Data Processing Addendum
Studio58, Inc. (operating Kaldune) · Last updated 13 October 2026 · Version 2.1
This Data Processing Addendum is part of the Kaldune Terms of Service for every business and workspace customer. It applies automatically when the Terms do; no signature is needed. A countersigned copy is available on request from enterprise@kaldune.ai. This document is published in English, and the English version governs.
1. Parties and scope
1.1. This Data Processing Addendum ("DPA") forms part of the Kaldune Terms of Service or other written agreement (the "Agreement") between Studio58, Inc., a Delaware corporation ("Kaldune", "Processor"), and the customer that accepts it ("Customer").
1.2. It applies to personal data that Customer, or its authorized users, submit to the Kaldune service or that Kaldune generates for Customer in a brief ("Customer Personal Data").
1.3. Where this DPA and the Agreement conflict on the processing of Customer Personal Data, this DPA governs. Where the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses govern.
2. Definitions
"Applicable Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), and other data protection laws that apply to the processing. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Subprocessor" means a third party Kaldune engages to process Customer Personal Data. "Standard Contractual Clauses" or "SCCs" means the clauses approved by European Commission Implementing Decision (EU) 2021/914.
3. Roles
3.1. Customer is the Controller (or a Processor acting for a third-party Controller) of Customer Personal Data. Kaldune is the Processor (or Subprocessor).
3.2. Kaldune is an independent Controller of the account, billing, security and service-usage data it needs to run the service (for example sign-in records, wallet and invoice records, device and fraud signals). That processing is governed by the Kaldune Privacy Policy, not this DPA.
3.3. For the CCPA, Kaldune is a service provider. It does not sell or share Customer Personal Data, and does not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service.
4. Details of processing
| Item | Detail |
|---|---|
| Subject matter | Providing the Kaldune AI creative studio: Customer briefs the studio and its AI specialists produce the work (documents, images, video, audio, applications). |
| Duration | The term of the Agreement, plus the return and deletion period in Section 12. |
| Nature of processing | Collection, storage, organisation, retrieval, transformation, generation, transmission to Subprocessors for model inference, and deletion. |
| Purpose | Producing the work Customer asks for in its briefs, storing it so Customer can return to it, delivering and sharing it on Customer's instruction, and the security, billing and support operations that keep the service running. |
| Categories of personal data | Whatever Customer chooses to include in briefs, uploads and messages (text, documents, images, video, audio, voice recordings) and what appears in the work made from them; names, email addresses and contact details of Customer's authorized users. |
| Special categories | Not required by the service. Customer should not submit special-category data unless it has a lawful basis to do so. The service does not use images or voice recordings to identify anyone. |
| Data subjects | Customer's authorized users, and any person Customer includes in its content (for example its staff, customers, contacts, or people depicted or voiced in its material). |
| Frequency | Continuous, for as long as Customer uses the service. |
5. Kaldune's obligations
Kaldune will:
(a) process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use of the service, including for transfers to a third country, unless the law requires otherwise, in which case it will tell Customer first unless the law forbids it; and tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law;
(b) ensure that every person it authorises to process Customer Personal Data is bound by confidentiality (Section 6);
(c) take the security measures in Annex 1 (Section 7);
(d) engage Subprocessors only under Section 8;
(e) assist Customer with Data Subject requests (Section 10);
(f) assist Customer with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Kaldune;
(g) at the end of the services, delete or return Customer Personal Data under Section 12;
(h) make available the information needed to demonstrate compliance with this DPA and allow for and contribute to audits under Section 13.
Kaldune does not use Customer Personal Data to train models.
6. Confidentiality
Kaldune limits access to Customer Personal Data to personnel and service identities that need it to provide the service, and binds its personnel to written confidentiality obligations that survive the end of their engagement. Kaldune does not read the content of Customer's work in the normal course; support personnel access it only at the request of Customer or its authorized user, for the stated purpose.
7. Security
7.1. Kaldune implements and maintains the technical and organisational measures in Annex 1, and may update them provided the update does not lower the overall level of protection.
7.2. Kaldune requires each Subprocessor to protect Customer Personal Data with measures at least as protective as those in this DPA.
8. Subprocessors
8.1. General authorisation. Customer authorises Kaldune to engage the Subprocessors listed at kaldune.ai/legal/sub-processors (the "Subprocessor List", Annex 2).
8.2. Flow-down. Kaldune enters into a written agreement with each Subprocessor imposing data protection obligations no less protective than this DPA, and remains liable to Customer for each Subprocessor's performance.
8.3. Notice of new Subprocessors. Kaldune will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessor List and by email to every Customer who asks for these notices at privacy@kaldune.ai.
8.4. Objection. Customer may object in writing on reasonable data protection grounds within the 30-day notice period. The parties will discuss the objection in good faith. If it is not resolved, Customer may terminate the affected part of the service and receive a pro-rata refund of prepaid, unused fees for it.
8.5. Emergency replacement. Where a Subprocessor must be replaced urgently for security or continuity reasons, Kaldune may do so with notice as soon as practicable, and Customer keeps its objection right under 8.4.
9. International transfers
9.1. Kaldune processes Customer Personal Data in the United States (Google Cloud: region us-central1, US multi-region storage, and a backup copy in us-west1). Some Subprocessors process in other countries, as the Subprocessor List states.
9.2. For transfers of personal data from the EEA to a country without an adequacy decision, the SCCs are incorporated by reference: Module Two (controller to processor) where Customer is a Controller, and Module Three (processor to processor) where Customer is a Processor. Clause 7 (docking) applies; in Clause 9, Option 2 (general authorisation) applies with the notice period in Section 8.3; the optional wording in Clause 11 does not apply; in Clauses 17 and 18, the law and courts of Ireland are selected; Annex I is Section 4 of this DPA; Annex II is Annex 1; Annex III is the Subprocessor List.
