1. Scope
This Data Processing Addendum applies when a business customer uses MegaX to process personal data on behalf of that customer, including videos, audio, images, transcripts, captions, team data, and project metadata.
2. Roles
For customer content, the customer is normally the controller and MegaX is normally the processor. For account, billing, security, fraud prevention, legal compliance, and service operations data, MegaX may act as an independent controller.
3. Processing instructions
MegaX processes customer personal data only to provide, secure, support, maintain, and improve the Service, and as otherwise required by law. The product settings, project actions, uploads, rendering requests, and account configuration are customer instructions.
4. Sub-processors
MegaX may use sub-processors for hosting, databases, object storage, AI processing, payments, email, caching, monitoring, and support. Customers authorize those sub-processors where needed to provide the Service. A production sub-processor list should be published before launch.
5. Security measures
- Access controls, admin-only permissions, and audit logs.
- Password hashing, secure session cookies, 2FA support, and session revocation.
- Rate limits, cost limits, storage quotas, queue locks, and abuse controls.
- Separated storage buckets or paths, signed URLs where appropriate, and lifecycle cleanup.
- Operational monitoring, error logs, and worker heartbeat checks.
6. Data subject requests
MegaX will reasonably assist business customers with access, deletion, correction, restriction, portability, objection, and other data subject requests where the customer cannot fulfill the request using the product.
7. Deletion and return
On account deletion or contract termination, MegaX will delete or return customer content according to product functionality, backup cycles, legal retention needs, security requirements, and billing/tax obligations.
8. International transfers
Where customer personal data is transferred outside the EEA/UK/Switzerland, MegaX will rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or equivalent lawful transfer mechanisms where required.