Data Processing Addendum

Last updated: November 20, 2025

1. Introduction & Scope

This DPA forms part of the agreement between Space Marvel AI ("Processor") and the Customer ("Controller"). It governs processing of personal data under the GDPR, India's DPDP Act 2023, and other applicable data protection laws.

2. Processor Obligations

Space Marvel AI agrees to: process personal data only on documented instructions from the Controller; ensure authorised persons are bound by confidentiality; implement appropriate technical and organisational security measures; assist with data subject rights requests; delete or return all personal data upon termination.

3. International Transfers

Where personal data is transferred outside the Controller's jurisdiction, Space Marvel AI relies on standard contractual clauses (SCCs) approved by the relevant supervisory authority, or such other lawful transfer mechanism as applicable.

4. Breach Notification

Space Marvel AI will notify the Controller of a personal data breach without undue delay, and in any event within 48 hours of becoming aware. The notification will include the information required by applicable law to enable the Controller to meet its own notification obligations.

5. Sub-Processors

Current sub-processors: AWS (cloud infrastructure, ap-south-1 Mumbai), Cloudflare (CDN/DDoS), Anthropic (Claude AI), OpenAI (GPT, optional), Google DeepMind (Gemini, optional), Razorpay (India payments), Stripe (international payments), Resend (email), Twilio (SMS/voice), PostHog (analytics, self-hosted EU), Sentry (error tracking), Datadog (monitoring).