Data Processing Addendum

Version: July 9, 2026

This Data Processing Addendum (“DPA”) is between Shotro inc. (“Shotro”) and the customer entity that has entered into an agreement for Shotro services (“Customer”). It applies when Shotro processes Personal Data on Customer’s behalf in providing the services. It supplements the applicable service agreement (“Agreement”) and is effective when Customer accepts it through an order form or other written or electronic agreement with Shotro.

This launch-stage DPA is not a representation that Shotro holds any certification or has implemented a control that is not expressly described in a binding order form or security exhibit. Customers should complete appropriate diligence before providing production Personal Data.

1. Definitions and Roles

“Data Protection Laws” means laws applicable to processing under the Agreement, including the EU GDPR, UK GDPR and UK Data Protection Act 2018, and applicable U.S. state privacy laws. “Personal Data,” “process,” “controller,” “processor,” and “Personal Data Breach” have the meanings given by applicable Data Protection Laws. “Customer Personal Data” means Personal Data processed by Shotro on Customer’s behalf.

Customer is a controller and Shotro is a processor of Customer Personal Data, except where Customer acts as a processor for another controller, in which case Shotro is Customer’s subprocessor. Each party is independently responsible for processing it performs as a controller, including business contact, billing, security, and service-administration data described in Shotro’s Privacy Policy.

2. Processing Instructions

Shotro will process Customer Personal Data only on Customer’s documented instructions, including the Agreement, Customer’s configuration and authorized use of the services, and written instructions consistent with the Agreement, unless law requires otherwise. In that case, Shotro will inform Customer before processing unless legally prohibited.

Shotro will promptly inform Customer if, in Shotro’s reasonable opinion, an instruction violates applicable Data Protection Laws. Shotro may suspend the affected processing while the parties resolve the issue. Customer is responsible for the lawfulness, accuracy, and quality of Customer Personal Data; required notices, consents, rights, and instructions; and ensuring that the services are appropriate for Customer’s intended processing.

3. Processing Details

Subject matter and purpose: hosting and processing private creative projects, prompts, inputs, media, outputs, account information, collaboration data, support data, and related technical data to provide, secure, maintain, and support the contracted Shotro services.

Duration: for the Agreement term and thereafter only as needed for return or deletion, legal obligations, security, dispute resolution, and backup cycles.

Nature and operations: collection, transmission, organization, storage, retrieval, viewing, transformation, generation, collaboration, support, security analysis, deletion, and other operations initiated or configured by Customer.

Data subjects: Customer’s authorized users, personnel, contractors, collaborators, clients, prospects, and individuals depicted in or otherwise associated with Customer content.

Data categories: identifiers and contact data; account, role, and collaboration data; prompts, files, images, audio, video, likeness or voice data, and generated content; usage and device data; support communications; and other Personal Data Customer chooses to submit.

Customer will not submit sensitive or special-category data, criminal-conviction data, government identifiers, financial-account credentials, health data, or children’s data unless specifically authorized in writing, supported by appropriate safeguards, and lawful. Shotro does not intentionally provide services to people under 18.

4. Confidentiality and Personnel

Shotro will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations, receive access only as needed for their responsibilities, and process the data according to Customer’s documented instructions.

5. Security

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing and risks to individuals, Shotro will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Measures will be proportionate to risk and may include access controls and authentication; least-privilege practices; encryption in transit and at rest where appropriate and supported by relevant systems; logging and monitoring; vulnerability and change management; backups and recovery planning; vendor diligence; incident response; personnel confidentiality; and periodic review. No system is completely secure, and this provision does not promise absolute security or any certification.

6. Subprocessors

Customer gives general written authorization for Shotro to use subprocessors to provide the services. The current list is at Subprocessors. Shotro will impose data-protection obligations on each subprocessor that are no less protective in material respects than Shotro’s obligations under this DPA, to the extent applicable to the subprocessor’s services. Shotro remains responsible for its subprocessor’s performance of those obligations as required by Data Protection Laws.

Shotro will provide notice of a new subprocessor before it begins processing Customer Personal Data and an opportunity to object on reasonable data-protection grounds. The parties will work in good faith on a reasonable solution. If no solution is available, Customer may terminate only the affected service within the notice period, and Shotro will refund prepaid fees for the unused terminated portion where appropriate. Shotro will name and disclose every generative model or API provider before sending it production Customer Personal Data.

