Data Processing Agreement

DRAFT — not legal advice; have a lawyer review. Version: draft-2026-10-27.

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the creator who holds a The Creator Funnel account ("Creator", "you"), and Alpha Lion Enterprises LLC, 2035 W Monte Cristo Ave, Phoenix, AZ 85023, USA ("we", "us"). It applies whenever we handle personal data for you while providing The Creator Funnel (the "Service"). You accept it when you accept the Terms. If this DPA and the Terms conflict on data protection, this DPA wins.

1. Roles

• For the personal data of your site visitors, subscribers, leads, customers and the people who contact your help desk ("Creator Data"), you are the controller (in US state laws, the "business") and we are your processor (the "service provider" or "contractor").
• For your own account data (your login, billing and use of the dashboard), we are the controller, and our Privacy Policy applies instead.
• You are responsible for having a lawful basis to collect Creator Data, for your own privacy policy, and for the instructions you give us.

2. What we process

Subject matter and purpose: hosting your site and running its features: sign-up forms and confirmation, product delivery and the My Products page, checkout through your Stripe account, email sending and receiving through your Resend account, sequences and broadcasts, lists, the help desk, outgoing webhooks you set up, reporting, exports, backups and support.

Duration: while your account exists, then until deletion as described in section 9.

People concerned: your site visitors, people who sign up for your free products, your email subscribers, your customers, people who contact you through your contact form or by email, and your team members.

Types of data:

• Names (first and last name) and email addresses.
• Consent records: the exact wording agreed to, time, IP address, browser (user agent), the page and the source.
• Sign-up source: tracking tag (?src=), UTM parameters, referring page and landing page.
• Subscription status, lists and tags, unsubscribe, bounce and complaint status.
• Email delivery and engagement events (sent, delivered, opened, clicked), as reported by your Resend account.
• Orders: product, amount, currency, status, refunds, and Stripe identifiers. Card details stay with Stripe and never reach us.
• Product access: library entries, download records, online reading position, and single-use access links.
• Help-desk tickets: messages, attachments, notes and topics.
• Technical data: IP address and browser details on forms and access requests.

We do not ask you to give us sensitive data (such as health, financial account or government ID data), and the Service is not designed for it. Do not collect it through the Service.

3. Your instructions

We process Creator Data only on your documented instructions. Your instructions are these Terms and this DPA, plus the settings you choose and the actions you take in the dashboard (for example sending a broadcast, issuing a refund, exporting or deleting data). We will tell you if we believe an instruction breaks data protection law. We may also process Creator Data where the law requires it; if so, we will tell you first unless the law forbids it.

We will not sell Creator Data, share it for cross-context behavioural advertising, or use it for our own purposes, except to provide, secure and support the Service and as the law permits processors to do.

AI features: we never put Creator Data (subscriber, order or ticket data) into prompts sent to AI models.

4. Confidentiality

Everyone we allow to access Creator Data is bound to keep it confidential. Our staff access a workspace only when needed (for example for support), with a recorded reason, for a limited time, with secret keys hidden, and with every action logged. The workspace Owner is emailed after each such access.

5. Security

We use appropriate technical and organisational measures to protect Creator Data. They are listed in Annex 1. We may improve them over time, but we will not make them meaningfully weaker.

6. Sub-processors

You give us general permission to use the sub-processors listed in Annex 2. We have written contracts with them that protect Creator Data at least as well as this DPA. We remain responsible for them.

We will tell you about any new or replacement sub-processor at least 30 days before it starts, by email or in the dashboard. You may object on reasonable data protection grounds within that time. We will work with you in good faith to resolve the objection. If it is not resolved before the change takes effect, you may end your subscription (or the affected part of the Service) by written notice, and we will refund, pro rata, any fees you have prepaid for the period after it ends.

Services you connect are not our sub-processors. Your own Stripe, Resend, OpenRouter, analytics (Google Analytics, Plausible), pixels (Meta, Google Ads, TikTok), Cloudflare Turnstile (with your own keys), YouTube and any webhook destinations are chosen and contracted by you. We send data to them only because you set them up. Your agreements with those companies govern how they handle it.

7. Helping you with people's requests

The dashboard gives you tools to respond to people who use their privacy rights: search, view a person's profile and consent history, export, correct, unsubscribe, and delete or anonymise a person. Unsubscribe links in your emails work at once. If someone sends a request about Creator Data to us, we will pass it to you and will not answer it ourselves unless you ask us to. We will give you other reasonable help where you cannot do it yourself with these tools. [TO CONFIRM: whether extra help is charged.]

We will also give you reasonable information to help with data protection impact assessments and with questions from regulators.

