Data Processing Addendum

Last updated: September 14, 2026

This Data Processing Addendum ("DPA") is part of the Creator Shout Terms of Service. It applies whenever Creator Shout processes personal data on your behalf. Note: this is a plain-language template, not legal advice. If you run a large business on Creator Shout, have your own counsel review it.

1. Who is who

• You (the creator or advertiser) are the data controller for personal data collected from visitors to your Creator Shout pages: you decide why and how that data is used (for example, building an audience, measuring ad performance, growing an email list).
• Creator Shout is the data processor: we process that visitor data only to operate the platform for you, following your instructions as expressed through your use of the service (your page settings, your ad configurations, your integrations).
• For data about your own account (your name, email, login), Creator Shout is the controller. See our Privacy Policy.

2. What we process, and why

Subject matter and purpose: hosting your public pages, serving ad placements, and providing the analytics and audience tools in your back office.

Types of visitor data: truncated IP address (never the full address), approximate location derived from it (country and state or region level only), device and browser type, referring page, pages viewed, ad impressions and clicks, and any information visitors type into your page blocks (for example an email address entered in an email capture block).

Duration: for as long as your account is active, plus the retention windows in our Privacy Policy.

3. Our obligations as processor

• Instructions only: we process visitor data only on your documented instructions (your settings and use of the service) and as required by law. If we believe an instruction would break data-protection law, we will tell you.
• Confidentiality: everyone who handles the data is bound to keep it confidential.
• Security: we use appropriate technical and organizational measures: encrypted connections (HTTPS), access controls on our infrastructure, and truncated IP storage so full addresses never reach our analytics database.
• Sub-processors: we use the sub-processors listed in section 4. We will notify you of changes and give you a chance to object.
• Your visitors' rights: if a visitor asks you for access, correction, deletion, or export of their data, we will help you respond, including through the deletion tools described in our Privacy Policy.
• Breach notification: if we discover a personal data breach affecting your visitors' data, we will notify you without undue delay so you can meet your own notification duties.
• Deletion or return: when you delete your account or ask us to, we delete or return your visitor data as described in our Privacy Policy, except where the law requires us to keep it.

4. Sub-processors

These services process data on our behalf to run the platform:

• Supabase: authentication, database, and backend infrastructure.
• Vercel: website hosting and serverless functions.
• Stripe: payment processing for advertisers and payouts to creators.
• Brevo: transactional email delivery.
• Kit (ConvertKit): only when you connect it yourself for your email capture block; your list lives in your own Kit account under your agreement with Kit.

5. International transfers

Our infrastructure providers may process data in the United States. Where data-protection law requires safeguards for transfers outside your region, we rely on the transfer mechanisms our sub-processors provide (such as standard contractual clauses in their own terms).

6. Your obligations as controller

• You must have a lawful basis for the visitor data you collect through your pages.
• You are responsible for notices to your visitors beyond what our platform-wide consent banner and privacy policy provide (for example, if you add your own third-party embeds or pixels to a page).
• Respond to your visitors' privacy requests; use our deletion and export tools to do so.

7. Contact

Privacy and DPA questions: virtualboy38@yahoo.com with the subject "Privacy request".