Overview
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Orshot (DaSkrad Ltd.) ("Processor") and the customer ("Controller") for the provision of Orshot services. It applies automatically to every customer; no signature is needed.
Scope of Processing
Orshot processes personal data on behalf of customers to provide template-based image, video, and PDF generation services. The types of personal data processed depend on the content you include in your templates and may include:
- Names and contact information
- Profile images or photographs
- Any text or data you include in template parameters
Data Processing Principles
Orshot commits to:
- Process personal data only on documented instructions from the Controller
- Ensure that persons authorized to process personal data have committed to confidentiality
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject requests
- Delete or return all personal data at the end of the service relationship, upon request
- Make available all information necessary to demonstrate compliance
Generated Content Ownership
The Controller (User) retains all rights, title, and interest in and to the generated content, including any AI-generated visuals, Orshot API generated images, PDFs, or videos created using Orshot services. Orshot acts solely as a processor with respect to such content.
Embedded Editor Usage Data
When the Controller embeds the Orshot editor in its own product, Orshot processes usage data about the Controller's end users on the Controller's behalf, only to provide the Controller with analytics and to operate and improve the embedded editor. The Controller is responsible for informing its end users and for any consent its jurisdiction requires.
Template Ownership
Orshot legally owns the templates provided in its library. Users receive a limited license to use these templates in their designs. While users can use customized templates for commercial purposes, ownership of the underlying template structure remains with Orshot.
Sub-processors
The Controller gives general authorization for Orshot to use sub-processors in these categories: hosting and infrastructure, payments, email, support and operations, analytics, ai model providers, social publishing. The current list, with each provider's purpose, is on our sub-processors page.
Orshot puts data protection terms in place with each sub-processor that are no less protective than this DPA, and remains responsible for them. We update the sub-processors page before a new sub-processor starts processing customer personal data. Customers who want an email when it changes can ask at hi@orshot.com. A Controller may object to a new sub-processor on reasonable data protection grounds within 14 days; if we cannot resolve the objection, the Controller may cancel the affected service.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit (TLS)
- Encryption at rest, including authenticated encryption of access tokens for connected integrations
- Workspace isolation enforced with row-level security in the production database
- Ongoing security monitoring, automated dependency scanning, and code review as part of the development process
- Access controls and authentication measures
- Regular backups and disaster recovery procedures
Data Retention
Templates, assets and generated files are kept while your account is active, or until you delete them. Temporary files fetched for rendering are deleted automatically on a short schedule. Account deletion is handled on request by email. On the Controller's request, we delete or return personal data within the time the law requires, except where retention is required by law.
International Data Transfers
Some of our sub-processors, including hosting and AI model providers, are located outside the UK/EEA, mainly in the United States. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreement (IDTA) where applicable
- Adequacy decisions where available
Data Breach Notification
In the event of a personal data breach, Orshot will notify the Controller without undue delay and within 72 hours of becoming aware of the breach, where feasible. The notification will include all information required under GDPR Article 33.
Liability
Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, or in a signed enterprise agreement where one exists.
Request a Signed DPA
For institutional or enterprise customers requiring a signed Data Processing Agreement, please contact us at hi@orshot.com. We will provide a formal DPA document for execution within 5 business days.
Contact
For any questions regarding data processing or this DPA, please contact: hi@orshot.com