Data processing agreement

Version 2026-10-28 · In force from 28 October 2026 · Part of the Terms of service

In short: if you use Pro for a business and your recordings show other people's personal data, you decide what is stored and we keep it for you as your processor. This agreement applies automatically, with nothing to sign. It uses the European Commission's own standard clauses, and lists everyone who helps us store your files.

1. When it applies

This agreement applies when you use Motion Mockups for a business or another professional purpose, and the recordings, images, file names or project names you store with us contain personal data for which you are the controller under the General Data Protection Regulation (GDPR). It is part of the Terms of service: accepting the Terms for that use accepts this agreement, and you do not need to sign anything. If you want a copy signed by us, write to hello@motionmockups.com.

It covers only the content you store. Your account, subscription and usage data are ours to answer for as controller, under the Privacy policy.

2. The standard contractual clauses

You, as controller, and we, as processor, agree to the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/915, which are incorporated into this agreement with these choices:

• Wherever the clauses offer a choice of regulation, Option 1: the GDPR (Regulation (EU) 2016/679).
• Clause 5 (docking clause) is not used.
• Clause 7.7: Option 2, general written authorisation, from the list of sub-processors in Annex IV. We tell you of any intended addition or replacement at least 30 days in advance, by email to your account's address.
• Annexes I to IV are completed below.

If anything in the Terms, the Privacy policy or this page contradicts the clauses, the clauses prevail.

3. How the clauses work here

• Your instructions. What you do in the service is your documented instruction: adding, replacing or removing a recording, deleting a project or your account, and the Terms. You can give further instructions by email.
• Objecting to a sub-processor. You can object within the 30 days' notice. If we cannot meet your objection, you may end Pro before the change and we refund the unused part of the paid period.
• Information and audits. We answer questions about the processing in writing first. Where an audit is still needed, we arrange it with reasonable notice. For our sub-processors we rely on their own published certifications and audit reports.
• Help with your obligations. You can remove any stored file yourself at any time, which serves most requests from the people in your recordings. For anything else, write to us and we help without undue delay.
• Personal data breaches. We notify you without undue delay after we become aware of a breach of your stored content, by email to your account's address, with what clause 9 requires.
• At the end. Stored files are deleted when you remove them, delete their project or your account, and 30 days after your Pro subscription ends, and are gone from storage within two days. If you would rather have them returned, ask before then and we send you download links first.
• Liability. The limits in the Terms apply to this agreement as far as the GDPR allows; they do not limit the rights of the people whose data you store.

Annex I · List of parties

Controller: the business that holds the Motion Mockups account, identified by and reachable at the account's email address. It accedes by accepting the Terms of service for business use.

Processor: Krystof Jezek, sole trader, IČO 08424683, Pod altánem 2406/48, 100 00 Praha, Czech Republic. Contact: Krystof Jezek, owner, hello@motionmockups.com. No data protection officer is appointed, as none is required.

Annex II · Description of the processing

• People whose data is processed: anyone whose personal data appears in what you store, for example your users, customers or colleagues shown on screen.
• Categories of personal data: whatever your recordings and images show or contain, such as names, email addresses, account details, messages, faces or voices; and the file and project names you give.
• Sensitive data: not intended. If a recording contains any, it gets the same safeguards as everything else: nobody views it, only your signed-in account can reach it, and it is deleted on your instruction.
• Nature of the processing: receiving the files you upload, storing them, sending them back to your signed-in account, and deleting them; keeping file and project names in our database. We do not view, analyse or share your files, or use them to train AI models.
• Purpose: recording storage under the Terms, so your projects open with their recordings on any computer you sign in on.
• Duration: from upload until the file is deleted as described in section 3.
• Sub-processors: subject matter, nature and duration as in Annex IV, each for as long as we process your content.

Annex III · Technical and organisational measures

• Encryption: every upload, download and request travels over HTTPS. Files and the database are encrypted at rest by Cloudflare and Supabase.
• Access to files: files sit in a private storage bucket with no public access, each under its account's own path. A link to a file is signed for that file only, lasts one hour and is issued only to the signed-in account that owns it; the server takes the account from the session, so a link can never name another account's file. File contents never pass through our server functions.
• Database: row-level security lets each account read only its own rows. Keys that bypass it stay on the server.
• Sign-in: a one-time code sent by email, or Google. Deleting an account needs a fresh sign-in confirmed with an emailed code.
• Administrator access: only Krystof Jezek holds administrator access to the storage and the database, and opens a stored file only when you ask (for support), or when the law or a valid notice of illegal content requires it.
• Location: files are stored in Cloudflare R2's EU jurisdiction; the database is hosted in the EU (Ireland).
• Minimisation: only the recordings and images of a Pro account's projects are stored. Their contents are never read on our servers, and our usage statistics never include file names.
• Limited retention: a daily job deletes files whose project or account is gone, files of accounts whose Pro ended more than 30 days ago, and uploads that never finished.
• Availability: storage durability and redundancy come from Cloudflare. We keep no separate backup; your original file is the way to restore a lost one.
• Application security: a strict content security policy, no framing by other sites, rate limits, and security reviews of the service before release.

Annex IV · Sub-processors

You authorise these sub-processors for your stored content. We bind each by a contract with the same data protection obligations, and give you 30 days' notice of any change.

• Cloudflare, Inc. (United States) — stores the files in R2's EU jurisdiction and serves them to your account through signed links.
• Supabase, Inc. (United States) — hosts the database that holds file and project names and your edits, in the EU (Ireland).
• Vercel, Inc. (United States) — runs the server functions that record file names and issue signed links, in the United States. It never receives file contents.

Where a sub-processor processes data outside the EU, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses for international transfers. The other providers named in the Privacy policy (sign-in emails, Google sign-in, payments) never handle your stored content.