7. Assistance

Taking into account the nature of processing and information available to Shotro, Shotro will reasonably assist Customer with requests from data subjects; security obligations; breach notifications; data protection impact assessments; and prior consultations with regulators. Customer remains responsible for responding to requests and regulatory obligations. Shotro will not respond directly to a data subject regarding Customer Personal Data unless instructed by Customer or legally required.

8. Personal Data Breaches

Shotro will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. As information becomes available, notice will describe the nature of the breach, likely consequences, categories and approximate numbers affected where known, measures taken or proposed, and a contact for follow-up. Notice is not an admission of fault. Customer is responsible for notices to regulators, individuals, or others unless the parties agree otherwise.

9. Return and Deletion

At Customer’s choice, and subject to available service functionality, Shotro will return or delete Customer Personal Data after termination and delete remaining copies unless law requires retention. Data may remain temporarily in backups or restricted records until overwritten in the ordinary cycle, provided it remains protected and is not used for another purpose. Customer should export needed data before the Agreement ends.

10. Information and Audits

Shotro will make available information reasonably necessary to demonstrate compliance with this DPA. No more than once annually, unless a breach or regulator requires otherwise, Customer may request relevant third-party reports or written responses. If those are reasonably insufficient, Customer may conduct an audit through an independent qualified auditor bound by confidentiality, on reasonable advance notice, during normal business hours, without accessing another customer’s data or disrupting operations. Customer bears its audit costs unless the audit identifies Shotro’s material breach.

11. International Transfers

Where Customer Personal Data protected by the EU GDPR is transferred to Shotro in a country lacking an adequacy decision, the parties incorporate the European Commission’s 2021 Standard Contractual Clauses (“EU SCCs”) by reference: Module Two applies to controller-to-processor transfers and Module Three applies to processor-to-processor transfers. The optional docking clause applies; Clause 9 uses Option 2 with the notice period in Section 6; the optional language in Clause 11 does not apply; and the governing law and courts are those of Ireland. The processing details in Section 3 form Annex I, the security commitments in Section 5 form Annex II, and the Subprocessors page forms Annex III. Customer is the data exporter and Shotro is the data importer. The parties’ agreement and business contact details supply the remaining party information.

For restricted transfers under the UK GDPR, the EU SCCs as completed above apply with “Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses,” incorporated by reference. Tables 1-3 are completed by the corresponding Agreement, DPA, and EU SCC information; either party may end the Addendum as permitted by its mandatory termination table; and neither party may end it solely because the UK Information Commissioner approves a revised addendum. For Swiss transfers, references in the EU SCCs will be interpreted to include the Swiss Federal Act on Data Protection and its competent authority, with Swiss data subjects able to enforce applicable rights.

If a transfer mechanism is invalid or unavailable, the parties will cooperate in good faith to implement a lawful alternative. The parties will assess and apply supplementary measures where required. This section does not claim that a particular vendor or transfer has been verified where that verification has not occurred.

12. U.S. State Privacy Terms

To the extent U.S. state privacy law treats Shotro as a service provider, contractor, or processor, Shotro will process covered Customer Personal Data only for the limited and specified purposes in the Agreement; will not sell or share it for cross-context behavioral advertising; will not retain, use, or disclose it outside the direct business relationship except as permitted by law; and will not combine it with personal information received from another person or collected from Shotro’s own consumer interaction except as legally permitted to provide the services. Shotro will notify Customer if it determines it can no longer meet these obligations and will allow reasonable steps to stop and remediate unauthorized use.

13. General

If this DPA conflicts with the Agreement about processing Customer Personal Data, this DPA controls. The EU SCCs or UK Addendum control over inconsistent terms for the transfers they govern. Liability is subject to the Agreement except to the extent Data Protection Laws prohibit that limitation. Changes to this DPA require written agreement, except Shotro may update non-material administrative details or changes needed to comply with law, with notice as appropriate.

Privacy contact: privacy@shotro.ai
Shotro inc., 3101 Ocean Park Blvd Ste 200, #612, Santa Monica, CA 90405, United States.