Data processing agreement
This agreement under article 28 of the GDPR (Regulation 2016/679) is part of the contract between the customer named in the order form ("Customer", the controller) and Artide Innova SRL, Via Rosina Sessa 16, 84128 Salerno, Italy, VAT IT06198200658, REA SA-504766 ("Artide", the processor) for the hosted rushbin service. It applies to the personal data that Artide processes on the Customer's behalf ("Customer Data"). It does not apply to the data Artide processes as controller, described in the privacy policy, nor to rushbin installed by the Customer on its own servers, where Artide processes nothing.
1. Instructions
Artide processes Customer Data only to provide the service and on the Customer's documented instructions: the contract, this agreement, and what the Customer's members do in rushbin. If Artide is required by EU or Italian law to process Customer Data otherwise, it tells the Customer first, unless the law forbids it. Artide tells the Customer if it believes an instruction infringes data protection law. The details of the processing are in annex 1.
2. The Customer's responsibilities
The Customer is responsible for the lawfulness of the processing it instructs, including a legal basis for, and information to, the people who appear or speak in its footage, and for deciding which drives get search by content and light copies.
3. Confidentiality
Only personnel who need it to run the service have access to Customer Data, and they are bound to confidentiality.
4. Security
Artide applies the technical and organizational measures in annex 2, appropriate to the risk under article 32 GDPR. It may improve them over time but not reduce the overall level of protection.
5. Sub-processors
The Customer gives general authorization to the sub-processors in annex 3. Artide informs the Customer's owners by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within 10 days; if the parties find no solution within 30 days, the Customer may terminate the affected service and receive a refund of fees paid for the remaining period. Artide binds each sub-processor to data protection obligations equivalent to these and remains responsible to the Customer for them.
6. Where the data is
Customer Data is stored in the European Union: the site and its database on servers in Frankfurt, Germany, the emails the site sends through Amazon SES in the same region, and the stored files and database copies in Cloudflare R2 buckets with the EU jurisdiction. Some sub-processors are established in the United States, or belong to groups that are, and may access Customer Data from there; for Tidy up with AI, the description of a drive that a member chooses to tidy goes to Anthropic, the only AI provider Artide's site uses. The Customer authorizes these transfers, each covered by the tool listed in annex 3: the EU-U.S. Data Privacy Framework (Commission Decision 2023/1795) and/or the standard contractual clauses (Commission Decision 2021/914, module three). Artide makes no other transfer outside the European Economic Area without the Customer's prior written consent and a valid transfer mechanism under chapter V of the GDPR. Artide gives the Customer a copy of the standard contractual clauses on request.
7. Requests from people
Artide helps the Customer answer requests from people exercising their rights under chapter III of the GDPR. If a person writes to Artide about Customer Data, Artide passes the request on to the Customer without undue delay and does not answer it on its own, unless the Customer asks it to.
8. Personal data breaches
Artide notifies the Customer of a personal data breach affecting Customer Data without undue delay and within 48 hours of becoming aware of it, with what is known: its nature, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. It then gives further information as it becomes available, so the Customer can meet its own duties under articles 33 and 34 GDPR.
9. Other assistance
Artide gives the Customer the information it reasonably needs for data protection impact assessments and prior consultations concerning the service.
10. Audits
Artide makes available the information necessary to show compliance with this agreement and answers the Customer's reasonable written questions. Once a year, or after a breach, the Customer may audit Artide's compliance itself or through an independent auditor bound to confidentiality, with 30 days' notice, during business hours and at its own cost.
11. End of processing
At the end of the contract Artide, at the Customer's choice, returns Customer Data, with its exportable metadata, in a structured, commonly used and machine-readable format, or deletes it. Without a request to return it, Artide deletes it within 30 days. When the Customer switches provider or asks for its data under clause 12 of the terms of service, the export and the retrieval follow that clause, and Artide deletes the data at the end of the retrieval period. The Customer's owners can also download an export of the team's data from the site at any time, as set out in clause 12 of the terms of service. Copies in database backups are deleted within a further 31 days. Artide may keep Customer Data only where EU or Italian law requires it.
12. Liability and duration
The liability of each party under this agreement follows the contract, without prejudice to articles 82 and 83 GDPR. This agreement lasts as long as Artide processes Customer Data. It is governed by Italian law and the court of Salerno has exclusive jurisdiction.
