Data processing agreement.

1. Definitions

“Controller” means the customer (natural or legal person) who determines the purposes and means of the processing of personal data through the Moon AI platform.

“Processor” means STELLARR STUDIO, which processes personal data on behalf of the controller in the course of providing the Moon AI services.

“Sub-processor” means any third party engaged by STELLARR STUDIO to carry out processing operations on behalf of the controller.

“Personal data”, “Processing”, “Data breach” have the meaning given to them by Regulation (EU) 2016/679 (GDPR).

2. Purpose and duration

The purpose of this DPA is to define the conditions under which STELLARR STUDIO undertakes to carry out, on behalf of the controller, the personal data processing operations necessary to provide the Moon AI services.

This agreement takes effect on the date on which the customer accepts the Terms of Use and remains in force throughout the contractual relationship. The obligations relating to the confidentiality and security of the data survive the end of the contract.

3. Nature and purpose of the processing

STELLARR STUDIO processes personal data in the course of:

• Providing multi-model AI chat services
• Protecting data through Moon Blur (automatic, reversible masking)
• Generating documents and content
• Running agents and scheduled routines
• Managing user accounts and organizations
• Technical support and maintenance of the platform

4. Types of data and categories of data subjects

• Types of data processed

  • Identification data (name, email)
  • Connection data (IP address, logs)
  • Content of AI conversations
  • Generated and imported documents
  • Platform usage data
  • Billing data

• Categories of data subjects

  • Users of the Moon AI platform
  • Members of customer organizations
  • Account administrators
  • Persons whose data is contained in the content submitted by users

5. Obligations of STELLARR STUDIO as processor

In accordance with Article 28 of the GDPR, STELLARR STUDIO undertakes to:

6. Security measures (Article 32 GDPR)

STELLARR STUDIO implements the following technical and organizational measures to ensure a level of security appropriate to the risk:

• Encryption

  TLS 1.3 in transit, AES-256 at rest

• Reversible masking

  Moon Blur, 5 layers before data is sent to AI

• Access control

  RBAC, MFA available, principle of least privilege

• Hosting

  OVHcloud, servers in France / EU

• Logging

  Audit trail of all access

• DRP / BCP

  Operational disaster recovery and business continuity plans, overseen by infrastructure experts.

The security measures are regularly tested, analyzed and evaluated in accordance with Article 32(1)(d) of the GDPR. Compliance details are available in our legal center.

7. Data breach notification

In the event of a personal data breach within the meaning of Article 4(12) of the GDPR, STELLARR STUDIO undertakes to:

• Notify the controller as soon as possible and, in any event, no later than 48 hours after becoming aware of it.
• Document the nature of the breach, the categories and number of persons concerned, the likely consequences and the measures taken or proposed.
• Cooperate with the controller so that it can meet its obligations to notify the CNIL, France’s data protection authority (Art. 33), and, where applicable, the data subjects (Art. 34).
• Remedy the breach and take all necessary measures to mitigate its effects and prevent it from recurring.

8. Sub-processors

The controller authorizes STELLARR STUDIO to engage the sub-processors listed below for the processing operations necessary to provide the Moon AI services. STELLARR STUDIO will inform the controller of any intended change concerning the addition or replacement of sub-processors, thereby giving the controller the opportunity to object (Art. 28(2) GDPR).

* For sub-processors located outside the EU, the safeguards rely on the standard contractual clauses (SCCs) they publish, on systematic prior masking, by Moon Blur, of the personal data it detects, and on the selection of providers that publish a no-retention / no-training commitment for their APIs (OpenAI Enterprise Zero Retention, Anthropic API, etc.). No individually signed DPA is concluded directly between Stellarr Studio and each API provider: the main protection for personal data remains Moon Blur masking before any external transmission. Details of the transfers are available in our privacy policy.

9. Transfers outside the EU

Where the processing involves a transfer of personal data to a third country (outside the European Economic Area), STELLARR STUDIO ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR:

• Standard contractual clauses (SCCs) adopted by the European Commission (Implementing Decision (EU) 2021/914), as published by each infrastructure provider in its own DPA.
• Moon Blur: automatic, reversible masking of the personal data detected, before any transmission to a third-party AI model (more than 150 categories of PII covered, including French identifiers).
• Selection of providers that publish a no-retention commitment for their APIs (OpenAI Enterprise Zero Retention, Anthropic Zero Data Retention API, Google Vertex AI). These commitments are public and can be invoked against the providers; Stellarr Studio is not in a position to impose these policies contractually on each provider.
• Transfer impact assessment (TIA) carried out internally for each sub-processor located outside the EU, in line with the recommendations of the European Data Protection Board (EDPB).

10. Right to audit

In accordance with Article 28(3)(h) of the GDPR, STELLARR STUDIO makes available to the controller all information necessary to demonstrate compliance with its obligations and allows for audits, including inspections, conducted by the controller or by an auditor mandated by the controller.

Audits are subject to the following conditions:

• Written notice at least 30 days in advance.
• Conducted during business hours, without disrupting the services.
• Signature of a confidentiality agreement by the mandated auditor.
• Limited to one audit per year, except in the event of a data breach or of an order from a supervisory authority.

STELLARR STUDIO immediately informs the controller if, in its opinion, an instruction infringes the GDPR or any other applicable data protection provision (Art. 28(3), last subparagraph).

11. Data at the end of the contract

Upon expiry or termination of the contract, and at the choice of the controller expressed in writing, STELLARR STUDIO undertakes to:

• Option A: return

  Return all personal data in a structured, commonly used and machine-readable format (Art. 20 GDPR), within 30 days of the request.

• Option B: deletion

  Securely and irreversibly delete all personal data and all existing copies, within 30 days, unless a legal retention obligation applies.

If the controller has not expressed a choice within 60 days of the end of the contract, STELLARR STUDIO will securely delete all personal data. A certificate of destruction will be provided on request.

12. Record of processing activities

In accordance with Article 30(2) of the GDPR, STELLARR STUDIO maintains a record of all categories of processing activities carried out on behalf of the controller, containing:

• The name and contact details of the processor and of the controller.
• The categories of processing carried out.
• Transfers of data outside the EU and the appropriate safeguards.
• A general description of the technical and organizational security measures.

13. Liability

Each party is liable for its own breaches of the GDPR in accordance with Articles 82 and 83 of the Regulation. STELLARR STUDIO is liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors, or where it has acted outside or contrary to the lawful instructions of the controller.

14. Governing law and jurisdiction

This agreement is governed by French law. In the event of a dispute relating to the interpretation or performance of this agreement, and failing amicable resolution, the courts with jurisdiction over the registered office of STELLARR STUDIO shall have jurisdiction, without prejudice to the right of any data subject to refer the matter to the competent supervisory authority (CNIL) or to the courts of their place of habitual residence (Art. 79 GDPR).

15. Contact