Ossavi Back to the site

Data Processing Addendum

Effective date: October 20, 2026

This Data Processing Addendum (“DPA”) forms part of the Ossavi Terms of Service between Render Forge LLC (“Render Forge,” “Processor”) and the Customer identified through its Ossavi Studio or an applicable order form (“Customer,” “Controller”). It applies when Render Forge processes Customer Personal Data on behalf of Customer and the EU GDPR, UK GDPR, or another applicable law requires a processor agreement. Where Customer acts as a processor for a third-party controller, Customer represents that it is authorized to engage Render Forge as a subprocessor and to provide the instructions described here.

1. Definitions and scope

1.1 Customer Personal Data. Personal data included in images, files, comments, markup, collaborator records or other Content that Render Forge processes on Customer’s behalf to provide Ossavi. It does not include personal data that Render Forge independently controls for its own support, fraud prevention, legal compliance or account administration, nor payment information independently processed by Paddle as merchant of record.

1.2 Processing details. The subject matter, duration, nature, purposes, types of personal data and categories of data subjects are described in Annex A. The terms “controller,” “processor,” “personal data,” “processing” and “data subject” have their meanings under the applicable data-protection law.

1.3 Customer responsibility. Customer determines whether and on what lawful basis personal data may be submitted and shared through Ossavi. Customer is responsible for its notices, consents where needed, and the permissions it grants Users and Reviewers.

2. Instructions and confidentiality

2.1 Documented instructions. Render Forge will process Customer Personal Data only on Customer’s documented instructions, including those expressed by the Terms, this DPA, authorized configuration and use of the Service, and written support requests. This does not prevent processing required by applicable law, in which case Render Forge will inform Customer in advance unless prohibited by law. Render Forge will promptly inform Customer if it believes an instruction violates applicable data-protection law.

2.2 Authorized personnel. Render Forge will limit access to personnel who need it to deliver, operate, secure or support the Service and who are subject to confidentiality obligations. Render Forge will not use Customer Personal Data for advertising or to train artificial intelligence or machine-learning models.

3. Security and incidents

3.1 Technical and organizational measures. Render Forge will maintain appropriate measures considering the nature, scope and risks of processing, including the controls described in Annex B, and will periodically review their effectiveness. Render Forge may update measures without materially reducing overall protection.

3.2 Security incidents. After becoming aware of a personal-data breach affecting Customer Personal Data, Render Forge will notify Customer without undue delay and provide information reasonably available to assist Customer with any legally required notices and assessments. Updates may be provided as the investigation progresses. Notification does not constitute an admission of fault.

4. Requests and compliance assistance

Taking into account the nature of the processing and information available to it, Render Forge will reasonably assist Customer with data-subject access, correction, deletion, restriction, portability and objection requests; with security assessments and breach notifications; and, where appropriate, data-protection impact assessments and regulator consultations. If a person directs a request about Customer-controlled Content to Render Forge, Render Forge will refer the request to Customer unless law requires otherwise. Assistance beyond standard self-service functionality may be subject to reasonable, previously disclosed fees unless prohibited by law.

5. Subprocessors

5.1 General authorization. Customer generally authorizes the subprocessors listed in Annex C for the functions identified there. Render Forge will impose legally required confidentiality and data-protection obligations on its subprocessors and remains responsible for their processing on its behalf as required by applicable law. Paddle is not listed as a subprocessor for customer-controlled Studio Content because it independently acts as merchant of record for purchases.

5.2 Changes and objections. Render Forge will provide advance notice of material additions or replacements of subprocessors through the Service or by email where reasonably practicable, ordinarily at least 30 days before a new subprocessor begins processing Customer Personal Data. Customer may object on reasonable data-protection grounds within 15 days of notice by contacting support@ossavi.com. The parties will discuss a reasonable solution in good faith. If they cannot resolve the objection, Customer may discontinue the affected Service in accordance with its contractual and statutory rights.

6. Return, deletion and audits

6.1 Data return and deletion. Upon termination or a valid written request, Render Forge will delete Customer Personal Data from active systems in accordance with Section 8 of the Terms, except where retention is legally required. Customer may request assistance exporting data before deletion. Limited historical copies may remain in protected disaster-recovery backups until they expire under the stated retention schedule and will not be used for new processing except legally required purposes or disaster recovery.

6.2 Demonstrating compliance. Render Forge will make available information reasonably necessary to demonstrate compliance with its processor obligations. Where required by applicable law, Render Forge will allow and contribute to an appropriate audit or inspection by Customer or an independent auditor bound by confidentiality, on reasonable advance notice and subject to measures protecting other customers, systems and confidential information. Existing security documentation and third-party reports may be used first. Additional audit costs may be agreed in advance where permitted.

7. International transfers

Primary Ossavi hosting and off-site backups are located in the United States; an email provider based in Switzerland may process limited communications data. Where a restricted transfer of Customer Personal Data requires a legal transfer mechanism, the parties will put the applicable European Commission standard contractual clauses, UK International Data Transfer Addendum or another valid mechanism in place before that transfer. This DPA alone does not substitute for executing any required transfer clauses. Customers needing transfer paperwork should contact support@ossavi.com.

8. US state privacy obligations

To the extent US state privacy laws classify Render Forge as a service provider or processor for Customer Personal Data, Render Forge will use that information only to provide and protect the contracted Service or as otherwise permitted by law; will not sell or share it for cross-context behavioral advertising; will not retain, use or disclose it for unrelated commercial purposes; and will provide reasonable assistance necessary for Customer to meet applicable privacy obligations. The parties will inform each other if they can no longer comply with applicable obligations and will cooperate on appropriate remediation.

9. Relationship to other terms

This DPA is effective for the period Render Forge processes Customer Personal Data on Customer’s behalf and survives termination to the extent necessary for retained data. If this DPA conflicts with the Terms on privacy processing of Customer Personal Data, this DPA controls. Any executed standard contractual clauses prevail to the extent required by their terms and applicable law. The liability provisions of the Terms apply to this DPA except where prohibited by applicable law or superseded by executed transfer clauses.

Annex A. Description of processing

Subject matter and duration. Hosting, reviewing, sharing and administering visual content and related collaboration records for the duration of the Studio subscription and permitted retention periods.

Nature and purpose. Collection, storage, organization, transmission to authorized Users and Reviewers, generation of previews, security logging, backup, retrieval and deletion as instructed by Customer and required to provide Ossavi.

Data subjects. Customer personnel, invited collaborators, agency clients, reviewers, people identified in uploaded images or attachments, and other individuals whose information Customer decides to include.

Types of data. Names, email addresses, account identifiers and permissions, account access records, technical identifiers, images and other customer-submitted media, image annotations, communications, comment threads, reference files and project metadata. Customer may choose to upload images containing personal information of additional types; the Service is not designed for special-category or regulated health information.

Annex B. Security measures

Annex C. Authorized subprocessors

For information about the latest subprocessor arrangements or required transfer safeguards, contact support@ossavi.com.

Contact

Render Forge LLC
Washington, United States
support@ossavi.com