Data processing agreement

Version v0.3 (17 Oct 2026)

between the studio using SilkRaven (the "Controller") and Kathryn Moore, SilkRaven, Marientaler Straße 4, 12437 Berlin, Germany (the "Processor").

1. Subject, duration, nature and purpose

1.1 The Processor provides SilkRaven, an online production tool, to the Controller under the terms of use. In doing so it processes personal data on the Controller's behalf.
1.2 Nature and purpose: hosting, storing, displaying and organising the Controller's project content; sending the emails the Controller's users choose (review reminders once they're switched on, and project invitations); support when the Controller asks for it.
1.3 Duration: as long as the Controller uses SilkRaven, plus the export and deletion period in section 10.

2. Data and people concerned

2.1 Types of data: names and email addresses of project members; their role, domains and settings; project content that may name or describe people (work items, tasks, notes, sign-off and decision notes, verdicts and reasons, comments, playtest feedback, uploaded files); the change history (who changed what, when and why).
2.2 People concerned: the Controller's staff, contractors and partners who are members of its projects, and anyone named in the project content (for example playtesters).
2.3 SilkRaven isn't designed for special categories of data (Article 9 GDPR). Free-text fields could contain them if users write them in; the Controller is responsible for its content and asks its team not to record such data unless necessary.

3. Instructions

3.1 The Processor processes the data only on the Controller's documented instructions. The terms of use, this agreement and the Controller's use of SilkRaven's settings are those instructions. Further instructions are given in text form (for example email).
3.2 If the Processor thinks an instruction breaks data protection law, it tells the Controller and may wait to carry it out until the Controller confirms or changes it.
3.3 If the law requires processing beyond the instructions, the Processor tells the Controller first, unless the law forbids it.

4. Confidentiality

Everyone at the Processor who can access the data is bound to confidentiality. Today that's Kathryn Moore only.

5. Security

The Processor takes the technical and organisational measures in Annex 1 (Article 32 GDPR) and keeps them up to date. It may replace a measure with one that's at least as good.

6. Sub-processors

6.1 The Controller agrees to the sub-processors in Annex 2.
6.2 The Processor may add or replace a sub-processor if it tells the Controller at least 30 days in advance. The Controller may object within that time on reasonable data-protection grounds; if no solution is found, the Controller may end its use of SilkRaven with a refund for any prepaid, unused period.
6.3 The Processor gives each sub-processor the same data-protection obligations as in this agreement, and remains responsible for them.

7. Location and transfers

The data is stored in the EU (Ireland). Where a sub-processor is outside the EU or uses providers outside the EU, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework) or the EU's Standard Contractual Clauses.

8. Helping the Controller

8.1 People's rights: SilkRaven's features (editing today; "Download my data", account deletion and project export once available) let the Controller answer most requests itself. Until then, and wherever they don't, the Processor helps on request by email. If a person contacts the Processor directly about the Controller's data, the Processor passes the request on and doesn't answer it on its own.
8.2 Other duties: the Processor helps the Controller with security, breach notifications, data protection impact assessments and consulting the authority (Articles 32–36 GDPR), as far as it can.

9. Personal data breaches

The Processor tells the Controller without undue delay, and within 48 hours of becoming aware of a breach affecting the Controller's data, with what it knows: what happened, what data and roughly how many people, likely consequences, and what's being done. It adds details as they become known.

10. End of the agreement

When the Controller stops using SilkRaven, it can export its data for 30 days. After that the Processor deletes the data, including from the hosting provider's database backups when they're overwritten, unless the law requires it to be kept. On request, the Processor confirms the deletion in text form.

11. Checks

The Processor makes available the information needed to show it meets this agreement (for example this agreement, Annex 1 and its sub-processors' certifications), and allows and contributes to audits by the Controller or an auditor it appoints, with reasonable notice, during business hours and at most once a year unless there's a specific reason. The Controller bears its own costs.

12. Liability and order of documents

Liability follows Article 82 GDPR and the terms of use. If this agreement and the terms of use conflict on data protection, this agreement wins.

Annex 1: Technical and organisational measures (Article 32 GDPR)

• Where: all data stored in the EU (AWS data centre, Ireland), through Lovable Cloud (Supabase).
• Encryption: every connection encrypted; data encrypted at rest (Lovable Cloud, confirmed by Lovable 16 Oct 2026). Lovable's own platform holds ISO 27001:2022 and SOC 2 Type II (reports on request from Lovable, under NDA).
• Access to data: row-level security in the database on every table: each person can only read and change the projects they're a member of, by role. This is enforced on the server, not only in the app.
• Sign-in: passwords stored only as secure hashes; sign-in with Google or Microsoft available.
• Access by SilkRaven: only Kathryn Moore can administer the service; access to the database is restricted to her accounts.
• Secrets: keys kept only in the hosting platform's secret store, never in code.
• Changes to the software: every change is reviewed against written rules and passes automatic checks (type checks, tests) before release; database changes are reviewed and checked before they're applied.
• Availability and backups: daily full database backups by the hosting provider, in the same EU region, kept for a limited period (not published by the provider). Uploaded files aren't backed up; studios keep their own copies of important files (terms § 10.4).
• Separation: every studio's data is separated by project in the database; test data is marked and kept apart.
• Deletion: on the Controller's request by email, within 30 days (deleted projects are erased by a scheduled job once project deletion is available in the app); account deletion erases name and email.
• Emails: sent without open or click tracking.
• Incidents: the breach process in section 9; contact kat@silkraven.com.

Annex 2: Sub-processors

Lovable's sub-processors (sub-sub-processors), as listed at trust.lovable.dev/subprocessors on 16 Oct 2026, those that can process the Controller's data: Google Cloud Platform (EU, Netherlands: application hosting and infrastructure), Amazon Web Services (UK, London: storage, cache and secrets), Supabase (EU: database, authentication), Cloudflare (global: edge routing and delivery), Modal (global: running project code), ClickHouse and Altinity (EU: visitor statistics), Temporal (UK: workflow orchestration), Grafana and Sentry (USA: logs and monitoring), Intercom (USA: support, only if the Processor shares data with Lovable support). The UK has an EU adequacy decision; US providers are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses. Lovable's AI and add-on providers aren't used for the Controller's data. Lovable's DPA with the Processor applies (Lovable Business, from 16 Oct 2026).