Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (the creator, “Controller”) and Khuume, Inc. (“Khuume,” “Processor”). It governs Khuume’s processing of personal data that you collect from your audience through the Service (“Customer Personal Data”) — for example, data submitted through bookings, polls, or forms on your Khuume page.

For Customer Personal Data, you are the controller and Khuume is your processor. (Khuume is a separate, independent controller for the data described in our Privacy Policy, such as your own account data; that processing is governed by the Privacy Policy, not this DPA.) This DPA is designed to meet the requirements of the Thai PDPA, the EU/UK GDPR, and comparable laws.

Khuume will process Customer Personal Data only on your documented instructions — including the instructions set out in this DPA, the Terms, and your configuration and use of the Service — and as required by applicable law. If Khuume is legally required to process beyond your instructions, it will inform you unless the law prohibits it. Khuume will not sell Customer Personal Data or use it for its own independent purposes.

The subject matter and details of processing are described in Annex 1. In summary:

• Nature and purpose — hosting and operating the Service so you can collect and manage interactions with your audience.
• Duration — for the term of your use of the Service and until deletion or return under the “Return and deletion” section.
• Types of data — contact and identification details your audience submits (such as name, email, and message content) and related metadata.
• Data subjects — your audience members, customers, and contacts who interact with your Khuume page.

Khuume ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access the data only as needed to provide the Service.

Khuume implements appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the risks involved. These measures are described in Annex 2 and include encryption in transit, access controls, and infrastructure operated by reputable cloud providers.

You give Khuume general authorization to engage sub-processors to process Customer Personal Data. Khuume’s current sub-processors are listed in Annex 3. Khuume will:

• impose data-protection obligations on each sub-processor that are no less protective than those in this DPA;
• remain responsible for its sub-processors' performance; and
• give you reasonable notice of any intended addition or replacement of a sub-processor, so you have the opportunity to object on reasonable data-protection grounds.

Customer Personal Data may be processed outside the country where it was collected, including in the United States and the European Union. Where such transfers occur, Khuume relies on an appropriate transfer mechanism — such as Standard Contractual Clauses or a mechanism recognized under the PDPA.

Taking into account the nature of the processing, Khuume will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights. If Khuume receives such a request directly, it will, where permitted, direct the data subject to you or forward the request to you rather than respond on your behalf.

Khuume will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to it to help you meet your own notification obligations to authorities and data subjects.

Taking into account the nature of processing and the information available to Khuume, Khuume will provide reasonable assistance with your obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.

Khuume will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, confidentiality obligations, and limits to protect the security and data of other customers. Where available, Khuume may satisfy audit requests by providing third-party certifications or reports.

On termination of the Service, or at your request, Khuume will delete or return Customer Personal Data, and delete existing copies, unless applicable law requires continued storage. Residual copies in routine backups will be deleted in the ordinary course.

This DPA forms part of the Terms. In the event of a conflict between this DPA and the rest of the Terms regarding the processing of Customer Personal Data, this DPA prevails. Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms, to the extent permitted by applicable law.

• Categories of data subjects: the creator’s audience members, customers, and contacts.
• Categories of personal data: name, email address, message and submission content, booking details, and related metadata such as timestamps and IP address.
• Special category data: not intentionally collected; creators must not use the Service to collect special category data without an appropriate legal basis.
• Nature and purpose: hosting, storage, display, and management of audience interactions on the creator’s page.
• Duration: the term of the Service plus the retention period described in the Terms and Privacy Policy.

• encryption of data in transit (TLS);
• passwords stored only as salted hashes;
• role-based access controls and least-privilege access for personnel;
• managed, reputable cloud infrastructure providers;
• rate limiting and abuse controls on public endpoints; and
• access logging and monitoring, encrypted backups, and a documented incident-response process.

• Vercel — application hosting and content delivery.
• Neon — managed PostgreSQL database hosting.
• Cloudflare — object storage for uploaded images and files (R2), and anti-spam verification on public forms (Turnstile).
• Stripe — payment processing (billing data).
• OpenAI, Anthropic, and/or Google — AI providers powering translation and text-analysis features.
• Google — sign-in with Google, and the optional YouTube channel connection.
• Meta (Instagram and Facebook) — optional Instagram and Facebook connections.
• TikTok — optional TikTok connection.
• LINE — optional LINE account linking and LINE notifications.
• Resend — transactional email delivery.
• Sentry — error monitoring and diagnostics.
• PostHog — product analytics (usage measurement).