Data Processing Agreement

2.1 Subject Matter

CreatoRain processes personal data on behalf of the Controller solely for the purpose of providing the Services, which include the CreatoRain restaurant influencer marketing platform, campaign management tools, influencer discovery and matching, analytics and reporting, and related managed services.

2.2 Nature of Processing

The processing activities performed by CreatoRain include:

• Collection and storage of influencer profile data and social media metrics
• Matching restaurants with influencers based on location, niche, and follower and engagement counts
• Managing campaign communications between restaurants and influencers
• Processing and analyzing campaign performance data and engagement metrics
• Facilitating payment transactions between restaurants and influencers
• Generating analytics reports using aggregated and individual-level data
• Storing and managing user-generated content including photos, videos, and reviews

2.3 Categories of Data Subjects

Personal data processed under this DPA relates to the following categories of Data Subjects:

• Restaurant owners, managers, and authorized personnel
• Influencers and content creators whom the Customer adds to a campaign, imports, contacts, books, or pays through the platform, whether or not they have registered
• End consumers whose data is captured through campaign interactions
• Customer employees and authorized users of the platform

CreatoRain collects public creator profiles for its own creator search as a controller under its Privacy Policy, not under this DPA. When the Customer imports a creator CreatoRain does not already hold, CreatoRain also adds that creator's name, handle, and email address to its own creator search, which other customers can search. When the Customer adds or corrects a creator's email address, including through a creator list the Customer has shared by link, CreatoRain saves that address to the same creator search. CreatoRain holds these copies as a controller under its Privacy Policy, not under this DPA. Email conversations the Customer imports stay with the Customer's campaigns, and other customers cannot open them.

2.4 Types of Personal Data

The types of personal data processed include:

• Contact information (name, email address, phone number, mailing address)
• Social media account information (handles, follower counts, engagement metrics)
• Demographic information: location, niche and interests, and likely gender, from the influencers.club search the creator matched, from our data provider Bright Data, or from the creator's public profile (such as pronouns)
• Financial information (payment details, transaction records, compensation amounts)
• Content data (photos, videos, captions, reviews created through campaigns)
• Platform usage data (login history, feature usage, communication logs)
• Communications content (emails, text messages, and transcripts and summaries of video meetings)

2.5 Duration of Processing

CreatoRain will process personal data for the duration of the Client Agreement, plus any retention period required by applicable law or as specified in Section 9 of this DPA.

4.1 Response Obligations

CreatoRain shall assist the Controller in responding to requests from Data Subjects to exercise their rights under applicable Data Protection Laws. These rights may include the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing.

4.2 Notification

If CreatoRain receives a request directly from a Data Subject regarding personal data processed on behalf of the Controller, CreatoRain shall promptly notify the Controller and shall not respond to the request without the Controller's prior written authorization, unless required by applicable law.

4.3 Technical Assistance

CreatoRain shall provide the Controller with self-service tools within the platform where feasible to facilitate the retrieval, export, correction, and deletion of personal data. Where such tools are not available, CreatoRain shall provide reasonable assistance upon the Controller's written request.

5.1 General Authorization

The Controller provides general written authorization for CreatoRain to engage subprocessors to assist in the delivery of the Services. CreatoRain keeps a current list of its subprocessors at creatorain.com/subprocessors.

5.2 Notification of Changes

CreatoRain shall notify the Controller of any intended changes regarding the addition or replacement of subprocessors at least thirty (30) days prior to the engagement of such subprocessor, providing the Controller with the opportunity to object to such changes. Notification will be sent by email to the Controller's account administrator, and the Subprocessors page will be updated at the same time.

5.3 Objection Right

If the Controller objects to a new subprocessor on reasonable grounds related to data protection, CreatoRain shall use commercially reasonable efforts to make available an alternative arrangement. If no alternative can be agreed upon within thirty (30) days, either party may terminate the affected Services without penalty.

5.4 Subprocessor Checks and Liability

Section 5 of the Subprocessors page describes the checks CreatoRain makes before adding a subprocessor. CreatoRain remains fully liable to the Controller for each subprocessor's processing of personal data for the Services.

5.5 Current Subprocessors

The Subprocessors page at creatorain.com/subprocessors lists every subprocessor that processes personal data for the Services. A copy is also available on written request to privacy@creatorain.com.

