Between Boetiek House S.L., CIF B75865022, Calle Fernando Fuentes 2, 38300 Santa Cruz de Tenerife, Spain ("Processor") and the customer who accepts it ("Controller").

The Processor is established in the Canary Islands, which are an outermost region of Spain under Art. 349 TFEU: inside the European Union for data-protection purposes, and outside its VAT and customs territory. Those two facts point in different directions and only the first one governs this agreement.

This agreement governs personal data processed by the VergeLabs Media Library AI service on the Controller's instructions. It takes effect when the Controller activates a licence, and lasts as long as the licence does.

1. Roles

The Controller determines the purposes and means of processing. The Processor processes only on the Controller's documented instructions — which, for this service, are the requests the Controller's WordPress site sends to the API.

2. Subject matter, duration, nature and purpose (Art. 28(3))

• Subject matter: generating descriptive text for images the Controller submits.
• Duration: the life of the licence.
• Nature and purpose: transmitting a downsized copy of an image to a model provider, receiving text, returning it, and metering the credit spent.
• Types of personal data: whatever the Controller's images and filenames happen to contain. The Processor does not select this and cannot know it in advance. Separately, account data: name, email, billing address, site URL.
• Categories of data subject: the Controller's own subjects — anyone depicted in or identifiable from the media they submit.

The Controller is reminded, and accepts, that images may contain special category data under Art. 9. The service is not designed for that and the Controller should not submit it.

3. Instructions

The Processor processes only on documented instructions, including on transfers to a third country, unless required otherwise by EU or Member State law — in which case it informs the Controller before processing, unless that law forbids the notice.

The Processor will tell the Controller if an instruction appears to infringe the GDPR.

4. Confidentiality

Everyone the Processor authorises to process the data is under a binding confidentiality obligation.

5. Security (Art. 32)

Measures actually in place today, stated so they can be verified rather than believed:

• Licence keys are stored hashed (SHA-256). A leaked database yields no usable licences.
• Account passwords use scrypt, a memory-hard KDF, at approximately 64MB per hash, with constant-time comparison.
• On the WordPress side the licence key is sealed at rest with AES-256-GCM, keyed from the site's own auth salt, and the REST API exposes only a boolean.
• All traffic is HTTPS; the plugin refuses a non-HTTPS service URL.
• Images are never written to disk or database. They exist in memory for the life of one request.
• Credit spending is transactional, with per-licence rate and daily caps, so a compromised key has a bounded blast radius.
• Access to production systems is limited to the Processor's directors. There are no shared credentials and no third-party support access; deployment and database access are held by named individuals only.

6. Sub-processors (Art. 28(2), 28(4))

The Controller gives general authorisation for the sub-processors published at https://vergelabsmedia.com/legal/sub-processors. The Processor will give notice of intended additions or replacements before they take effect and allow the Controller to object. Each sub-processor is bound by terms no less protective than these.

7. Data subject rights (Art. 28(3)(e))

The Processor holds no images, so most requests are answerable by the Controller alone from their own WordPress installation. For account and billing data, the Processor will assist by appropriate technical and organisational measures, insofar as possible.

8. Personal data breach (Art. 28(3)(f), Art. 33)

The Processor notifies the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach, with the information the Controller needs for its own notification.

Seventy-two hours rather than something shorter, deliberately: it matches the window Art. 33 gives the Controller for its own notification, and a processor that promises less than it can keep on a bad weekend has written a term it will breach.

9. Deletion or return (Art. 28(3)(g))

On termination the Processor deletes account and licence data within 30 days, except where EU or Member State law requires retention — principally invoices and accounting records, which Spanish law requires be kept (six years for accounting records under Art. 30 of the Código de Comercio; the tax limitation period is four). Images require no deletion step because none are retained.

10. Audit (Art. 28(3)(h))

The Processor makes available the information needed to demonstrate compliance and allows audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice and no more than once a year absent a breach.

11. International transfers (Chapter V)

The Processor is established in the Canary Islands, which are an outermost region of Spain under Art. 349 TFEU and inside the Union for data-protection purposes whatever their position on VAT and customs. The Controller-to-Processor relationship therefore involves no transfer to a third country.

Sub-processors include US-based organisations, and those transfers rely on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), relied on directly rather than through Data Privacy Framework certification — a certification can be withdrawn by the recipient or struck down, and a basis that has to be re-checked per recipient is a basis that eventually is not. Read and confirmed for Supabase and Resend; the basis for each is recorded in the sub-processor list.

Settled 29-08-2026. docs/ai-roadmap.md commits to zero-retention routing, and that is now enforced per request rather than promised: lib/routing.ts sets zdr: true and data_collection: "deny" on every model call, and lib/routing.test.ts asserts those flags leave the process by reading the outgoing request body. Region is deliberately not pinned — OpenRouter has no region predicate — so the published claim is zero-retention and not EU residency for inference. See sub-processors.md.

12. Liability and precedence

Where this agreement conflicts with the general terms, this agreement prevails for matters of personal data processing.