Data Processing Addendum

You (the customer) are the data controller for personal data you send to PromoStack (e.g. customer references in redemptions). Flux Studio is the data processor, processing that data only on your instructions and to operate the service.

• Categories: customer references you provide, redemption and ledger records, fraud signals (velocity, blocklist hits).
• Purpose: executing promotion redemptions, enforcing stacking and exclusion rules, maintaining immutable ledgers, preventing fraud.
• Duration: for the life of your account, plus any legally required retention afterwards.

• Process data only on your documented instructions.
• Ensure personnel are bound by confidentiality and process data only as needed to operate the service.
• Implement appropriate technical and organizational measures — see our Security page (TLS in transit, encryption at rest, hashed API keys, access controls, rate limiting).
• Assist you with data-subject requests (access, deletion, export) as far as technically feasible.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, at abdullah129026@fluxyai.codes.
• Delete or return your personal data on termination of the service, except where retention is required by law.

We use the following sub-processors:

• Neon (managed Postgres) — primary data store;
• Vercel (hosting) — application runtime;
• Upstash (Redis) — rate limiting;
• Resend (email) — transactional notifications;
• Paddle (billing) — merchant of record for subscriptions.

We will notify customers of sub-processor changes via email or the dashboard before they take effect.

Sub-processors may store data in the US and EU. Transfers are safeguarded by standard contractual clauses or equivalent mechanisms where required.

Customers may request reasonable information about our security practices once per year by writing to abdullah129026@fluxyai.codes. On-site audits are not offered; remote questionnaires and documentation are.

If this DPA conflicts with our Terms of Service, this DPA prevails for data-protection matters.