Data Processing Addendum

This Data Processing Addendum applies when Rib Creative processes personal data on behalf of a workspace customer through hosted apps, builder workflows, storage, databases, integrations, support, or runtime infrastructure. It supplements the Terms of Service and Privacy Policy.

Roles

For personal data that a customer submits to Rib Creative or collects through a customer app, the customer is usually the controller or business, and Rib Creative is usually the processor or service provider. Rib Creative may act as an independent controller for account administration, billing, fraud prevention, security, legal compliance, and platform analytics.

Processing instructions

Rib Creative will process customer personal data to provide the platform, operate hosted apps, process exports, run builds, manage storage and databases, provide support, secure the service, comply with law, and follow documented customer instructions expressed through the product, agreement, or authorized support requests.

Customer responsibilities

• Customers are responsible for lawful collection, use, disclosure, and deletion of end-user data.
• Customers must provide their own privacy notices, consent flows, legal bases, and end-user terms.
• Customers must not submit regulated or highly sensitive data unless the feature and contract allow it.
• Customers control project configuration, exported environments, app logic, permissions, and secrets.

Subprocessors and transfers

Rib Creative may use subprocessors listed on the Subprocessors page to provide hosting, AI processing, storage, database, email, payments, analytics, monitoring, support, and security services. Where required for international transfers, Rib Creative will rely on appropriate transfer safeguards such as Standard Contractual Clauses, UK transfer mechanisms, adequacy decisions, or other lawful mechanisms.

Security and incidents

Rib Creative will maintain technical and organizational measures designed to protect customer personal data, including access controls, encryption where appropriate, logging, operational safeguards, and provider controls. Rib Creative will notify affected customers without undue delay after confirming a personal data breach that requires notification under applicable law.

Deletion, export, and assistance

Rib Creative will provide product features or reasonable support to help customers export supported project data, delete projects, respond to data subject requests, and meet security or compliance obligations. Some data may remain in backups, logs, billing records, fraud records, or legal records for limited periods where retention is required or technically necessary.