Data Processing Agreement (DPA)

1. Scope and Applicability

This Data Processing Agreement ("DPA") supplements the AbeyCollab Terms of Service and applies to the processing of Personal Data by AbeyCollab Inc. on behalf of customer brands and creator talent partners subject to the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and the Digital Personal Data Protection Act 2023 (India).

2. Roles of the Parties

• Brand Customers (Data Controllers): Determine the purposes and scope of creator marketing briefs, deliverable specifications, and campaign parameters.
• AbeyCollab Inc. (Data Processor): Processes creator channel analytics, review comments, timecoded video timestamps, and payout transaction records strictly under the instruction of the controller.

3. Technical & Organizational Security Measures

AbeyCollab implements rigorous technical controls to safeguard all campaign assets and personal information:

• Cryptographic Protection: User passwords hashed with PBKDF2 (100,000 rounds) + unique salt; session cookies signed with HMAC-SHA256 and configured with HttpOnly; Secure; SameSite=Lax.
• Transport & Storage Encryption: TLS 1.3 in transit across all endpoints; AES-256 at rest for media storage and database logs.
• Webhook Verification: HMAC signature validation on all incoming payment events (Stripe / Razorpay).

4. Sub-processors

AbeyCollab engages verified sub-processors for essential infrastructure services: Vercel (Edge Hosting), Stripe Inc. (Payment Processing & Payouts), and Resend (Transactional Email). Customers will be notified of any material sub-processor modifications.

5. Data Deletion & Audit Inquiries

Upon termination of services, AbeyCollab will delete or return all Personal Data upon controller request within 30 days. For custom enterprise DPA counter-signatures, contact dpa@abeycollab.com.