Feedova Data Processing Agreement (DPA)

Last updated: 21 October 2026 · version 2026-10-21

This agreement (the "DPA") forms part of the agreement between the customer (the "Customer") and Nabta LLC, a limited liability company organized under the laws of the State of Wyoming, entity number 2026-002022285, 30 N Gould St Ste R, Sheridan, WY 82801, United States, which provides Feedova ("Feedova"). That agreement comprises the Terms of Sale, the Terms of Use and any Order (together, the "Agreement").

This DPA applies automatically upon acceptance of the Agreement, without any separate signature. A Customer who wishes to receive a signed copy may request one at privacy@feedova.ai. This DPA meets the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR"), of its United Kingdom equivalent (the "UK GDPR"), of the Swiss Federal Act on Data Protection (the "FADP") and, for data of residents of the United States, of the state laws applicable to service providers (the "US State Laws").

1. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR. "Customer Data" means the personal data contained in the Customer's Content or collected at the Customer's request, which Feedova processes on the Customer's behalf. "Sub-processor" means any provider to which Feedova entrusts all or part of the processing of Customer Data. "SCCs" means the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914.

2. Roles of the parties

2.1 With respect to Customer Data, the Customer is the controller and Feedova is the processor.

2.2 If the Customer itself acts as a processor on behalf of a third party (for example, an agency acting for a client brand), Feedova is the Customer's sub-processor. The Customer warrants that its instructions comply with those of its own controller and that it has obtained the necessary authorizations, in particular for Feedova's Sub-processors and for Article 7.5.

2.3 Feedova is a controller, and not a processor, for: User account data, billing, security and fraud prevention, support, direct marketing, the improvement of its models and services under the conditions of Article 7.5, and public data that it collects on its own behalf. This processing is described in the Privacy Policy.

3. Description of the processing

The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.

4. Instructions

4.1 Feedova will process Customer Data only on the documented instructions of the Customer, including with regard to transfers outside the European Union, unless required to do so by law; in that case, Feedova will inform the Customer before the processing, unless the law prohibits it from doing so.

4.2 The Agreement, this DPA, the settings of the Service and the actions that the Customer or its Users initiate in the Service constitute the Customer's documented instructions. By accepting the Agreement, the Customer instructs Feedova to transmit to the Sub-processors listed in Annex 3 the data necessary for the functions the Customer uses, under the conditions described in that Annex. Any additional instruction must be in writing and compatible with the Service; if it involves a cost, Feedova will say so before carrying it out.

4.3 Feedova will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or any other applicable provision.

4.4 The Customer is responsible for the lawfulness of Customer Data and of its instructions: legal basis, information provided to data subjects (including about Article 7.5 and about what the Sub-processors flagged in Annex 3 do with the data), necessary consents (in particular from the persons whose image or voice the Customer provides), and compliance with the terms of the websites and services from which the data originates.

5. Confidentiality

Feedova will ensure that the persons authorized to process Customer Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they access Customer Data only to the extent necessary.

6. Security

6.1 Feedova will implement the technical and organizational measures set out in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.

6.2 Feedova may update these measures, provided that it does not reduce the overall level of security.

7. Sub-processors

7.1 General authorization. The Customer authorizes Feedova to engage the Sub-processors listed in Annex 3, which is published and kept up to date on the Subprocessors page.

7.2 Changes. Feedova will inform the Customer of any addition or replacement of a Sub-processor at least 30 days in advance, by email to the Owner of the Organization and on the Subprocessors page. The Customer may object, on reasonable grounds relating to data protection, in writing, within that period. The parties will then seek a solution in good faith; failing such a solution, the Customer may terminate the affected part of the Service, and Feedova will refund the price paid in advance for the remaining period.

7.3 Flow-down obligations. Feedova will impose on each Sub-processor, by contract, data protection obligations at least equivalent to those set out in this DPA, in particular with respect to security and confidentiality, and remains liable to the Customer for their performance.

