How does Alorevio protect customer data and GDPR rights?

Alorevio stores customer data in EU-located Cloudflare D1 databases, uses AES-256-GCM encryption at rest, TLS 1.3 in transit, and complies with GDPR Article 28.

Data Processing Agreement

Q: Who operates Alorevio?

Alorevio is operated by Grösser vastgoed en internetdiensten, KvK 42089439, located in Scheemda, The Netherlands.

This Data Processing Agreement ('DPA') supplements the Alorevio Terms of Service and enters into force between the Customer ('Controller') and Grösser vastgoed en internetdiensten, KvK 42089439, located in Scheemda, The Netherlands ('Processor'), pursuant to Article 28 of the European Union General Data Protection Regulation (Regulation (EU) 2016/679 - 'GDPR').

1. Scope, Subject Matter and Duration

1. Subject Matter: Processor processes personal data submitted by Controller in the course of utilizing Alorevio creative workspace, video compositor, and related cloud services.
2. Duration: This DPA remains in effect for the duration of Controller's active Alorevio subscription or account until all personal data is deleted.
3. Nature and Purpose: Processing personal data solely for generating storyboard manifests, video compositing pipelines, subtitle cues, and providing customer support.
4. Categories of Data: User account identifiers, video scripts, prompts, subtitles, audio narration, and technical log identifiers.
5. Categories of Data Subjects: Controller's authorized users, collaborators, and individuals referenced in creative scripts.

2. Obligations of the Processor

Pursuant to Article 28(3) GDPR, Processor warrants and agrees that it shall:
1. Process personal data solely on documented instructions from Controller, including with regard to transfers of personal data to a third country, unless required to do so by European Union or Member State law.
2. Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement technical and organizational security measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk.
4. Respect the conditions for engaging sub-processors pursuant to Article 28(2) and (4) GDPR.
5. Assist Controller by appropriate technical and organizational measures in responding to data subject requests under Chapter III GDPR.
6. Assist Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation).
7. At Controller's choice, delete or return all personal data upon termination of the service.
8. Make available to Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits conducted by Controller or an authorized auditor.

3. Authorized Sub-Processors

Controller provides general authorization for Processor to engage the following vetted sub-processors:

Cloudflare, Inc.: Cloud infrastructure, serverless edge Workers, and EU D1 primary database storage located within the European Union.
Google Cloud Platform / Vertex AI: Google Cloud Identity Platform and Firebase Authentication for secure sign-in, and Vertex AI (Gemini 2.5 Flash API inference) for automated editorial and script drafting.
Stripe Payments Europe, Ltd.: Payment processing, SEPA Direct Debit, and credit card subscription billing.
Resend, Inc.: Transactional email delivery for support and account notices.

Processor imposes data protection terms on each sub-processor no less protective than those in this DPA. Processor remains fully liable for the performance of its sub-processors' obligations.

4. Technical and Organizational Measures (TOMs)

Processor maintains appropriate technical and organizational measures, including:

AES-256-GCM Encryption: Encryption at rest for stored credentials, service settings, and access tokens.
TLS 1.3 Encryption: Strong encryption for all data in transit across public and private networks.
Access Control & Least Privilege: Access to administrative tools is gated behind multi-factor authentication and Cloudflare Access.
Isolated Multi-Tenancy: Strict logical separation of customer workspaces and credit ledgers.
Audit Logging: Comprehensive, append-only activity and audit logs for administrative modifications.

5. Personal Data Breach Notification

Processor shall notify Controller without undue delay (and in any case within 48 hours) upon becoming aware of a confirmed personal data breach affecting Controller's data. The notification shall contain details of the breach, affected categories of data, and recommended mitigation measures in accordance with Article 33(3) GDPR.

6. International Data Transfers

Personal data is primarily stored and processed within the European Union (Cloudflare EU D1 database in Western Europe). Any international data transfers outside the European Economic Area shall be conducted pursuant to valid European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.

7. Governing Law and Contact

This DPA is governed by the laws of The Netherlands.
Data Protection Contact:
Grösser vastgoed en internetdiensten
KvK: 42089439
Address: Scheemda, The Netherlands
Email: info@victorgrosser.nl / support@alorevio.com