DRAFT — under review. Version of November 9, 2026. Source: https://vlick.ai/dpa
This Data Processing Addendum (“DPA”) forms part of the Vlick Terms of Service or other agreement (the “Agreement”) between ZEROPLE USA INC, a New Jersey corporation (“Vlick”, “Processor”) and the customer that accepted it (“Customer”). It applies when Vlick processes Customer Personal Data on Customer’s behalf. It takes effect without signature when Customer accepts the Agreement; a countersigned copy is available on request at hello@vlick.ai.
Download this DPA (HTML, printable)
“Data Protection Laws” means all laws on privacy and personal data that apply to the processing under the Agreement, including US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA, “CCPA”), and, where applicable, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. “Customer Personal Data” means personal data in Your Content (as defined in the Terms) or otherwise provided by or for Customer and processed by Vlick as processor. “Controller”, “processor”, “data subject”, “personal data breach”, “processing”, “business”, “service provider” and “sell/share” have the meanings in the Data Protection Laws. “Subprocessor” means a third party Vlick engages to process Customer Personal Data.
Customer is the controller (or business) and Vlick is the processor (or service provider) of Customer Personal Data. Where Customer is itself a processor for its own clients (for example an agency), Customer confirms that its instructions and this DPA are authorised by the relevant controller, and Vlick is Customer’s subprocessor. Vlick processes Customer Personal Data only on Customer’s documented instructions, which are the Agreement, this DPA, and Customer’s use and configuration of the Service (including what it uploads, imports, approves and publishes, and the accounts it connects). Vlick will tell Customer if it believes an instruction breaks Data Protection Laws. Vlick is controller of its own account, billing, security and website data, as described in its Privacy Policy.
| Subject matter and duration | Providing the Service under the Agreement, for its term and until deletion under section 10. |
| Nature and purpose | Hosting, storing, analysing (including AI descriptions and metadata extraction), editing, generating video, voice and images, rendering, scheduling and publishing content to accounts Customer connects; support. |
| Categories of data subjects | Customer’s personnel and workspace members; people shown or heard in Customer’s media; Customer’s clients and their personnel; people mentioned in briefs or scripts; people who reviewed videos through review links. |
| Categories of personal data | Names, contact details and roles; images, video and voice; media metadata including capture time and GPS location; content of briefs, scripts and comments; social account identifiers and post results. |
| Sensitive data | Not intended. Customer should not upload special categories of data unless needed and lawful. Precise geolocation in media metadata is kept private to the workspace and removed from outputs. |
| Frequency | Continuous, for as long as Customer uses the Service. |
Vlick ensures that people authorised to process Customer Personal Data are bound by confidentiality, and gives access only as needed to provide the Service, support Customer at its request, keep the Service secure, or comply with law.
Vlick maintains technical and organisational measures appropriate to the risk, including:
Customer gives Vlick general authorisation to use the subprocessors listed at vlick.ai/subprocessors. Vlick imposes data protection terms on each that protect Customer Personal Data at least as much as this DPA, and remains responsible for them. Vlick will give at least 30 days’ notice of a new subprocessor to customers who asked for notices (by email to hello@vlick.ai); Customer may object on reasonable data protection grounds within that period, and if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term.
The Service lets Customer export, correct and delete its data. Vlick will forward to Customer any request it receives from a data subject about Customer Personal Data, without answering it except as Customer instructs, and will reasonably help Customer respond, carry out data protection impact assessments and consult authorities, taking into account the information available to Vlick.
Vlick will notify Customer without undue delay, and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its obligations, and will take reasonable steps to contain and remedy it.
Vlick processes Customer Personal Data in the United States. To the extent Customer Personal Data subject to the GDPR is transferred to Vlick in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA: Module Two (controller to processor) or Module Three (processor to processor), as the case may be; clause 7 (docking) applies; clause 9 option 2 (general authorisation, with the notice period in section 6); the optional wording in clause 11 does not apply; clause 17 option 1, governed by the law of Ireland; clause 18 courts of Ireland. Annexes I and II are sections 3 and 5 of this DPA; the competent supervisory authority is that of Customer’s establishment or representative. For transfers under UK law, the UK International Data Transfer Addendum (version B1.0) applies, completed with the same information; for Swiss transfers, the Clauses apply with the FDPIC as authority and references to the GDPR read as the FADP.
Lawyer Confirm the SCC module choices, Irish governing law, and whether to offer EU/UK customers at launch at all (see Privacy Policy section 9).
Customer can export its data at any time during the term (Settings › Data & privacy › Export). Stored media files are deleted 30 days after a paid plan ends, as the Terms describe. When Customer deletes a workspace, Vlick deletes Customer Personal Data in it 14 days after the request (during which Customer can cancel), except copies in encrypted backups, which expire within about 8 weeks, and data Vlick must keep by law. On request Vlick will confirm deletion in writing.
Vlick will make available the information reasonably necessary to show compliance with this DPA, including answers to reasonable security questionnaires once a year. If that is not enough, or a supervisory authority requires it, Customer may audit Vlick once in any 12 months, on 30 days’ notice, during business hours, at Customer’s cost, under confidentiality, and without access to other customers’ data.
Vlick will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; or combine it with personal data from other sources except as the CCPA allows. Vlick will comply with the CCPA and similar laws as they apply to service providers and processors, give the same level of protection they require, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remedy unauthorised use. Vlick certifies that it understands and will comply with these restrictions.
If this DPA conflicts with the Agreement, this DPA wins for the processing of Customer Personal Data; the Standard Contractual Clauses win over both. The limitation of liability in the Agreement applies to this DPA. This DPA ends when Vlick no longer processes Customer Personal Data. Notices under this DPA go to the addresses in the Agreement; Vlick: ZEROPLE USA INC, New Jersey, United States, hello@vlick.ai (postal address on request at hello@vlick.ai).
Owner Large customers may ask to sign: keep a PDF with signature blocks ready (print the downloadable version).
ZEROPLE USA INC (Vlick)
Name, title, date
Customer
Name, title, date