7.4 Use of data by certain artificial intelligence providers. Certain Sub-processors state, in their public terms, that they may use the data they receive to train or improve their own models; for that use, they act on their own behalf. Annex 3 indicates this for each of them ("use for its own models"). Feedova will: (a) transmit to these providers only the data necessary for the functions the Customer uses; (b) seek to obtain from each of them terms that exclude this use, and update Annex 3 accordingly; (c) activate the opt-out mechanisms that these providers offer; (d) not activate any new provider of this type without announcing it in accordance with Article 7.2. A Customer who does not want Customer Data (for example, the image of a real person) to be transmitted to such a provider will either not use the relevant functions with that data, or contact Feedova beforehand.

7.5 Improvement of Feedova's models and services. The Customer authorizes Feedova to use the Customer's Content, after removing the personal data it contains or replacing it with pseudonyms to the extent reasonably possible, to improve its models, its generation rules and its services (Terms of Use, Article 4.3). For this processing, Feedova acts as a controller, on the basis of its legitimate interest, and undertakes to: (a) exclude the faces, bodies and voices of identifiable real persons, except with their consent, as well as sensitive data and children's data; (b) never make this data accessible to any other customer; (c) honor the Customer's refusal for its Organization (guaranteed by contract for Enterprise accounts) and objections by data subjects, for future training runs; (d) announce the first training run in the Service before it begins.

8. Transfers outside the European Union

8.1 Feedova is established in the United States. Customer Data is hosted in the European Union (Frankfurt, Germany), but Feedova accesses it from outside the European Union, and certain Sub-processors process it outside the European Union. The Customer authorizes these transfers on the terms of this Article.

8.2 Between the Customer and Feedova. Where the Customer is subject to the GDPR for Customer Data, the parties enter into the SCCs, which are incorporated into this DPA by reference, with the following choices: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is itself a processor; Clause 7 (docking clause) applies; Clause 9, Option 2 (general written authorization), with the notice period set out in Article 7.2; Clause 11, without the independent dispute resolution body option; Clause 13: the supervisory authority designated by Clause 13(a) according to the Customer's situation (that of the Member State in which the Customer is established, or in which the Customer's own representative under Article 27 of the GDPR is located, or failing that, that of the Member State where the data subjects are); Clause 17: French law; Clause 18: the courts of Paris (France); Annexes I, II and III: Annexes 1, 2 and 3 of this DPA. If Nabta LLC self-certifies under the Data Privacy Framework, transfers will rely primarily on the adequacy decision set out in Commission Implementing Decision (EU) 2023/1795, and the SCCs will continue to apply if that decision ceases to apply.

8.3 United Kingdom. For data subject to the UK GDPR, the SCCs apply as amended by the International Data Transfer Addendum issued by the Information Commissioner's Office.

8.4 Switzerland. For data subject to the FADP, the SCCs apply with the adaptations recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC) (references to the FADP; competent authority: the FDPIC).

8.5 Onward transfers. Feedova will safeguard transfers to its Sub-processors located in countries without an adequacy decision through the Data Privacy Framework, where the Sub-processor is certified, or through the SCCs (Module Three), and will carry out the necessary transfer impact assessment.

9. Assistance to the Customer

9.1 Data subject rights. Feedova will assist the Customer, by appropriate technical and organizational measures and insofar as possible, in responding to requests from data subjects to exercise their rights. If a data subject contacts Feedova directly regarding Customer Data, Feedova will forward the request to the Customer without delay and will not respond to it itself, unless instructed by the Customer or required by law.

9.2 Impact assessments. Feedova will provide the Customer with the information reasonably necessary for its data protection impact assessments and its prior consultations with the supervisory authority.

9.3 This assistance is free of charge as long as it remains reasonable; beyond that, Feedova may charge for it at a rate announced in advance.

