Data Processing Agreement

This agreement is made between you as a business customer (“you”) and

Firehorse Media LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States of America

a limited liability company under the laws of Wyoming, registered with the Wyoming Secretary of State under ID 2026-001921765 (“we”). Contact: hello@boonvid.com

1. What this agreement covers

When you upload a script and a voiceover, they may contain personal data of other people. For that data, you decide why and how it is used: you are the controller. We process it only on your behalf, to build your video: we are your processor under Article 28 of the EU General Data Protection Regulation (GDPR). This agreement sets out the rules for that.

In this agreement, “your data” means the personal data contained in what you upload and in everything boonvid produces from it.

Your account data (such as your email address) and your bookings are not covered: we process them as controller under our Privacy Policy.

2. How it takes effect and how long it lasts

• This agreement comes into force when you accept our Terms of Service as a business customer; it then forms part of the contract between us. No separate signature is needed.
• If you would like a signed copy, write to hello@boonvid.com. We will then send you this agreement for signature.
• It applies for as long as we process your data and ends when your data has been deleted as described in section 12.
• Where this agreement and the Terms of Service differ on personal data, this agreement prevails.

3. Subject matter, nature and purpose

• Subject matter: building a finished video from the script and the voiceover you upload.
• Nature: we store what you upload; our software and AI models process the script text to plan and cut the video (selection, placement, checks); we produce the video file, check it automatically before delivery, deliver it, keep it available for download and then delete it.
• Purpose: only to build, check and deliver your video and to let you download it again. We use your data for nothing else: no profiling, no sale of data, no advertising based on your uploads, no training of AI models.

4. Types of data and people concerned

You decide what you upload. Your data can include:

• the text of your scripts, including names and other information about people mentioned in them;
• your voiceover recordings, including the voice of the speaker;
• the options you choose, the finished video, its subtitles and the list of sources and licences;
• build logs and the results of the automatic checks, which contain the script text.

The people concerned are those named or described in your scripts, the speakers in your voiceovers, and anyone else whose data is contained in what you upload.

5. Your instructions

• We process your data only on your documented instructions. These are the Terms of Service, this agreement, the orders and settings you make in your account, and any further instructions you send by email to hello@boonvid.com. This also applies to transfers of data to countries outside the European Union.
• If the law of the European Union or of one of its member states requires us to process your data differently, we tell you before we do so, unless that law forbids it.
• If we believe that an instruction breaks data-protection law, we tell you without undue delay.

6. Confidentiality

We make sure that everyone on our side who has access to your data has committed to confidentiality or is under a statutory obligation of confidentiality.

7. Security

We protect your data with technical and organisational measures under Article 32 GDPR. They are listed in short form in the annex at the end of this page. We may develop the measures further, but not lower the level of protection.

8. Sub-processors and other recipients

You give us general authorisation to use the following providers:

• Not every provider in this list receives your data. The column “Task” shows what each provider does.
• Where a provider processes your data on our behalf, we bind it by contract to data-protection obligations that protect your data at least as well as this agreement (Article 28(4) GDPR). We are liable to you for that provider as for ourselves.
• Before we add or replace a provider, we inform you by email to the address of your account. You may object to the change for reasons of data protection. We will then look for a solution with you; if we cannot find one, you may terminate your contract with us.

9. Help with the rights of people concerned

• People whose data is contained in what you upload can ask you for access, correction, deletion, restriction of processing and a copy of their data, or object to the processing. Taking into account the nature of our service, we help you answer such requests with suitable technical and organisational measures, as far as possible.
• If such a person contacts us directly about your data, we forward the request to you without undue delay and do not answer it ourselves unless you instruct us to.
• You can instruct us by email at any time to delete an order and its files early.

10. Help with security, breaches and impact assessments

Taking into account the nature of our service and the information available to us, we help you meet your obligations regarding the security of processing, the notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority (Articles 32 to 36 GDPR).

11. Personal data breaches

• If we become aware of a breach of the protection of your data — that is, a security incident in which your data is lost, destroyed, altered, disclosed or accessed without authorisation — we inform you without undue delay, where possible within 48 hours of becoming aware of it, by email to the address of your account.
• As far as we know it, we tell you what happened, which kinds of data and roughly how many people and records are affected, the likely consequences, what we have done or intend to do, and whom you can contact. If we do not yet know everything, we send what we know and add the rest as soon as we have it.

12. Deletion and return

• What you upload, the finished video, its subtitles, the list of sources and licences, the build logs and the check results are deleted automatically 90 days after delivery. If an order is never delivered, they are deleted 90 days after the order was created.
• On your instruction by email, we delete them earlier.
• After delivery, you can download the finished video for a limited time; this is how we return your data to you. Please download it promptly: once that time has passed or the files have been deleted, we can no longer return them.
• These rules also apply after our contract has ended.
• Backups: hourly copies of our databases and daily snapshots of our server’s data volume are kept for 14 days, encrypted, in Frankfurt. Data deleted under these rules can therefore remain in a backup for up to 14 days longer. We use backups only to restore the service; after a restore, the deletion rules apply to the restored data again.
• Alerts to our operator (section 8) can contain a short note of the automated content check that refers to the script. They are kept in our operator’s Telegram chat and in an internal folder on our server until our operator deletes them; the 90 days above do not apply to them.
• Booking records that we must keep by law (order and payment reference, plan, minutes, credits) are not your data under this agreement; our Privacy Policy applies to them.

13. Proof and audits

• On request, we give you all the information you need to verify that we meet the obligations in this agreement.
• We allow and contribute to audits, including inspections, carried out by you or by an auditor you appoint. Dates are agreed with us in advance. The auditor must be bound to confidentiality, and the audit should not disrupt our operations more than necessary.

14. Transfers outside the European Union

• Our servers and storage are in Frankfurt, Germany. The AI models are provided by Anthropic PBC (USA) through the Anthropic API (section 8). Anthropic stores the data in the USA; the models may also process it in other countries.
• Firehorse Media LLC is a company in the United States. Some of the providers named in section 8 are in the United States. Transfers of data to them are based on the EU–US Data Privacy Framework or on the providers' standard contractual clauses; for Anthropic, on the standard contractual clauses in Anthropic's data processing addendum.
• Telegram (section 8) is based outside the European Union, in the United Arab Emirates, for which there is no adequacy decision of the European Commission. It receives only the alerts to our operator described in section 8.

15. Contact

Instructions, questions and requests about this agreement: hello@boonvid.com

Annex: Technical and organisational measures (short form)

• Location: servers and storage in Frankfurt, Germany (AWS region eu-central-1); AI processing by Anthropic PBC as described in section 8.
• Encryption in transit: data is transferred over encrypted connections (TLS).
• Encryption at rest: files in storage (Amazon S3) are stored encrypted.
• Access control: only authorised persons have access to your data.
• Sign-in: with a code sent by email, or optionally with Google; no passwords are stored. Sessions end after 8 hours and are stored on the server only as a hash (SHA-256). Repeated wrong codes lock the sign-in with a code for that address for a while.
• Separation: each customer's data is kept separate from that of other customers.
• Logs: server logs are deleted after 30 days.
• Backups: hourly copies of the databases and daily snapshots of the data volume, encrypted, in Frankfurt; deleted after 14 days.
• Deletion: an automatic deletion run checks every day and deletes the files of each order 90 days after delivery (or 90 days after the order was created, if it was never delivered), on our servers and in storage.
• No AI training: customer data is not used to train AI models.

Version: 26 September 2026 · Deutsche Fassung