Data Processing Agreement

01Who this agreement is between

This agreement is between an agency that uses CamRiser (the "controller") and Digital Riser LLC (the "processor", "we", "us"). It covers the personal data the agency puts into CamRiser, or that CamRiser collects for it, about its staff, its models and the members of the cam sites they talk to.

It forms part of our Terms of Service, and an agency accepts it when it accepts the Terms. Where the Terms and this agreement differ about the personal data we process for an agency, this agreement governs.

02What we process, and why

We process the agency's personal data only to provide CamRiser to it, as described in the Terms, and as the agency sets it up through its settings. That means storing it, organising and analysing it, sending what is needed to our providers (for example a conversation to an AI provider to write a reply), and deleting it.

We process it for as long as the agency's account is active, and then as described under "When the service ends".

03The people and the data

• Staff: identity and contact details, logins and activity in the app.
• Models: identity and contact details, profile and schedule, photos, documents and contracts, earnings and payout records, payment details, and the logins of their cam site accounts.
• Cam site members: usernames, tips and activity in public rooms, their conversations with the models, and the notes the copilot keeps about them.

04Sensitive data

Because CamRiser serves the adult cam industry, some of this data may reveal information about people's sex lives, which the GDPR treats as a special category of data. The agency is responsible for having a legal basis for processing it, and for not putting into CamRiser more than it needs.

05What we commit to

• Instructions: we process the data only on the agency's documented instructions, which are these terms and the way it sets up CamRiser, unless the law requires otherwise; in that case we tell the agency first, unless the law forbids it.
• Confidentiality: everyone at CamRiser who can access the data is bound to keep it confidential.
• Security: we protect the data with appropriate technical and organisational measures. Cam site passwords, payment details and connected bot tokens are stored encrypted, access is limited by role, and important actions are logged.
• Your people's rights: we help the agency answer requests from people who exercise their rights over their data.
• Compliance: we help the agency with its security, impact assessments and consultations with authorities, as far as is reasonable for the service.
• Breaches: we tell the agency without undue delay after we become aware of a personal data breach affecting its data, with the information we have.
• Audits: we give the agency the information it reasonably needs to show compliance with this agreement, and allow an audit by an independent auditor bound by confidentiality, with reasonable notice and at the agency's cost.

06Sub-processors

The agency allows us to use other providers to process its data. We bind each of them to data protection obligations equivalent to these, and we remain responsible for them. Currently they fall into these groups:

• AI providers, to write the copilot's replies.
• An email delivery provider, to send emails.
• Security and content delivery providers, to protect our website and make it faster.
• Cloud hosting providers, to store and run the service.
• Messaging platforms, only when the agency connects its own bot to post to a channel.

07Changes to sub-processors

An agency can ask us at [email protected] for the current list of sub-processors, with each one's name and location. We tell agencies before we add or replace a sub-processor, by email for significant changes. An agency that objects can tell us at [email protected], and can stop its subscription if we cannot resolve the objection.

08International transfers

We are based in the United States, and some sub-processors process data in other countries. Where data leaves the EEA or UK, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

09When the service ends

When the agency's account ends, we delete or return its personal data at its request, unless the law requires us to keep it, for example in invoices and tax records.

10The agency's responsibilities

The agency is responsible for having a legal basis for the data it puts into CamRiser, for telling its staff and models how their data is used, and for giving us only lawful instructions.

11Liability and contact

Each party's liability under this agreement is subject to the limits in our Terms of Service, except where the law does not allow it. For anything about this agreement, email [email protected].