Delivami

Legal & Studio Compliance

Transparent agreements governing creative file delivery, pay-to-unlock escrow, payout settlement, and data sovereignty on Delivami.

Data Processing Agreement (DPA)

Version 2026-10-27 · Last updated: November 2026

This Data Processing Agreement (“DPA”) forms an integral part of the Delivami Terms of Service and governs the processing of Personal Data by Delivami Inc. (“Processor”) on behalf of the Creator or Studio workspace (“Controller”) in accordance with the EU/UK General Data Protection Regulation (GDPR), the Ghana Data Protection Act (Act 843), the Nigeria Data Protection Act (NDPA), the Kenya Data Protection Act, and applicable international privacy laws.

1. Roles & Scope of Processing

  • Data Controller: The Creator or Studio is the Data Controller with respect to the Personal Data of their clients, reviewers, collaborators, and invoice recipients uploaded to or invited into a Delivami workspace.
  • Data Processor: Delivami acts as the Data Processor, processing Client and project Personal Data solely on the documented instructions of the Controller (such as sending delivery links, verifying portal OTP codes, recording timestamped review notes, and settling invoices).

2. Categories of Data & Data Subjects

  • Data Subjects: The Controller’s clients, external reviewers, agency collaborators, and billing contacts.
  • Categories of Personal Data: Full name, email address, phone number (for SMS/WhatsApp delivery and payment notifications), company name, billing address, invoice line items, timestamped review comments, voice notes, approval signatures, and access audit logs (IP address and timestamps).

3. Technical & Organizational Security Measures

Delivami implements defense-in-depth technical and organizational safeguards to protect Personal Data and creative assets:

  • Encryption in Transit & at Rest: All data in transit is encrypted via TLS 1.3. Master files in Cloudflare R2 vaults are encrypted at rest with AES-256, and sensitive database fields (such as phone numbers, webhook secrets, and tokens) are encrypted using authenticated AES-256-GCM encryption.
  • Strict Tenant Isolation: Every database query and storage path is scoped to the Controller’s unique user or workspace organizationId. API keys (dv_...) are stored exclusively as SHA-256 hashes.
  • Access Control & Step-Up MFA: Studio accounts support FIDO2/WebAuthn biometric passkeys and TOTP 2FA, with mandatory step-up verification and automated 12-to-24-hour withdrawal security holds upon sensitive account changes.
  • Zero Foundation AI Training: Delivami contractually guarantees that Controller files, transcripts, and client comments processed through Cloudflare Workers AI or AssemblyAI are never used to train public foundation models.

4. Subprocessing & International Transfers

The Controller grants general authorization for Delivami to engage the third-party infrastructure providers listed on our Subprocessors page. Delivami enters into written data protection agreements with each Subprocessor requiring equivalent security standards and Standard Contractual Clauses (SCCs) where Personal Data is transferred across borders.

5. Data Subject Rights & DSAR Assistance

Delivami provides built-in self-serve tools under Settings > Privacy & Data allowing Controllers to export structured JSON reports (Data Subject Access Requests) or permanently delete client, project, and account records.

6. Deletion, Return of Data & Breach Notification

  • Account & Project Erasure: Upon workspace deletion (following the 30-day grace window), Delivami permanently purges all Controller project files, R2 objects, Stream videos, comments, and client contact records, retaining only anonymized tax ledger records for 6 years as required by law.
  • Incident Notification: In the event of a confirmed Personal Data Breach affecting Controller data, Delivami will notify the Controller without undue delay (and within 72 hours where feasible) along with remediation details.

Studio plan customers requiring a countersigned PDF copy of this DPA may request one at legal@delivami.com.