Data Processing Addendum

1. Roles

For personal data in the Studio’s books (client details, invited viewers’ emails, guest names, notes, advice, votes, device IDs and visit counts), the Studio is the controller and Momentus is the processor. Under US state privacy laws, Momentus is the Studio’s service provider. For Studio account and billing data, Momentus is a separate controller under its Privacy Policy.

2. Details of processing

3. Momentus’s commitments

• Process personal data only on the Studio’s documented instructions (the Terms, this DPA and the Studio’s settings in Lore), and tell the Studio if an instruction appears to break the law.
• Not sell or share the personal data, not use it for advertising or for any purpose outside the business relationship, and not combine it with data from other sources except as the law allows a service provider to.
• Make sure everyone who can access the data is bound by confidentiality.
• Keep the security measures in section 6.
• Help the Studio answer data subject requests (access, correction, deletion, copy), mainly through the tools in Lore (hide, delete, export), and pass on any request we receive directly. Help beyond the tools in Lore may be charged at our reasonable cost.
• Provide reasonable information to help the Studio with data protection impact assessments and regulator consultations where they relate to Lore.
• Notify the Studio without undue delay after becoming aware of a personal data breach affecting its data, with the information reasonably available to help the Studio meet its own notification duties. Notifying the Studio isn’t an admission of fault.
• Delete the Studio’s book data 30 days after cancellation (after the export window), including from live systems, with backups overwritten within 7 days.
• Make available the information needed to show compliance with this DPA. Audits are met first by our written answers to a reasonable security questionnaire and our providers’ certifications (such as SOC 2 reports). An on-site or further audit is allowed only where a regulator requires it or after a breach affecting the Studio, at most once a year, on 30 days’ notice, under confidentiality, and at the Studio’s cost.

4. Subprocessors

The Studio authorizes Momentus to use the subprocessors below. Momentus binds each one to data protection terms at least as protective as this DPA and stays responsible for them. We will announce new subprocessors on this page and by email to Studio owners at least 30 days in advance; the Studio may object on reasonable data protection grounds and, if we can’t resolve it, cancel and receive a pro-rated refund of prepaid fees.

Stripe processes Studio billing data as Momentus’s own provider, not book data. Booth.Events is the Studio’s own provider: Lore reads from it with the Studio’s API key and permission, and it is not a Momentus subprocessor.

5. International transfers

Momentus processes data in the United States. Where the Studio is subject to the GDPR, UK GDPR or Swiss law and data moves to the US, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), which are incorporated by reference, with: Clause 7 (docking) included; Clause 9 option 2 (general authorization, 30 days’ notice); Clause 11 optional wording omitted; Clauses 17 and 18 governed by and decided in the courts of Ireland; Annex I as in section 2 above; Annex II as in section 6; Annex III as in section 4. For the UK, the UK International Data Transfer Addendum applies, and for Switzerland the SCCs apply with references read as the Swiss FADP. Where Momentus is certified under the EU-US Data Privacy Framework, that certification may be relied on first. For Canadian, Australian and other studios, Momentus provides protection comparable to the Studio’s home law, as required by those laws.

6. Security measures

• Encryption in transit (TLS) for all traffic, and encryption at rest by our database provider.
• Row-level security on every database table, so each studio can reach only its own data; guests never access the database directly.
• Booth.Events API keys stored in an encrypted vault, never in code or logs.
• Webhook signatures verified; Booth.Events payload fields Lore doesn’t need (guest emails, phone numbers, survey answers) discarded on receipt.
• Passwords handled by our authentication provider and stored hashed; admin access limited to Momentus staff who need it, with an audit log of key admin and studio actions.
• Rate limits and a word-list filter on guest submissions.
• Daily backups by our database provider; data minimization (no photo files, no IP addresses in Lore’s database).

7. The Studio’s responsibilities

• Have a lawful basis for the book data, and give clients and guests the notices the law requires. Lore shows guests a short notice and links to our Privacy Policy before they post; the Studio is responsible for its own notices too (for example on QR signs and in client contracts).
• Tell Momentus about any instructions beyond the Terms and settings, and respond to data subject requests about its books.

8. General

If this DPA conflicts with the Terms, this DPA wins for personal data; if it conflicts with the SCCs, the SCCs win. Each party’s liability under this DPA and the SCCs together is subject to the limits and exclusions in the Terms, except where the law or the SCCs don’t allow that. The Studio is responsible for the lawfulness of the personal data it brings into Lore and for its instructions. Questions: support@lorebooth.com.