Data Processing Addendum (DPA)

Effective date: February 16, 2026

This DPA describes how Vid Hub acts as a processor for customer-uploaded media on behalf of customers (controllers).

Scope

• Purpose of processing: subtitle generation, translation, artifact delivery, billing, and abuse prevention.
• Categories of data: uploaded media, generated subtitle artifacts, account identity fields, billing metadata, audit logs.
• Data subjects: customer users and individuals appearing in customer-provided media.

Processing instructions

• Vid Hub processes data only per customer instructions expressed through API/UI actions.
• Automated processing includes transcription, translation, artifact storage, and retrieval.
• Retention defaults to 7 days for media artifacts unless extended by explicit customer configuration or legal obligations.

Security controls

• Access control via bearer authentication and tenant ownership checks.
• Webhook signature verification with idempotent event deduplication.
• Audit event recording for security and billing actions.
• Encrypted transport (HTTPS) for API and third-party provider communication.

Sub-processors

• OpenAI (transcription/translation model APIs)
• Clerk (authentication/JWKS token validation)
• Lemon Squeezy (billing and webhooks)
• AWS S3-compatible object storage providers (artifact storage)
• Sentry (error monitoring, if enabled by operator)

Data subject rights and customer obligations

• Customers remain responsible for lawful basis and notices to data subjects.
• Customers may request deletion/export via support channels; Vid Hub will assist controller obligations where applicable.

Cross-border transfers

• Where applicable, Vid Hub relies on provider contractual safeguards (e.g., SCCs) for international transfers.

Governing law and jurisdiction

• Governing law: State of Israel.
• Venue: competent courts in Tel Aviv-Yafo, Israel, unless otherwise required by mandatory law.