR: this DPA, its annexes, and answers to the Customer's reasonable written questions, including a security questionnaire once a year.

12.2 Where this information is not enough, or where a supervisory authority requires it, the Customer can audit our compliance with this DPA, itself or through an independent auditor bound by confidentiality. The Customer gives us at least 30 days' notice, the audit takes place during business hours, at most once every 12 months (unless after a personal data breach or at the request of a supervisory authority), at the Customer's cost, and in a way that does not expose the data of our other customers or the security of the Platform.

12.3 Ecliptio does not hold security certifications (for example ISO 27001 or SOC 2) today.

13. Liability, duration and changes

13.1 Each party's liability under this DPA is governed by the limitation of liability in the Terms of Service, to the extent the law allows.

13.2 This DPA applies for as long as we process Customer Personal Data, including during the deletion period and until the backups that contain it expire.

13.3 We may update this DPA, for example to reflect new features or changes required by law. We publish the new version on this page with its date and tell the owner of each Workspace of a business Customer by email before material changes take effect; changes to the sub-processors follow Section 6.3.

13.4 This DPA is governed by the laws of Malta, and the courts of Malta have jurisdiction, without affecting the rights of data subjects or the powers of supervisory authorities. Our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), Malta.

13.5 Contact for anything about this DPA: privacy@eclipt.io.

Annex I — Details of the processing

Subject matter. Providing Ecliptio Studio to the Customer: a platform where a business works with AI assistants to create and manage its content, websites, apps, documents, images, videos, campaigns, mailboxes and social profiles.

Duration. For as long as the Customer uses the Platform, then until the deletion described in Section 11 (30 days after the request, and until the backups that contain the data expire, within about 6 months).

Nature of the processing. Hosting and storage; transmission; organisation and retrieval; AI processing at the Customer's request (writing, analysis, classification, translation, summarising, image and video generation, the search index of a project's content, and, only where the Customer switches on «People in photos», face fingerprints); sending and receiving emails; publishing to and reading from the services the Customer connects; hosting the websites and apps the Customer builds, with their databases; sending notifications; backups; and deletion.

Purpose. To provide the Platform and the work the Customer asks for, as described in the Terms of Service and in our Privacy Policy, and to keep the Platform secure and working.

Categories of data subjects.

• The Customer's team: the members of its Workspaces.
• The Customer's own customers, prospects, suppliers and other contacts.
• People who write to the Customer's mailboxes, or receive its emails and newsletters.
• People who comment on, or reply to, the Customer's posts on the services it connects (for example Facebook, Instagram, Threads, YouTube, LinkedIn), and the profiles it analyses.
• Visitors and users of the websites and apps that the Customer builds and hosts on the Platform.
• People who appear in the Customer's photos, videos and documents.

Types of personal data.

• Identification and contact details (for example names, email addresses, phone numbers, postal addresses, company names).
• The content of messages, comments, documents, conversations with the assistant, and other files.
• Images and videos, and, only with «People in photos» switched on, face fingerprints and the names that the Customer's team gives to them (biometric data).
• The public profile details and the comments received from connected services.
• The data that the Customer's websites and apps collect from their users, as decided by the Customer.
• Technical data about the visitors of the hosted websites and apps, such as IP addresses in server logs and, where the Customer uses A/B tests or trackable QR codes, the events of a visit.

Special categories of data. None are needed to use the Platform. Face fingerprints are processed only for projects where the Customer switches on «People in photos» (Section 2.2). Any other special category data is present only if the Customer chooses to upload it, under its own responsibility.

Frequency. Continuous, for as long as the Customer uses the Platform.

Where the data is processed.

• Germany: Hetzner servers (the Platform, its database, some files, the search index, the face fingerprints, the drawing of diagrams, our own web-search relay and the data downloads).
• Malta: computing machines owned by Ecliptio (by default the assistant's chat, the memory the assistant keeps of a project's work, and recognising the language of a message). They are connected to our servers in Germany over an encrypted private network.
• Italy: Wasabi, Milan (media and project files).
• Germany: Wasabi, Frankfurt (the encrypted nightly backup).
• Other countries: only when a task uses a sub-processor of Annex III located there.

Retention. As described in Section 6 of our Privacy Policy and in Section 11 of this DPA.

Annex II — Technical and organisational security measures

This annex describes the measures as they are today.

Encryption

• In transit: public connections use TLS 1.2 or higher (TLS 1.0 and 1.1 are refused). Connections between our servers in Germany and our machines in Malta travel over an encrypted private network.
• At rest: files stored with Wasabi are encrypted (AES-256). The nightly backup is encrypted (AES-256) before it leaves our servers.
• Not encrypted at rest: the Platform's main database and the files kept on our Hetzner servers. They are protected by the access controls below.
• Passwords are stored only as bcrypt hashes. AI provider keys are encrypted with AES-256-GCM before they are stored. The access tokens of connected services and the secrets of projects are stored encrypted; the Platform decrypts them on the server when it needs to use them.

