This Data Processing Addendum ("Addendum") is between Createrun Incorporated, a New York corporation ("Createrun") and the customer that has agreed to Createrun's terms of service ("Customer"). It forms part of that agreement (the "Agreement") and applies when Createrun processes Customer Personal Data in the Hosted Services.
1. Definitions
1.1 Terms used but not defined here have the meaning given in the Agreement.
- Applicable Data Protection Laws means all data protection and privacy laws that apply to a party's processing of Customer Personal Data under the Agreement.
- Hosted Services means the services that Createrun hosts for Customer:
- Createrun Cloud and rented virtual machines; and
- Createrun's hosted development services, including Editor projects, Git repositories, build artifacts, and Createrun Agent prompts and outputs.
- Customer Content means data that Customer or its users submit to, store in, or generate through the Hosted Services.
- Customer Personal Data means personal data contained in Customer Content.
- Subprocessor means a third party that Createrun engages to process Customer Personal Data.
- Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data held by Createrun or its Subprocessors.
- controller, processor, data subject, personal data, processing, service provider and contractor have the meanings given in Applicable Data Protection Laws, and include equivalent terms used in those laws.
2. Scope and roles
2.1 Hosted Services. For Customer Personal Data in the Hosted Services, Customer is the controller (or a processor acting for its own customers), and Createrun is a processor acting on Customer's behalf.
2.2 Self-hosted software is outside this Addendum. When Customer runs Createrun software on infrastructure that Customer or its contractors control, Createrun does not receive, access or process the content of that instance and is not a processor for it. Customer is solely responsible for that data. The only data that a self-hosted instance sends Createrun is licensing information, such as:
- the instance, organization and account identifiers;
- the hostname, installation path and operating platform;
- the product and component versions and the edition; and
- periodic health and update-check requests.
Createrun processes that licensing information as a controller under its Privacy Policy. Operational telemetry from a self-hosted instance is off by default. If Customer turns it on and sends it to Createrun, Createrun receives only the data Customer enables. [DECISION: decide whether Createrun acts as processor for telemetry a customer chooses to send, or whether the Agreement should prohibit including personal data in it]
2.3 Createrun's own data. Createrun is an independent controller for the following, which are governed by its Privacy Policy and not by this Addendum:
- account and organization information;
- billing information;
- support communications;
- security logs;
- website analytics; and
- self-hosted licensing information.
2.4 Customer's own AI providers and integrations. Customer may connect its own AI tools or other third-party services to the Hosted Services, for example through the Model Context Protocol (MCP). Data sent to those services is sent on Customer's instruction and under Customer's own agreements with those providers. Those providers are not Createrun's Subprocessors, and Createrun is not responsible for them.
2.5 Third-party applications. Applications that Customer obtains from third-party publishers, and any data those publishers receive, are governed by Customer's terms with the publisher and not by this Addendum.
2.6 Details of processing. The subject matter, duration, nature and purpose of processing, and the types of personal data and data subjects, are described in Annex 1.
3. Customer instructions
3.1 Createrun processes Customer Personal Data only on Customer's documented instructions, unless a law that applies to Createrun requires otherwise. If such a law applies, Createrun will inform Customer before processing, unless the law prohibits it.
3.2 Customer's instructions are made up of:
- the Agreement and this Addendum;
- Customer's configuration and use of the Hosted Services; and
- any other written instructions that Customer gives and Createrun accepts in writing.
3.3 Createrun will tell Customer if it believes an instruction violates Applicable Data Protection Laws. Createrun may then suspend that processing until Customer confirms, changes or withdraws the instruction.
3.4 Customer is responsible for:
- the lawfulness of its instructions;
- having a lawful basis for processing, and giving any required notices and obtaining any required consents; and
- the accuracy, quality and legality of Customer Personal Data and of how Customer obtained it.
