Data Processing Agreement

Axion Minds Inc. (Canada) acts as the data processor. You — the customer — act as the data controller. We process your data only on your documented instructions and only for the purposes set out in your subscription agreement and this DPA.

The categories of data processed are: brand reference assets you upload, generation prompts and outputs, account credentials, workspace audit logs, and standard product telemetry (page views, error reports). The categories of data subjects are your team members and (where applicable) your end customers whose images appear in your reference set.

We engage subprocessors (Google Cloud, fal.ai, Replicate, RunPod, OpenAI, Anthropic, HeyGen, Hedra, ElevenLabs, Suno, Magnific, Resend, PostHog, Stripe at public launch) to deliver specific portions of the service. The full list and what each one processes lives at /legal/subprocessors. Enterprise customers receive 30 days notice before any new subprocessor is added.

Standard Contractual Clauses (SCCs) are incorporated by reference for any cross-border transfer of personal data out of the EU/UK. We rely on the European Commission's 2021 SCCs (Module Two — controller-to-processor) as the transfer mechanism.

Data retention follows the same lifecycle as in our Privacy Policy: data deleted within 60 days of account closure, except where required by law. On request we can configure shorter retention windows for specific workspaces (Enterprise tier).

Security measures: encryption at rest (AES-256) and in transit (TLS 1.3), least-privilege IAM on all service accounts, Postgres Row-Level Security on every customer-facing table, audit logging on every data access. SOC 2 Type 1 prep starts Week 15 of the public-launch runway. Full security architecture at /trust.

Sub-processors are listed at /legal/subprocessors. Notification of new subprocessors goes out 30 days in advance for Enterprise customers and as soon as the engagement starts for everyone else.