Data Processing Addendum.

This Data Processing Addendum ("DPA") governs Developum AI Inc.'s processing of Personal Data on behalf of Customer in connection with the EVOLUM platform and other Developum services. It is incorporated into and forms part of our Terms of Service. If Customer requires a signed DPA for internal records, the version at this URL is available on request as an executable document via security@developumaiengine.com.

1. Definitions

Terms used in this DPA have the meanings given in the GDPR unless otherwise defined. For clarity:

• "Customer" means the individual or entity that has accepted our Terms of Service.
• "Developum," "we," or "us" means Developum AI Inc., a Delaware C-Corporation.
• "Personal Data" means information relating to an identified or identifiable person that Customer submits to the EVOLUM platform.
• "Processing" has the meaning given in Article 4(2) GDPR.
• "Sub-processor" means a third party engaged by Developum to process Personal Data on Customer's behalf. Our current list is at /subprocessors.

2. Scope & Roles

Under this DPA, Customer is the data controller and Developum is the data processor for Personal Data submitted to the platform. Each party shall comply with its respective obligations under applicable data-protection law.

3. Nature and Purpose of Processing

Developum processes Personal Data solely to provide the EVOLUM service Customer has subscribed to. This includes:

• Storing screenplays, project data, and account information submitted by Customer.
• Running deterministic analyses on Customer content (locally, without transmission to third-party AI providers).
• Facilitating communication between Customer and other platform users (e.g., cast members, investors) that Customer has explicitly invited or engaged with.
• Delivering platform notifications, security alerts, and account-related communications.

Developum does not use Personal Data for advertising, does not train external AI models on it, and does not sell it.

4. Categories of Data Subjects and Data

Data Subjects

• Customer's own users, cast members, crew, or invited collaborators.
• Individuals whose personal data Customer chooses to include in creative documents (character sketches based on real people, cast contact information, etc.).

Categories of Personal Data

• Contact information (name, email, phone) provided during signup or added by Customer.
• Content data (uploaded scripts, treatments, images) which may incidentally contain personal data.
• Payment metadata (Stripe customer ID, subscription state) — but not payment card numbers, which never touch our systems.
• Access logs (IP address, session timestamps) for security and audit purposes.

5. Sub-processors

Customer authorizes Developum to engage the sub-processors listed at /subprocessors to help deliver the service. That list is kept current. Developum will:

• Impose written data-protection obligations on each sub-processor that are no less protective than this DPA.
• Remain responsible for each sub-processor's compliance with those obligations.
• Provide at least 30 days' prior notice before adding or replacing a sub-processor, giving Customer an opportunity to object. If Customer reasonably objects, we will work to accommodate the objection or, failing that, Customer may terminate the affected service.

6. Security Measures

Developum implements the technical and organizational measures documented in our Security Overview and Trust Center. In summary:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 via Supabase-managed storage).
• Row-Level Security at the database layer.
• Role-based access control with least privilege.
• Automated backup verification and RLS auditing.
• Incident response with 72-hour notification for confirmed data-affecting incidents.

7. Data Subject Requests

Where Customer receives a request from a data subject to exercise their rights (access, rectification, erasure, portability, restriction, objection), Developum will assist Customer to the extent reasonably possible. Customer is responsible for verifying the requestor's identity and responding within regulatory deadlines.

Developum-facilitated requests can be initiated at privacy@developumaiengine.com.

8. Personal Data Breach Notification

Developum will notify Customer without undue delay — and in any event within 72 hours of becoming aware — of any Personal Data Breach affecting Customer's data. The notification will describe the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and the measures taken or proposed to address it.

9. International Transfers

Where Personal Data is transferred outside the EEA, UK, or Switzerland, Developum relies on the Standard Contractual Clauses ("SCCs") published by the European Commission and, for UK transfers, the UK International Data Transfer Addendum, in each case as incorporated by reference into this DPA. Copies available on request.

10. Deletion and Return of Data

Upon termination of the underlying service, Developum will, at Customer's choice, delete or return all Personal Data within 30 days of termination, subject to any legal obligation to retain certain records. Backups containing Customer data are overwritten in the normal rotation cycle (documented in the DR/BCP).

11. Audits

Customer may audit Developum's compliance with this DPA once per calendar year with 30 days' written notice. Developum will provide reasonable access to relevant records, personnel, and facilities, subject to confidentiality. Where Developum has undergone or engages a third-party audit (including future SOC-2 Type II attestation), the resulting report may satisfy this obligation.

12. Contact

For all DPA-related matters, contact privacy@developumaiengine.com.