3.5 Where Applicable Data Protection Laws treat Createrun as a service provider or contractor, Createrun will not:
- sell or share Customer Personal Data;
- retain, use or disclose it for any purpose other than providing the Hosted Services or as those laws permit;
- retain, use or disclose it outside its direct business relationship with Customer; or
- combine it with personal data from other sources, except as those laws permit.
Createrun will tell Customer if it can no longer meet these obligations.
4. Createrun Agent and AI processing
4.1 The Createrun Agent uses AI models selected by Createrun. These may be models operated by Createrun or models of third-party cloud model providers. At the date of this Addendum, the Createrun Agent uses a model that Createrun operates.
4.2 A third-party model provider that processes Customer Personal Data is a Subprocessor. Createrun will add it to the Subprocessors page and give notice under Section 7 before it processes Customer Personal Data.
4.3 Createrun processes Customer Content, including Createrun Agent prompts and outputs, only on Customer's instructions under Section 3. Createrun's use of data to improve the Hosted Services is limited to de-identified or aggregated operational data, such as performance, error and usage metrics, used under restricted access to operate, secure and improve the efficiency of the Hosted Services. Createrun will give Customer prominent notice before any materially different use.
4.4 AI output may be inaccurate. Customer is responsible for reviewing output before relying on it.
5. Confidentiality of personnel
5.1 Createrun ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations.
5.2 Access is given only to people who need it to provide or support the Hosted Services.
6. Security
6.1 Createrun maintains technical and organizational measures designed to protect Customer Personal Data against Security Incidents. The measures are appropriate to the risk, taking into account the nature of the processing. They include measures designed to:
- encrypt Customer Personal Data in transit over public networks;
- protect stored data, including through encryption at rest where the service supports it [VERIFY: which storage layers are encrypted at rest];
- limit administrative access to authorized personnel, using individual accounts and least-privilege access [VERIFY: whether multi-factor authentication is enforced for administrative access, before stating it];
- separate customer environments from one another;
- record security-relevant events and support the investigation of incidents;
- keep backups that allow data to be restored after an incident; and
- apply security updates to the systems that run the Hosted Services within a reasonable time.
6.2 Createrun may update these measures over time, provided it does not materially reduce the overall level of protection.
6.3 Customer is responsible for the security decisions within its control, including:
- the design of its applications and access rules;
- the credentials it issues and how its users protect them;
- the integrations and AI tools it connects; and
- keeping its own copies of data it cannot afford to lose.
6.4 Createrun does not claim any security certification in this Addendum.
7. Subprocessors
7.1 Customer gives Createrun general authorization to engage Subprocessors. The current list is on the Createrun Subprocessors page.
7.2 Before a Subprocessor processes Customer Personal Data, Createrun will put a written contract in place with it. That contract will contain data protection obligations that are no less protective than those in this Addendum, to the extent they apply to the service the Subprocessor provides.
7.3 Createrun remains responsible to Customer for its Subprocessors' performance of those obligations.
7.4 Createrun will give notice of a new Subprocessor in two ways:
- by updating the Subprocessors page; and
- by email to the account owner of each Customer subject to this Addendum.
The notice will be given at least [30] days before the new Subprocessor begins processing Customer Personal Data. [DECISION: confirm the notice period]
7.5 Customer may object to a new Subprocessor on reasonable data protection grounds by writing to privacy@createrun.com within the notice period. The parties will try in good faith to resolve the objection. If they cannot, Customer may terminate the affected Hosted Service by written notice. Createrun will then refund any prepaid fees for the unused part of that service.
7.6 In an emergency, Createrun may replace a Subprocessor without advance notice where this is needed to maintain the security or availability of the Hosted Services. Createrun will give notice as soon as practicable, and Section 7.5 will apply.
8. Requests from data subjects
8.1 If Createrun receives a request from a data subject about Customer Personal Data, Createrun will forward it to Customer without undue delay. Createrun will not respond to the request itself, other than to tell the data subject that it has been forwarded, unless the law requires otherwise.
