Data Processing Addendum

Last updated: October 19, 2026

This Data Processing Addendum ("DPA") forms part of the Retaincast Terms of Service between Media Yard LLC ("Media Yard", the "Processor") and the customer ("Customer", the "Controller"), and applies where the GDPR, UK GDPR, or similar data-protection law applies to personal data in the content and platform data Customer processes through the Service ("Customer Data").

1. Roles and scope

For Customer Data, Customer is the controller and Media Yard is the processor. For account, billing, waitlist, and usage data, Media Yard is an independent controller under the Privacy Policy.

2. Details of processing

• Subject matter & purpose: hosting, analyzing, publishing, and reporting on video and script content and its platform analytics, as described in the Terms.
• Duration: the term of the Customer's use of the Service.
• Data types: submitted content (video, audio, text, images), platform identifiers and tokens, platform analytics including audience-retention data.
• Data subjects: the Customer, persons appearing in Customer content, and the Customer's audience (in aggregate analytics form).

3. Processor commitments

• Process Customer Data only on the Customer's documented instructions — the Terms, the Customer's use of the Service, and this DPA — unless law requires otherwise.
• Ensure persons processing Customer Data are bound by confidentiality.
• Implement appropriate technical and organizational measures: encryption in transit, access-controlled and key-gated infrastructure, minimal data collection.
• Assist the Customer, taking into account the nature of processing, with data-subject requests, security, breach notification, and data-protection impact assessments.
• Notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data.
• At termination, delete or return Customer Data on request, unless law requires retention.
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits as required by Article 28(3)(h) GDPR.

4. Subprocessors

Customer authorizes these subprocessors: Cloudflare, Inc. (hosting, storage, database — USA/global edge), Resend, Inc. (delivery of service emails — USA), Anthropic, PBC (AI analysis of submitted content — USA), and, at the Customer's direction through platform connections, Google LLC (YouTube), TikTok, and Meta Platforms (Instagram). We will give at least 30 days' notice of new subprocessors (via this page's "Last updated" date and, for account holders, by email), during which the Customer may object on reasonable data-protection grounds. Media Yard remains responsible for its subprocessors' performance.

5. International transfers

Customer Data is processed in the United States. Where Chapter V GDPR applies, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two: controller → processor), with Media Yard as data importer and the Customer as data exporter; for UK transfers, the UK International Data Transfer Addendum to the SCCs applies. For a countersigned copy, email support@retaincast.com.

6. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms regarding processing of Customer Data, this DPA prevails.

7. Contact

Media Yard LLC, New Jersey, USA — support@retaincast.com