Data Processing Addendum

Version 2026-09-21 · Between you (controller) and SuperFile Inc. [confirm] (processor).

1. Roles

For the personal data of your viewers, you are the controller and we are the processor. For your own account data we are the controller — see the Privacy Policy.

2. Subject matter and duration

We process viewer data only to issue and meter DRM licences for your content, for as long as your account exists, and in any event no longer than the retention periods in section 6.

3. Categories of data and data subjects

Data subjects: the end users of your service who request a licence. Data: the viewer reference you supply, a hashed device identifier, a salted hash of the IP address, the user agent, and the outcome of the request. No content, no names, no payment data.

4. Our obligations

• We process viewer data only on your documented instructions — using the service is that instruction — unless the law requires otherwise, in which case we tell you first where we may.
• Everyone with access is bound to confidentiality.
• We keep the security measures described in the Privacy Policy, including the hardware-sealed key vault and the per-deployment IP salt.
• We notify you without undue delay after becoming aware of a personal-data breach affecting your data, and we give you what you need to notify your own authority.
• We assist you with data-subject requests, and with your impact assessments, to the extent the data is in our hands.
• On termination we delete your data; the licence rows are purged on the schedule in section 6 in any event.

5. Subprocessors

You authorise the subprocessors listed in the Privacy Policy. We will give notice before adding one, and you may object on reasonable data-protection grounds — if we cannot resolve the objection you may terminate the affected service.

6. Retention

Licence rows and audit rows are purged after 90 days by a nightly job. Expired sessions and spent email tokens are purged in the same pass. Daily aggregate counts, which contain no personal data, are kept for billing and trend reporting.

7. Profiling: sharing signals

SuperDRM can compute “sharing signals” — one viewer reference across many devices, one device across many viewer references. This is profiling of your end users. It is off unless a workspace owner switches it on, and it cannot be switched on until this addendum is accepted for that workspace. You are responsible for having a lawful basis, and for telling your viewers.

8. International transfers

Our infrastructure runs in the United States (IBM Cloud, Dallas). If you are in a jurisdiction that restricts transfers, the appropriate transfer mechanism must be agreed in writing — [governing law and venue — confirm]; contact [email protected] [confirm].

9. Audit

On reasonable notice, and no more than once a year unless an authority requires otherwise, we will answer a written audit questionnaire and provide the documentation we hold about the measures in section 4.

10. Accepting this addendum

A workspace owner accepts it in the portal, under Workspace settings → Data processing. We record who accepted it, when, and which version.