Data Processing Terms

These Data Processing Terms (“DPT”) are part of the Curator Agreement between Edan Labs LLC (“Megaphone”) and the curator. They apply to personal information about the curator’s clients and prospects that Megaphone processes for the curator through the service (“Client Data”). Effective date: October 29, 2026. Version 2026-10-29.1.

Client Data includes names, phone numbers, emails, social handles, requests and preferences, approvals, payment metadata, check-ins and messages.

• For Client Data, the curator is the controller (or “business” under US state law) and Megaphone is the processor (or “service provider”).
• For its own account data, such as curator and team sign-ins, billing, security and service analytics, and for clients’ own Megaphone account data used to run the platform, Megaphone is an independent controller, as described in the Privacy Policy.
• Where a team member is acting for a curator, the curator is responsible for them.

Megaphone will process Client Data only on the curator’s documented instructions, which are this DPT, the Curator Agreement and the curator’s use of the service’s features, and as the law requires. If we think an instruction breaks the law, we will tell you.

The subject matter is running the curator’s requests, options, payments, passes, guest lists and messaging. Duration is the term of the Agreement plus the return or deletion period. The data subjects are the curator’s clients, their guests and assistants.

Megaphone will not market to or solicit your clients for itself or for any other curator, and will not sell or share their data. It sends messages to your clients only on your behalf, as part of the service: transactional messages about the client’s own requests and bookings, and marketing messages only to clients who opted in. Your clients’ data is walled off from every other curator.

Megaphone limits access to Client Data to personnel who need it to run the service. They are bound by confidentiality duties and receive security training. Access is logged.

Megaphone maintains appropriate technical and organizational measures, including:

• Row-level security that separates each curator’s data.
• Encryption of data in transit, and encryption at rest by our infrastructure providers.
• Multi-factor authentication for Megaphone staff.
• Role-based access (owner, booker, viewer) for curators’ teams.
• Audit logs of access to sensitive data and administrative actions.
• Payment card data handled by the payment processor, not stored by Megaphone.
• Rate limiting, bot protection and monitoring for errors and abuse.
• Backups and a tested process for recovery.
• Vulnerability management and a process for security reports.

We may update these measures over time, as long as we do not materially lower the overall level of protection.

The curator authorizes Megaphone to use these subprocessors. Each is bound by written terms that protect Client Data to a standard no less protective than this DPT, and Megaphone remains responsible for them.

Megaphone will tell curators before it adds or replaces a subprocessor, with at least 15 days’ notice by email or in Studio. A curator may object on reasonable data protection grounds. If we cannot resolve it, the curator may stop using the affected feature or end the Agreement. Note that Stripe also acts as an independent controller for its own processor-account obligations.

If a client contacts Megaphone about their Client Data, we will point them to the curator where the request is about the curator’s use, and tell the curator, unless the law says otherwise. Megaphone gives curators tools in Studio to export and delete client data, and will help with requests, taking into account the nature of the processing.

Clients also have their own rights with Megaphone as an independent controller, as set out in the Privacy Policy.

Megaphone will tell the curator without undue delay after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of or access to Client Data. We aim to do so within 72 hours.

The notice will describe what happened, the data affected, what we are doing about it, and what we recommend. The curator is responsible for deciding whether to notify clients and regulators, and Megaphone will cooperate reasonably.

When the Agreement ends, the curator has 30 days to export Client Data from Studio. After that, Megaphone will delete or de-identify Client Data, except where the law requires us to keep it, such as for payment, tax and dispute records. Anything we keep stays under this DPT.

Backups are overwritten in the ordinary course. The curator may also ask for earlier deletion of specific records.

On reasonable request, no more than once a year (or more often after a breach or if a regulator requires), Megaphone will give the curator the information needed to show it follows this DPT, such as security summaries or third-party reports. If that is not enough, the curator may carry out an audit on reasonable notice, during business hours, with a confidentiality agreement, and at the curator’s expense. It must not disrupt the service or expose other customers’ data.

Megaphone and its subprocessors may process Client Data in the United States and other countries. Where the law requires a transfer mechanism for data coming from the EU, UK or Switzerland, the parties use the Standard Contractual Clauses (and the UK addendum), which are incorporated here by reference. [counsel to confirm]

For Client Data covered by the CCPA/CPRA and similar laws, Megaphone is a service provider. Megaphone:

• Will not sell or share Client Data.
• Will not retain, use or disclose Client Data for any purpose other than the business purposes in the Agreement (running the service for the curator), or outside the direct business relationship with the curator.
• Will not combine Client Data with personal information it receives from or on behalf of another party, or collects from its own interactions, except as the law allows for a service provider.
• Will give the same level of privacy protection the law requires, and tell the curator if it can no longer do so.
• Will let the curator take reasonable steps to make sure Megaphone uses Client Data consistently with the curator’s obligations, and to stop and fix unauthorized use.
• Will help the curator respond to consumer requests.

Megaphone certifies that it understands and will follow these restrictions.

As controller, the curator is responsible for:

• Having a lawful basis, and giving any notices, for the Client Data it collects and the way it uses it.
• Getting the consent required for marketing, and only texting or emailing clients who opted in.
• Honoring opt-outs, STOP requests and quiet hours.
• Making sure instructions it gives Megaphone are lawful.
• Keeping its team’s access appropriate and credentials secure.
• Not putting sensitive or unnecessary data into the service, such as government ID numbers or payment card numbers.
• Following the Acceptable Use Policy.

Each party’s liability under this DPT is subject to the limits in the Curator Agreement. If this DPT conflicts with the Curator Agreement about Client Data, this DPT controls. If you are in the EU or UK and the Standard Contractual Clauses apply, they control over this DPT.