1. When this applies
This addendum is part of our Terms of Service for any production or operator ("you") that asks for it at [email protected]. We'll confirm by email, and sign a copy if you need one. It covers personal information we process on your behalf: job backups from signed-in Macs (crew names, departments, roles, device keys and shared profile details, take notes) and relay data (coded member and chat ids, sizes, times, device push tokens and IP addresses).
It doesn't cover information we handle for our own purposes as a controller (orders, accounts, support email), which the Privacy Policy covers. It doesn't cover Production Content kept only on your own Mac and devices, which we never receive.
2. Roles
You (or the production you work for) are the controller of this information, and Abby Video LLC is your processor (or sub-processor, if you act for a production). You're responsible for having a lawful basis for the information you put into our services, and for telling your members how it's used.
3. What we'll do with it
- Process it only to provide the services you use, on your documented instructions (these terms and your settings), unless the law requires otherwise, in which case we'll tell you first where the law allows.
- Never sell it, use it for advertising, use it to train AI, or combine it with other data for our own purposes.
- Make sure everyone who can access it is bound to keep it confidential. Today that's only the owner of Abby Video LLC.
- Help you, as far as we reasonably can, to answer people's requests to exercise their rights, and with security, breach notices and impact assessments.
4. Security
We protect the information with the measures on our Security page, including: encryption in transit (TLS); job backups encrypted at rest (AES-256-GCM, a key per account); end-to-end encryption of messages and remote pictures, so the relay never has their keys; passwordless sign-in with hashed codes and tokens; a security log; least-privilege access; and secrets kept in encrypted storage.
5. Our service providers
You authorize us to use these sub-processors:
- Cloudflare, Inc.: hosting, the relay, databases (D1), job backup storage (R2), email. United States and Cloudflare's global network.
- Apple Inc.: push notifications for Abby Monitor (sealed content only).
We'll give at least 14 days' notice by email before adding or replacing a sub-processor for this data. If you object on reasonable data protection grounds and we can't resolve it, you may stop using the affected service. We bind each sub-processor to data protection terms at least as protective as these, and we remain responsible for them.
6. Breach notice
We'll tell you without undue delay after we become aware of a breach affecting this information, and aim to do so within 72 hours, with what we know: what happened, the data and people likely affected, what we've done and what you should do. We'll update you as we learn more.
7. International transfers
The information is processed in the United States and on Cloudflare's network. Where the GDPR, UK GDPR or Swiss law requires a transfer mechanism, the European Commission's Standard Contractual Clauses (controller-to-processor or processor-to-processor module, as fits) and the UK International Data Transfer Addendum apply between us, with this addendum supplying their details. We rely on our sub-processors' own transfer safeguards, such as Cloudflare's.
8. Deletion at the end
You can delete any job backup at any time on abbyvideo.com/account, and deleting your account deletes all of them at once. Relay data is deleted on the schedule in the Privacy Policy (messages within 30 days; rooms when closed or after 30 days without contact). When our services to you end, we delete the information unless the law requires us to keep it.
9. Information and audits
On request, once a year (or after a breach), we'll answer a reasonable written security questionnaire and give you the information you need to show compliance. Any on-site audit needs reasonable notice, must be at your cost, and is limited to what the law requires.
10. Liability and order
The limits of liability in our Terms of Service apply to this addendum. If this addendum conflicts with the Terms of Service about personal information processed for you, this addendum applies.
11. Contact
Data protection questions: [email protected].
Abby Video LLC, a New Jersey limited liability company. Email [email protected]. Mailing address: Abby Video LLC, 316 E Collings Dr, Williamstown, NJ 08094, USA.