Annex 1: the processing
| Subject matter and duration | Hosting the Customer's rushbin team site, for the term of the contract and until deletion under clause 11. |
|---|---|
| Nature and purpose | Storing, indexing, searching and showing to the Customer's members the catalog of its drives and what its rushbin apps extracted from its footage; storing light copies and originals requested by members; nightly database backups; sending the site's emails (invites, password links, sign-up confirmations) through Amazon SES; when a member asks for it for a drive (Tidy up with AI), passing the description of that drive (folder and file names with sizes, dates, durations and codecs) to Anthropic's Claude and returning the proposed reorganization to the member's app. |
| Categories of people | The Customer's members (staff and collaborators); people who appear or speak in the Customer's footage, such as clients, interviewees, crew, performers and the public at events; people named in file and folder names. |
| Categories of data | Members: name, email, role, decisions taken on footage (including hiding lines of a transcript and marking a transcript as checked). Footage: file and folder names and paths, technical details (size, duration, format), previews (5 frames per clip), light copies (video and audio), originals requested (kept 7 days), transcripts of speech, text visible on screen, automatic labels, numeric image vectors used for search by content. Transcripts, on-screen text and labels are made by AI models on the Customer's computers and are marked as made by AI. No face recognition, other biometric identification, emotion recognition or biometric categorisation is performed. |
| Special categories | None intended. Footage may reveal special categories of data (for example health, religious or political opinions in an interview) as part of its content; rushbin does not extract or classify them. |
| Frequency | Continuous, while the service is used. |
| Retention | As decided by the Customer while the contract lasts; originals requested by members are deleted after 7 days, and the records of the requests (who asked, the file, its path and hash, the state) 90 days after their last change; when a member turns off "Send to the team" for a drive, the site deletes at once that drive's catalog, previews, analyses, transcripts, vectors, light copies and original files, keeping only the data of clips also on other drives of the team; decisions and records of removals on request stay when a drive is removed; the site keeps nothing of a description sent for Tidy up with AI, only how many tidy-ups the team ran in the current month, deleted when the month ends; under Anthropic's commercial terms, Anthropic may not train models on the description, and under its rules for the API it deletes the description and its answer within 30 days, unless the law requires it to keep them longer or its safety systems flag them as a breach of its usage policy (then up to 2 years, and the safety classification scores up to 7 years); deletion at the end under clause 11. |
Annex 2: technical and organizational measures
Access control
Members sign in with email and password; passwords are stored only as bcrypt hashes; session, invite and reset tokens and the codes that connect a Mac are random and stored only as hashes; each works once: invite links and the password links an owner makes for 7 days, password links sent by email for 1 hour, codes that connect a Mac for 10 minutes. At most 5 emails per address and 100 per site every 15 minutes. Roles (owner, editor, viewer) limit what each member can do. Repeated failed sign-ins are blocked per email and per network address. Owners can remove members, which ends their sessions.
Separation of customers
Every query is filtered by team, and the database enforces row level security for team data through a role without access to other teams' rows.
Encryption and links
All connections use HTTPS (TLS certificates from Let's Encrypt). Light copies and originals are reached through signed links that expire within an hour; the storage bucket is not public.
Web security
A strict Content Security Policy, no framing by other sites, writes accepted only from the site's own origin, the session cookie not readable by scripts and sent only over HTTPS.
Availability and resilience
Nightly database backups to the storage in the EU, one per day for the last 31 days, each downloaded again and checked after it is made; containers restart by themselves after a failure.
Minimization
Speech, on-screen text and images are analyzed on the Customer's own computers, not on Artide's servers, and only for the drives where the Customer turns it on; light copies are uploaded only for the drives where the Customer turns them on. The site never receives the original footage, except originals a member asks for, which are deleted after 7 days. Tidy up with AI sends Anthropic only names and technical details, never file contents or frames, and only for a drive a member confirms; the site does not log them. No face recognition. Server logs are rotated by size, at most 50 MB for each of the site's services.
Organization
Access to the servers is limited to Artide personnel who run the service, with personal SSH keys. Software changes are tested automatically before release. Security reports are handled as described in the project's SECURITY.md.
Annex 3: sub-processors
| Sub-processor | What it does | Where the data is | Transfer tool |
|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg (AWS Lightsail and Amazon SES) | Server running the site, its database and the search model (Lightsail); sending the site's emails: invites, password links and sign-up confirmations, with the recipient's address, the team's name, the name of who invites or makes the link, and the link (SES) | Frankfurt, Germany (eu-central-1) | For access by Amazon group companies in the United States: EU-U.S. Data Privacy Framework and standard contractual clauses (module three) in AWS's data processing addendum |
| Cloudflare, Inc., United States (R2 and DNS) | Object storage of light copies, requested originals and database copies (R2); DNS for Artide's domains | R2: European Union (buckets with the EU jurisdiction) | EU-U.S. Data Privacy Framework; the 2021 standard contractual clauses (module three) as fallback, in Cloudflare's customer data processing addendum |
| Anthropic Ireland, Limited (Claude API) | Proposing a reorganization of a drive (Tidy up with AI), only when a member asks for it: receives the folder and file names of that drive with their sizes, dates, durations and codecs | Outside the European Union | Standard contractual clauses (module three) in Anthropic's data processing addendum |
When a member uses Tidy up with AI with an AI and a key of their own, set in the app, the description goes from their computer straight to the provider they chose, under their own agreement with it: Artide does not receive it, and that provider is not Artide's sub-processor.