Legal
Data processing agreement
For creators and agencies in the EU who need one. The short version below, the signed PDF on request.
Roles
You are the controller of the data in your kit; OneMediaKit is the processor. It is processed only to render, refresh and deliver your kit, on your instructions, and for nothing else.
What is processed
Your account email, the statistics the platforms return for your connected accounts, the text and images you add to your kit, and the addresses of brands who request rates through it. Retention follows the privacy policy: the life of your account, then 30 days.
Security measures
Read-only platform permissions, access tokens stored hashed or encrypted, TLS on every request, deletion within 30 days, and a breach notice to you without undue delay, as the GDPR requires.
Your rights and audits
You can delete everything from your settings at any time. A data-subject request or an audit question that reaches OneMediaKit instead of you is forwarded within 5 business days, with the information needed to answer it.
Sub-processors
- Stripe, for payments and receipts
- The hosting provider named in the privacy policy, for servers and backups
- The email provider named in the privacy policy, for transactional email only
Need a signed copy?
The full agreement, with the EU standard contractual clauses attached, is a PDF signed on the OneMediaKit side. One email and it is in your inbox within one business day.