Access control

• Every item of Customer Data is tagged with its Workspace in the database, and the application gives access to it only to the members of that Workspace, according to their role (owner, admin, member). A conversation can use only the projects of its own Workspace.
• Staff access is limited to what is necessary (Section 4). Each staff sign-in as a user is recorded.
• Administrative access to our servers is limited to Ecliptio's administrators and uses SSH keys; password login is disabled.
• The database and the internal services of the Platform (AI models, search index, face fingerprints, diagram drawing, web-search relay) accept connections only from our own servers or our private network.
• Repeated login and password-reset attempts are limited, and new accounts are asked to verify their email address.

Availability and recovery

• An encrypted backup of the Platform's databases and server files is made every night and stored with Wasabi in Frankfurt. Backups are kept for 7 days, 4 weeks and 6 months (daily, weekly and monthly copies), and part of their data is checked for integrity after each nightly run.
• Media and project files stored with Wasabi keep their older versions, so that a file deleted or overwritten by mistake can be recovered.

Deletion

• Workspaces and accounts can be deleted by the Customer and its team themselves (Section 8.1). The deletion is carried out automatically after 30 days; if any part cannot be deleted, nothing is deleted from the database, the deletion is retried every hour and our staff is alerted. A record of each deletion is kept, without its content and without names or email addresses.

Records

• Data downloads, deletion requests and staff access to accounts are recorded. Web server access logs are overwritten within a few days.

Development and suppliers

• The Platform's code and the software it depends on are reviewed for security problems. Changes are tested on a separate copy of the Platform before they go live.
• AI requests sent through OpenRouter with Ecliptio's account go only to providers that, according to OpenRouter, do not use the data to train their models.

People

• Everyone who works on the Platform is bound by confidentiality. Ecliptio is a small company: the people with access to Customer Personal Data are few and known by name.

Not in place today

• Encryption at rest of the main database and of the files on our Hetzner servers.
• Security certifications (for example ISO 27001 or SOC 2).

Annex III — Sub-processors

The same services listed in Section 5.1 of our Privacy Policy. Which ones receive a Customer's data depends on the features and the AI configuration that it uses.

1. Anthropic (USA) — AI inference, when a task uses a Claude model, for example writing code. Receives the prompt and the conversation context, which can include data read from connected accounts. For these tasks the Customer can also connect an AI subscription of its own or have them done by the models that Ecliptio runs itself.
2. OpenAI (USA) — AI inference, when a task uses an OpenAI model, for example writing code. Receives the prompt and the conversation context. Here too the Customer can connect an AI subscription of its own or use the models that Ecliptio runs itself.
3. OpenRouter (USA) — AI router, when the model used for a task is reached through OpenRouter; it passes the request to a company that runs the chosen model (the model's maker, for example OpenAI, Google or DeepSeek, or a hosting company), in the USA or in other countries. With Ecliptio's account, only providers that do not use the data to train their models are used. Transfer basis: SCCs.
4. Exa Labs (USA) — web search, when the assistant searches the web for a task. Receives the search query written by the assistant, which may contain words from the Customer's request. Exa states that it may use search queries to improve its services, including to train its models. Transfer basis: none in place beyond the provider's own terms.
5. Runware (United Kingdom; services hosted in the USA, Germany and Romania) — image and video generation with Ecliptio's account; for some models it passes the request to the model's maker (for example OpenAI). Receives the prompt and any reference images. Its terms do not state whether prompts may be used to train models. Transfer basis: none stated beyond the provider's own terms.
6. Pixabay (Germany) — stock image search, when the assistant looks for photos for a task. Receives the search query written by the assistant. EU, no transfer.
7. Stripe (USA) — payment processing for the Customer's subscription. Receives payment details. Transfer basis: EU-US Data Privacy Framework and SCCs.
8. mxroute (USA) — email delivery and the Platform's own mailbox, on servers in the USA. Receives the recipient's email address and the content of the message. Transfer basis: none in place beyond the provider's own terms.
9. Wasabi Technologies (USA; data stored in the EU) — object storage for media and project files (Milan, Italy) and for the encrypted nightly backup (Frankfurt, Germany). The data stays in these regions; Wasabi may access it from other countries to provide its service. Transfer basis: SCCs.
10. Hetzner Online (Germany) — hosting of the Platform, its database, some files and the services Ecliptio runs itself (search index, face fingerprints, diagram drawing, web-search relay). EU, no transfer.
11. Push services of the browser (for example Apple, Google, Mozilla) — deliver the notifications that a member has turned on for a device. The content is encrypted end to end: the push service delivers it but cannot read it.

Ecliptio's own machines in Malta and our own web-search relay are run by Ecliptio and are not sub-processors. The relay forwards search queries to public search engines without any identifier of the Customer or its Workspace.