8.2 Taking into account the nature of the processing, Createrun will provide reasonable assistance to help Customer respond to data subject requests, where Customer cannot respond using the features of the Hosted Services.
9. Security Incidents
9.1 Createrun will notify Customer without undue delay after becoming aware of a Security Incident.
9.2 The notice will describe, to the extent the information is known at the time:
- the nature of the Security Incident;
- the types of data and data subjects likely to be affected;
- its likely consequences;
- the measures taken or proposed; and
- a contact point for more information.
Createrun may provide information in stages as it becomes available.
9.3 Createrun will take reasonable steps to contain and investigate the Security Incident. It will provide reasonable assistance to help Customer meet any obligation Customer has to notify authorities or data subjects. Customer remains responsible for deciding whether notification is required and for making it.
9.4 A notice under this Section is not an admission of fault or liability.
9.5 Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data. Examples include blocked sign-in attempts, pings and port scans.
10. Assistance
10.1 Taking into account the nature of the processing and the information available to it, Createrun will provide reasonable assistance with any data protection impact assessment or consultation with an authority that Customer is required to carry out in relation to the Hosted Services.
11. Deletion and return
11.1 Customer may export Customer Content using the features of the Hosted Services while its service is active. [DECISION: confirm whether a post-termination export window is offered within the 30 days]
11.2 Createrun will delete Customer Content, including Customer Personal Data, 30 days after the Hosted Service ends.
11.3 Copies in backups are deleted as those backups roll off in the ordinary course. Until then, they remain protected under this Addendum and are not used for any other purpose.
11.4 If the law requires Createrun to keep some Customer Personal Data, Createrun will keep only what is required, for only as long as required, and will continue to protect it under this Addendum.
12. Information and audits
12.1 Createrun will make available information reasonably necessary to show that it complies with this Addendum. This includes written responses to reasonable security questionnaires, no more than once a year.
12.2 If that information is not enough to meet a requirement of Applicable Data Protection Laws, Customer may carry out an audit. The following conditions apply:
- no more than once in any 12-month period, unless an authority requires it or a Security Incident has occurred;
- on at least 30 days' written notice;
- during normal business hours;
- by Customer or an independent auditor that is not a Createrun competitor and is bound by confidentiality; and
- in a way that does not disrupt Createrun's operations or put other customers' data at risk.
Customer bears its own costs and Createrun's reasonable costs of the audit.
13. Location and transfers
13.1 Createrun is based in the United States. We process data on servers operated by us or our service providers, primarily in the United States. Where data of users in other regions is transferred, we rely on appropriate safeguards as required by applicable data protection laws.
13.2 Where Applicable Data Protection Laws require a transfer mechanism for Customer Personal Data sent across borders, the parties will rely on a mechanism those laws recognize. Where standard contractual clauses or a similar instrument is required, the parties agree to enter into it, and it prevails over this Addendum if the two conflict.
14. General
14.1 Liability. Each party's liability under this Addendum is subject to the limitations and exclusions of liability in the Agreement, to the extent Applicable Data Protection Laws permit.
14.2 Precedence. On data protection matters, this Addendum prevails over the Agreement if the two conflict.
14.3 Term. This Addendum stays in effect for as long as Createrun processes Customer Personal Data in the Hosted Services.
14.4 Governing law. This Addendum is governed by the law that governs the Agreement, unless Applicable Data Protection Laws require otherwise.
14.5 Changes. Createrun may update this Addendum to reflect changes in the law, its Subprocessors or its services, provided the update does not materially reduce the protection of Customer Personal Data. Createrun will notify Customer by email before a material update takes effect.
14.6 Notices. Notices to Createrun under this Addendum must be sent to privacy@createrun.com. Security matters must be sent to security@createrun.com. Createrun sends notices to the account owner's registered email address.
Annex 1: Details of processing
Related: Terms of Service · Privacy Policy · Acceptable Use Policy · Subprocessors · Cookie Notice · Store Terms · Publisher Agreement · Paid Apps Addendum · Security