Legal
Data Processing Agreement
1. Parties and how this agreement is concluded
This data processing agreement (“DPA”) is concluded between you, the customer who accepted the Terms of Service (“Controller”), and Nils Knäpper, Brand-Pipe, c/o Online-Impressum 10839, Europaring 90, 53757 Sankt Augustin, Germany (“Processor”). It is concluded in electronic form under Article 28(9) GDPR when you accept the Terms of Service on the sign-up page or the key claim page; no signature is needed. If you need a signed copy for your records, write to support@brand-pipe.com.
It applies where the videos, logos or caption files you submit (“Content”) contain personal data of other people and the GDPR applies to your processing. For your own account data (email address, key, credit balance) Brand-Pipe is a controller; see the privacy policy.
2. Subject matter, duration, nature and purpose
- Subject matter and purpose. Providing the Service described in the Terms of Service: downloading the Content from the URLs you supply, re-encoding it (format, logo overlay, loudness, burned-in captions), storing the result and making it available to you through a signed link.
- Duration. For as long as you use the Service. Each item of Content is processed only for the length of a request or job; results and job records are stored for 24 hours.
- Types of personal data. Whatever the Content contains, typically image, voice and spoken or written statements of people who appear in a video, and names or handles in captions and logos. The Service does not analyse, transcribe, index or recognise people in the Content.
- Data subjects. People who appear or are mentioned in the Content, as chosen by the Controller.
- Special categories. The Service is not designed for special categories of personal data (Article 9 GDPR). Whether Content reveals such data is decided by the Controller alone, who must have a legal basis for it.
3. Documented instructions
The Processor processes the Content only on documented instructions from the Controller. The instructions are the Terms of Service, the documentation and each API request you send, which states what to process and how. The Processor will tell you without delay if it considers an instruction to infringe data protection law, and may suspend that instruction until you confirm or change it. If Union or Member State law requires other processing, the Processor informs you beforehand unless that law forbids it.
4. Confidentiality
Brand-Pipe is operated by one person, who is bound to confidentiality by this DPA. Anyone the Processor authorises to access Content in the future will be committed to confidentiality in writing before getting access. Content is not viewed by a human except where this is needed to investigate a report of illegal content (Terms of Service, section 9), a security incident, or a support request in which you ask for it.
5. Security
The Processor takes the technical and organisational measures in Annex 1 (Article 32 GDPR). Measures may be developed further as long as the level of protection does not drop.
6. Sub-processors
You give general authorisation to engage the sub-processors in Annex 2. Each is bound by a data processing agreement that imposes data protection obligations equivalent to this DPA. The Processor announces a new or replaced sub-processor by email at least 30 days in advance. You may object for good reason within that period; if no solution is found, either party may terminate the contract and unused purchased credits are refunded as set out in the Terms of Service. The Processor remains responsible to you for its sub-processors.
7. Transfers outside the EU/EEA
Content is processed and stored in the EU (Annex 2). Where a sub-processor is a company based in the United States or has a US parent, any transfer takes place on the basis of an adequacy decision (EU-US Data Privacy Framework) or the EU standard contractual clauses.
8. Helping you meet your obligations
- Data subject requests. The Processor cannot identify people in the Content. If a data subject contacts the Processor about Content, the request is passed on to you without delay where the customer can be identified, and is not answered on your behalf. Because results are deleted after 24 hours, erasure is usually complete before a request arrives; on your request a result is deleted earlier.
- Security, breach notification, impact assessments. Taking into account the nature of the processing and the information available, the Processor assists you with your duties under Articles 32 to 36 GDPR.
9. Personal data breaches
The Processor notifies you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your Content, by email to the address used at sign-up or checkout. The notice describes what happened, what data is likely to be affected, and what was done about it, as far as this is known at the time.
10. Deletion and return
Source files are deleted from the processing instance as soon as the request or job ends. Results and job records are deleted automatically 24 hours after they were created; backups of Content are not made. You return the data to yourself by downloading the result within that time. When the contract ends nothing further remains to be deleted, unless Union or Member State law requires storage.
11. Information and audits
The Processor makes available the information needed to demonstrate compliance with Article 28 GDPR and answers reasonable written questionnaires. If that is not sufficient, you or an auditor bound to confidentiality may carry out an audit with at least 30 days' notice, during business hours, not more than once a year unless there is a specific reason, and without access to data of other customers. The infrastructure of the sub-processors in Annex 2 is audited through their certifications and audit reports (such as ISO 27001 and SOC 2), which the Processor passes on where they are available to it. Each party bears its own audit costs.
12. Liability and precedence
Article 82 GDPR applies to claims of data subjects. Between the parties, liability follows section 11 of the Terms of Service. On data protection matters this DPA prevails over the Terms of Service. German law applies.
Annex 1. Technical and organisational measures
- Encryption in transit. The website and the API are reachable over HTTPS only. Source files are downloaded from the URL you supply using the scheme you chose, so use an https URL.
- Encryption at rest. Results and job records are stored on Cloudflare R2 and logs on Google Cloud, both of which encrypt stored data by default.
- Access to results. The storage bucket is private. A result is reachable only through a signed link that expires after one hour. A job can be queried only with the API key that submitted it; any other key receives
404. - Authentication. API keys are shown once and stored as hashes by the key service, not in plain text. Each key carries a rate limit. Internal endpoints accept only requests carrying an identity token of the service's own account and are blocked at the edge.
- Separation. Each request or job runs in its own working directory, which is removed when it ends. Customers are separated by key and job id.
- Data minimisation and deletion. Source files are not kept after processing. Results and job records are removed by a storage lifecycle rule after 24 hours. Logs hold request metadata, not Content, have query strings removed, and are kept for 30 days.
- Location. Processing runs on Google Cloud Run in Frankfurt (europe-west3); results are stored on Cloudflare R2 with EU jurisdiction.
- Network protection. A web application firewall in front of the API admits only the documented paths. Source and callback URLs are checked so that they cannot address private, loopback or cloud-internal networks.
- Administration. One operator has administrative access. Production credentials are held in Google Secret Manager, not in the source code, and are split by purpose so that the request path holds only the permissions it needs. The service runs under a dedicated service account.
- Integrity and change control. Every change passes an automated test suite that runs inside the deployment image before it is released; deployments are versioned and can be rolled back.
- Availability. The Service holds no data that needs a backup: Content is transient and you keep the originals. Failed requests are reported with an error envelope and are safe to retry with an
Idempotency-Key.
Annex 2. Sub-processors
- Google Cloud EMEA Limited, Ireland. Processing of Content (Cloud Run), job queue and logs, region Frankfurt. Sees Content: yes, transiently during processing.
- Cloudflare, Inc., USA. Storage of results and job records (R2, EU jurisdiction), and delivery and protection of the API (proxy, firewall). Sees Content: yes, stored results for 24 hours.
- Unkey, Inc., USA. Verification of API keys, credit counting, rate limiting. Sees Content: no.
- Polar Software, Inc., USA. Sale of credits as merchant of record. Sees Content: no. Polar acts as an independent controller for the purchase.