6.1 Encryption

• Personal data sent between users and the CreatoRain platform is encrypted in transit using TLS 1.2 or higher
• The production database is encrypted at rest with an AWS Key Management Service key, and files stored in Amazon S3 are encrypted at rest with AES-256
• The database encryption key is held in AWS Key Management Service, which rotates it automatically
• Database backups are encrypted using the same standards as production data

6.2 Access Control

• Access to personal data is limited to the personnel who operate the platform and need it for their work
• Administrative activity on CreatoRain's AWS account is recorded with AWS CloudTrail, and Amazon GuardDuty watches the account for signs of compromise

6.3 Incident Response

CreatoRain's incident response includes:

• Procedures for detecting, reporting, and investigating Security Incidents
• Notification to the Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Security Incident that affects personal data processed on behalf of the Controller
• The notification shall include the nature of the incident, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the incident
• Cooperation with the Controller in investigating and remediating the Security Incident
• Post-incident review and implementation of corrective measures to prevent recurrence

6.4 Additional Security Measures

• Physical security of the data centers, including access control, surveillance, and environmental controls, is provided by Amazon Web Services
• The production database is backed up daily and can be restored to any point in time within the last 35 days, and a full restore from backup was tested in August 2026

7.1 International Transfers

CreatoRain's production systems run in the United States, on Amazon Web Services. Some Subprocessors process personal data in other countries. CreatoRain uses DeepSeek's AI models to write campaign emails and replies, to check AI-drafted replies before they are sent, and to help find and match creators. DeepSeek is also a backup for CreatoRain's other AI features, such as reading replies. DeepSeek processes personal data in China, and Subprocessors such as Google may process it in any country where they operate. CreatoRain's staff may also access it from outside the United States. The Subprocessors page lists each Subprocessor, what it does, and where it is based, and its Section 5 describes the checks CreatoRain makes before adding one, including how any cross-border transfer is covered.

7.2 Transfer Impact Assessments

CreatoRain shall cooperate with the Controller in conducting transfer impact assessments where required by applicable Data Protection Laws and shall implement supplementary measures as necessary to ensure that the level of protection of personal data is not undermined by the transfer.

8.1 Controller Audit Rights

CreatoRain shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. The Controller, or an independent third-party auditor appointed by the Controller, may conduct audits of CreatoRain's data processing activities, subject to the following conditions:

• The Controller shall provide at least thirty (30) days' prior written notice of any audit
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with CreatoRain's operations
• The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by CreatoRain
• Auditors must execute a confidentiality agreement before accessing CreatoRain's systems or information
• Audits shall be limited to once per twelve-month period unless required by a supervisory authority or triggered by a Security Incident

8.2 Documentation in Place of an Audit

CreatoRain may satisfy audit requests by providing the Controller with documentation demonstrating compliance with this DPA, such as a written description of its security measures and answers to a reasonable security questionnaire. The Controller agrees that such documentation may be used to satisfy audit obligations where reasonably sufficient.

9.1 Upon Termination

Upon termination or expiration of the Client Agreement, or upon the Controller's written request, CreatoRain shall, at the Controller's election:

• Return all personal data to the Controller in a commonly used, machine-readable format; or
• Delete all personal data processed on behalf of the Controller from the production systems, with copies in backups removed as the Data Retention Policy describes

9.2 Transition Period

CreatoRain shall provide the Controller with a period of thirty (30) days following termination to request the return of personal data. After this period, CreatoRain shall delete all remaining personal data unless retention is required by applicable law.

9.3 Certification of Deletion

Upon the Controller's written request, CreatoRain shall provide written certification that all personal data has been deleted from the production systems in accordance with this DPA, except where retention is required by applicable law, and shall say which backups or snapshots may still hold copies. Any retained data shall continue to be protected in accordance with this DPA.

10.1 Allocation of Liability

Each party's liability arising from or related to this DPA shall be subject to the limitation of liability in Section 10 of the Client Agreement. Nothing in this DPA shall limit either party's liability for breaches of applicable Data Protection Laws to the extent such limitation is prohibited by law.

10.2 Indemnification

Each party shall indemnify and hold harmless the other party from and against any fines, penalties, claims, damages, or losses arising from the indemnifying party's breach of this DPA or applicable Data Protection Laws, to the extent that such breach is attributable to the indemnifying party's acts or omissions.