1. Scope and roles
This Data Processing Addendum (DPA) applies where a customer uses FRAME to store or manage Personal Data about its own clients, contacts, shoots, invoices, receipts, expenses, or related workspace records (Customer Personal Data), and FRAME processes that information on the customer's documented instructions as a processor or service provider under applicable law.
The customer is responsible for determining its own role and legal basis for Customer Personal Data. FRAME acts independently for account, service-operation, security, fraud-prevention, legal-compliance, and Paddle-related billing information it processes for its own purposes, as described in the Privacy Policy. This DPA does not assert that FRAME is a processor for every category of data or in every jurisdiction.
2. Processing details and instructions
FRAME processes Customer Personal Data only to provide, secure, support, maintain, and improve the contracted service, follow documented customer instructions made through normal use of FRAME, and comply with applicable law. Processing continues for the customer relationship and any retention period required for legitimate service, security, legal, accounting, dispute, or backup purposes.
- Data subjects may include the customer's clients, contacts, collaborators, and other people whose information the customer enters into its workspace.
- Data categories may include identity and contact details, booking and shoot details, commercial records, invoice and receipt data, expense information, notes, and other workspace information entered by the customer.
3. Confidentiality and security
FRAME limits personnel access to Customer Personal Data to people with a need to know for service operation, support, troubleshooting, security, fraud or abuse investigation, legal compliance, or protection of FRAME, customers, or others. FRAME uses authenticated access, authorization controls, row-level security where applicable, server-side billing verification, and restricted administrative access. No security measure eliminates all risk.
4. Subprocessors and international transfers
FRAME uses the providers listed at /subprocessors to support the service. A provider may process Customer Personal Data only as needed for its stated service. Processing may occur in locations where FRAME or its providers operate. Customers should review the current provider terms and applicable transfer requirements for their own circumstances.
5. Assistance, incidents, deletion and return
FRAME will provide reasonable information and cooperation available through the service for customer data-subject requests, security questions, and incident response, taking account of the nature of processing and applicable law. Customers can export their own workspace JSON while they have appropriate access. Account-deletion requests deactivate the account; permanent deletion and retention handling are support-assisted and are not guaranteed within a fixed time. FRAME may retain information where reasonably necessary for the purposes described in the Privacy Policy.
6. Priority and contact
If a customer requires a separately executed DPA, contact easyops.support@gmail.com before relying on this page as a negotiated agreement. A signed DPA may add or replace terms for that customer. This page is not a certification or universal legal classification.