Data Processing Addendum

Roles and responsibilities

This Data Processing Addendum defines the relationship between LaserPulse and its customers when processing personal data subject to GDPR.

Processing scope

LaserPulse processes the following categories of data on behalf of customers:

• User account data (name, email)
• Content inputs and campaign data
• Integration and OAuth token data
• Customer-uploaded media, including images and assets used for AI image generation and model training
• AI models derived from customer-uploaded training assets
• Platform usage and analytics data

Customer-directed AI model training may include training on brand assets, authorized images of individuals, spokespersons, creators, employees, or other media supplied by the Customer.

Sub-processors

We use the following sub-processors to deliver the service. All sub-processors are bound by appropriate data protection agreements.

• Stripe - payment processing
• OpenAI - AI content generation
• Google Vertex AI - AI image and content processing
• fal.ai - AI image generation and model training
• Black Forest Labs (BFL) - AI image generation
• Cloudflare R2 - media storage and delivery
• Cloud hosting providers - infrastructure and storage

We will notify customers of any material changes to our sub-processor list with reasonable advance notice. A current list is available on request.

Security measures

LaserPulse implements appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit using TLS
• Access controls limiting data access to authorized personnel
• Regular security monitoring and logging
• Secure credential handling for platform integrations

International data transfers

LaserPulse is based in the United States. When transferring data from the EU to the US, we rely on:

• Standard contractual clauses (SCCs) where applicable
• Contractual safeguards with sub-processors
• Standard transfer mechanisms recognized under GDPR

Data subject requests

We assist customers in fulfilling their obligations to data subjects, including:

• Access requests - providing data exports upon request
• Deletion requests - removing personal data, uploaded training assets, and derived models from our systems
• Correction requests - updating inaccurate data
• Portability requests - providing data in a machine-readable format

Requests should be submitted to [email protected]. We will respond within 30 days.

Breach notification

In the event of a personal data breach, LAK Technology Inc will notify affected customers without undue delay and within 72 hours of becoming aware of the breach, where feasible. Notification will include the nature of the breach, categories of data affected, and measures taken to address it.

Data deletion and retention

Upon termination of a customer's account:

• Personal data, uploaded training assets, and derived AI models can be deleted upon written request to [email protected]
• Backup copies may persist temporarily for up to 90 days
• We retain data required for legal compliance as long as legally required