8. Personal data breaches

If we become aware of a breach of security that leads to the accidental or unlawful loss, change, disclosure of or access to Creator Data, we will tell you without undue delay and in any case within 72 hours of becoming aware of it. We will tell you what we know (what happened, what data and roughly how many people are affected, what we are doing about it and who you can contact), and update you as we learn more. We will take reasonable steps to contain it. Notifying people or regulators is your decision as controller, and we will help you with the information we have.

9. Export, return and deletion

• Export: the workspace Owner can download a full export (all workspace data as JSON, CSV files of subscribers, consents, orders and tickets, plus product files and media) from the Data screen at any time, including while the account is limited, suspended or cancelled. Each export file is available for 7 days.
• Deletion on request: when the Owner deletes a workspace (typed confirmation plus two-step login, with a 7-day waiting period during which it can be cancelled), we delete all of its Creator Data and files, remove its custom domains and destroy its encryption key.
• Deletion after the account ends: 30 days after a subscription is cancelled, its workspaces are scheduled for deletion and deleted in the same way.
• Backups: encrypted backup copies are deleted as backups expire, within 30 days of deletion.
• What we keep: a minimal record that a workspace was deleted, and the billing records about your account that we need for accounting. These do not contain your subscribers' or customers' data.

10. Audits

On request, we will give you the information reasonably needed to show that we meet this DPA, such as a description of our security measures and sub-processors, and answers to a reasonable security questionnaire. You agree to rely on this documentation first. Only if it is not enough to show that we meet this DPA, or if a data protection authority requires it, you may carry out an on-site audit or have an independent third party do so: at most once in any 12 months, at your cost, with at least 30 days' written notice, during normal business hours, without disrupting the Service or other customers' data, and under a duty of confidentiality.

11. International transfers

Creator Data is hosted on servers provided by Hostinger [TO CONFIRM: data-centre location], with traffic served through Cloudflare's global network and backups stored in Cloudflare R2. Resend processes email in the United States. Our sub-processors may process Creator Data in the United States and other countries. We accept creators and customers from the European Union and the United Kingdom.

• EU Standard Contractual Clauses. Where the GDPR requires a transfer safeguard for Creator Data transferred to us, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA by reference. Module 2 (controller to processor) applies between you (data exporter) and us (data importer). Where you are yourself a processor for someone else, Module 3 applies instead. For our onward transfers to sub-processors, we use Module 3 (processor to processor) of the SCCs or another valid transfer mechanism.
• Choices under the SCCs: Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 6; the optional wording in Clause 11 does not apply; under Clause 13, the supervisory authority is the one that is competent for you; under Clauses 17 and 18, the SCCs are governed by the law of, and disputes go to the courts of, the EU Member State where you are established, or Ireland if that law does not allow third-party beneficiary rights or you are not established in the EU. Annex I of the SCCs is completed with the parties and the details in section 2 of this DPA, Annex II with Annex 1 of this DPA, and Annex III with Annex 2 of this DPA.
• UK Addendum. For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) is incorporated by reference. Tables 1 to 3 are completed with the information in this DPA, and either party may end the Addendum as allowed by its Section 19.
• Switzerland. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
• If the SCCs or the UK Addendum conflict with this DPA, they win.

EU/UK representative: [TO CONFIRM if required].

12. US state privacy laws

Where US state privacy laws apply (for example the California Consumer Privacy Act), we act as your service provider or contractor. We will not keep, use or disclose Creator Data outside our direct business relationship with you, or combine it with personal data from other sources except as those laws allow. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorised use.

13. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms of Service. This DPA lasts as long as we process Creator Data for you.

Annex 1: Security measures

• Separation between creators: every workspace's data is kept separate in the application, and automated tests check that one workspace cannot read, change, download or trigger anything in another.
• Encryption: HTTPS for all traffic. Secret keys you connect are encrypted with a per-workspace encryption key, which is itself encrypted with a master key; secrets are never logged and are shown only as their last four characters. Nightly backups are encrypted before they leave the server.
• Access control: two-step login required for account Owners and for our staff; separate admin sign-in available only on the platform address, with an optional IP allowlist; role-based permissions for team members; secret keys visible only to the Owner and hidden during staff access.
• Server: reachable only through Cloudflare; key-only SSH access; automatic security updates; separate system users for each environment; configuration files outside the web root; debug output off.
• Application protection: CSRF protection, bot checks and rate limits on forms; signature checks on incoming webhooks; protection against server-side request forgery on outgoing requests; sanitising of all rich text; uploaded files kept private with random names and type checks; downloads only after an access check, never from a link in an email.
• Logging and monitoring: audit logs for sensitive actions (keys, settings, refunds, exports, deletions, role changes, sign-ins, staff access); alerts to us for failed backups, failed jobs and unusual errors.
• Backups and recovery: encrypted nightly database and file backups to separate storage, kept 30 days, with tested restores.
• Data minimisation: sign-up and checkout forms collect first name, last name and email only; no personal data is sent in AI prompts.

Annex 2: Sub-processors