9.3. For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs (version B1.0) is incorporated by reference, with Tables 1 to 3 completed by Section 4 and the annexes, and Table 4 allowing either party to end it.
9.4. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and "Member State" read to include Switzerland.
9.5. The parties will cooperate on any transfer impact assessment Applicable Data Protection Law requires.
10. Data Subject requests
Kaldune will promptly forward to Customer any request it receives from a Data Subject about Customer Personal Data, and will not answer it except on Customer's instruction or as law requires. The service gives Customer the means to meet such requests itself: an export of its account data, deletion of individual work and of the account, and correction of account details. Where Customer cannot meet a request itself, Kaldune will assist on request.
11. Personal Data Breach
11.1. Kaldune will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
11.2. The notice will describe, as far as known: the nature of the breach, the categories and approximate numbers of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first notice follows as it becomes available.
11.3. Kaldune will take reasonable steps to contain and remedy the breach and will cooperate with Customer's own investigation and notifications. Notice is not an admission of fault.
12. Return and deletion
12.1. During the term, Customer may export its account data and delete its work at any time from Settings.
12.2. When the Agreement ends, or when Customer deletes its account, Kaldune deletes Customer Personal Data from its active systems within 30 days, including every stored version of Customer's work, and revokes every share and publish link Customer created. Deleted data can persist in encrypted backups until they cycle out, no longer than 40 days after it leaves the active systems.
12.3. Kaldune may retain data where law requires, under this DPA's protections, and only for as long as required. Kaldune's own credit and receipt history is deleted with the account; invoices and payment records stay with Kaldune's payment processor for as long as tax and accounting law requires.
12.4. On request, Kaldune will confirm the deletion in writing.
13. Audits
13.1. Kaldune will make available the information reasonably needed to demonstrate compliance with this DPA.
13.2. Kaldune will answer reasonable written security questionnaires. If Kaldune holds an independent audit report, it will provide it under confidentiality on request, and that report will be the primary means of meeting audit requests.
13.3. Where the information above is not enough to demonstrate compliance, or a Supervisory Authority requires it, Customer may conduct an audit (itself or through an independent auditor bound by confidentiality) on at least 30 days' written notice, during business hours, no more than once in any 12 months except after a Personal Data Breach, at Customer's cost, and without access to other customers' data.
14. Voice and likeness
14.1. Where Customer submits a recording of a person's voice or image, or asks the studio to make a voice model or a likeness of a person, Kaldune processes the recording, the voice model and the likeness only on Customer's instructions and only to produce Customer's work.
14.2. Customer warrants that it has the consent of each person whose voice or likeness it submits, or another lawful basis, for that use.
14.3. Kaldune never uses a voice recording, a voice model or a likeness to train models, and never makes it available to anyone other than Customer and the people Customer shares the work with. Customer may delete them at any time under Section 12.
15. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Applicable Data Protection Law or the SCCs do not permit a limitation.
16. Term and general
This DPA takes effect when the Agreement does and ends when Kaldune no longer processes Customer Personal Data. It is governed by the law that governs the Agreement (Delaware), except where the SCCs require otherwise. Notices to Kaldune under this DPA go to privacy@kaldune.ai.
Annex 1: Technical and organisational security measures
Hosting and network
- The service runs on Google Cloud (region us-central1) on Google Kubernetes Engine with private nodes and workload identity, so services authenticate to Google without stored keys.
- The database is Cloud SQL for PostgreSQL with no public IP address, reachable only over the private network, and accepts only encrypted connections.
- Public traffic enters through a Google Cloud load balancer with a TLS 1.2 minimum and a modern cipher profile, behind a Cloud Armor security policy for rate limiting and filtering.
Encryption
- In transit: TLS 1.2 or higher on public endpoints; encrypted-only connections to the database.
- At rest: Google Cloud encrypts all stored data (database, storage, backups) with AES-256 under Google-managed keys.
Storage of Customer work
- Customer work is stored in Cloud Storage in the US multi-region with uniform bucket-level access and public access prevention enforced. Files leave it only through short-lived signed links or a share or publish link Customer creates.
- Object versioning protects against accidental overwrite. Account export archives are deleted after one day.
- A second, locked copy of Customer work is held in Cloud Storage in us-west1 (Oregon); a deletion at the source leaves that copy within 31 days.
Backups and resilience
- The production database is regional (high availability across zones), with automated daily backups in the US multi-region, point-in-time recovery with 7 days of transaction logs, and 7 retained daily backups. Deletion protection is on.
- Releases roll out progressively with automatic rollback.
Access control
- Every service identity holds only the roles its job needs, declared in infrastructure code. Secrets are held in Google Secret Manager, never in the code repository.
- 2-step verification is enforced on every Kaldune company Google account.
- Users sign in with email one-time codes or Google sign-in and can turn on two-factor authentication. Sessions are protected against cross-site request forgery.
- Google Cloud Admin Activity audit logs record every administrative change to the infrastructure.
- Administrative access, every read of the database, and any change made outside the Service to stored data are logged.
Deletion
- An account deletion is queued and a purge deletes the account's rooms including every stored version, revokes its share and publish links, and removes its database records, within 30 days.
Monitoring and incident response
- Alerting on the service, the database and provider errors, with uptime checks from outside Google Cloud. A written incident procedure rolls back first and holds a postmortem within 24 hours.
Providers
- Each Subprocessor is listed with the data it receives and its region; a build check refuses any outbound provider address that is not on the list.
Annex 2: Subprocessors
The Subprocessor List is published at kaldune.ai/legal/sub-processors. It is generated from the same list the software checks its outbound calls against, so it names every provider the service sends Customer Personal Data to, what each receives and where it processes it.