10. Personal data breaches

10.1 Feedova will notify the Customer of any personal data breach affecting Customer Data without undue delay, and no later than 48 hours after becoming aware of it.

10.2 The notification will describe, to the extent such information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the point of contact, the likely consequences, and the measures taken or proposed. Information that is not yet available will be provided as soon as possible.

10.3 Notification does not constitute an admission of fault. It is the responsibility of the Customer, as controller, to notify the supervisory authority and, where applicable, the data subjects; Feedova will assist the Customer in doing so.

11. Audits

11.1 Feedova will make available to the Customer the information necessary to demonstrate compliance with this DPA: documentation, answers to a reasonable security questionnaire once a year, and audit reports or certifications of its Sub-processors where they exist.

11.2 If this information is not sufficient, or if a supervisory authority so requires, the Customer may have an audit carried out, no more than once a year except in the event of a personal data breach, either by itself or by an independent auditor bound by confidentiality and not a competitor of Feedova, with at least 30 days' prior notice, during business hours, without disrupting the Service and without accessing other customers' data. The costs of the audit are borne by the Customer, unless the audit reveals material non-compliance by Feedova.

12. End of the processing

12.1 At the end of the Agreement, the Customer may export Customer Data for 30 days, as provided in the Terms of Sale.

12.2 At the end of that period, Feedova will delete Customer Data within 90 days, including at its Sub-processors, unless the law requires it to be retained. Backups are erased in accordance with their normal cycle and remain protected until then. Feedova will confirm the deletion in writing upon request. Data already used under the conditions of Article 7.5 is not affected, and copies held by a provider on its own behalf (Article 7.4) are governed by that provider's terms.

13. Public data collected for the Customer

Where the Customer asks Feedova to collect and analyze content published by third parties (reviews, discussions, advertisements): (a) Feedova will collect it through the official interfaces of the relevant websites or through providers under contract, and will exclude sources that clearly refuse automated collection; (b) Feedova will delete or pseudonymize the names, pseudonyms and identifiers of the authors upon collection, and will retain only what is used for the analysis; (c) Feedova will exclude, as far as possible, content that reveals sensitive data about its authors; (d) the Customer will use the results only for its own marketing research and creative work, without seeking to identify, contact or target the authors; (e) the Customer remains responsible for the legal basis and for informing the data subjects, and Feedova will provide the Customer with the necessary information (sources, volumes, safeguards applied).

14. Residents of the United States

For data of residents of the United States that is subject to a state privacy law, Feedova acts as a "service provider" or "processor" and will: (a) not sell this data or share it for cross-context behavioral advertising; (b) not retain, use or disclose it outside the direct business relationship with the Customer or for purposes other than those of the Agreement, except to improve its services within the limits permitted by those laws (Article 7.5); (c) not combine it with data received from other sources, except as permitted by law; (d) comply with the applicable obligations and notify the Customer if it can no longer meet them; (e) allow the Customer to take reasonable steps to stop any unauthorized use.

15. Liability

Each party's liability under this DPA is subject to the limitations set out in the Agreement, with a separate cap equal to twice the amounts paid by the Customer during the twelve months preceding the event giving rise to the liability. These limitations do not restrict the rights of data subjects under the law or under the SCCs, and do not apply to a Customer who is a Consumer to the extent prohibited by law.

16. Term, language and order of precedence

16.1 This DPA applies for as long as Feedova processes Customer Data.

16.2 In the event of any conflict, the SCCs prevail over this DPA, and this DPA prevails over the rest of the Agreement with respect to data protection.

16.3 This DPA exists in French and in English. For Customers established or resident in France, the French version prevails; for all other Customers, the English version prevails.

Annex 1: Description of the processing

Annex 2: Technical and organizational measures

As of 21 October 2026.

Annex 3: Sub-processors

The current list, with the role, location, transfer safeguard, what each provider does with the data and the status of each provider, is published on the Subprocessors page. It forms part of this DPA.