Version of 27 October 2026. The French version prevails. This translation is provided for convenience only. Read the French version.

Data Processing Agreement – Parisia

Article 1 – Purpose

1.1 This data processing agreement (the “Agreement”) supplements the Terms of Use. It applies when Parisia processes, on behalf of the Customer, personal data contained in Uploaded Images. For this data, the Customer is the controller and Parisia is its processor, within the meaning of Article 28 of the GDPR. In this Agreement, the “Customer” means any User, including one who uses the free plan.

Article 2 – Description of the processing

2.1 The processing carried out by Parisia on behalf of the Customer is as follows:

Subject matter: creation of Visuals, Alt Texts, file names and captions from the Images uploaded by the Customer.
Nature: receipt and temporary storage of Uploaded Images, transmission to AI Providers, creation and making available of Visuals and Alt Texts.
Purpose: to provide the Service to the Customer.
Duration: Uploaded Images: until processing is complete, and no later than 24 hours after upload. Visuals: 30 days at most, or until deleted by the Customer.
Data concerned: image and appearance of the people shown in Uploaded Images, and any other personal data visible in those images.
Data subjects: people shown in Uploaded Images, for example the Customer’s models, staff or customers.

Article 3 – Customer’s instructions

3.1 Parisia processes the data only on the Customer’s documented instructions. The Terms of Use, this Agreement and the Customer’s use of the Tools constitute those instructions. If European Union or Member State law requires Parisia to carry out other processing, it informs the Customer before doing so, unless that law prohibits it.

3.2 Parisia informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or another data protection rule.

Article 4 – Confidentiality

4.1 Parisia ensures that the persons authorised to process the data have committed themselves to confidentiality or are subject to a statutory obligation of confidentiality.

Article 5 – Security

5.1 Parisia implements technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, to protect the data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Article 6 – Sub-processors

6.1 The Customer gives Parisia general authorisation to use sub-processors for creating Visuals and Alt Texts (AI Providers) and for hosting. The up-to-date list of these sub-processors is set out in the annex to this Agreement.

6.2 Parisia updates the list at least 15 days before any addition or replacement of a sub-processor, and informs Customers by email. The Customer may object during this period, on grounds relating to data protection, by writing to contact@parisia.app. If Parisia maintains the change, the Customer may cancel their subscription under the conditions of the Terms of Sale.

6.3 Parisia imposes on each sub-processor, by contract, data protection obligations that comply with Article 28 of the GDPR. It remains liable to the Customer for its sub-processors’ compliance with these obligations.

Article 7 – Transfers outside the European Union

7.1 Parisia transfers data outside the European Union only on the Customer’s documented instructions and in compliance with Chapter V of the GDPR. By accepting this Agreement, the Customer authorises transfers to the sub-processors on the list referred to in Article 6.1. This list states each sub-processor’s country of processing and the safeguard used, such as the standard contractual clauses adopted by the European Commission.

Article 8 – Assistance to the Customer

8.1 If a data subject sends Parisia a request directly concerning data processed on the Customer’s behalf, Parisia forwards it to the Customer without delay. Where possible, and taking into account the nature of the processing, Parisia assists the Customer in responding to requests to exercise rights.

8.2 Parisia notifies the Customer of any personal data breach without undue delay after becoming aware of it, and provides the information it has. Taking into account the nature of the processing and the information available to it, Parisia also assists the Customer in complying with its security obligations and, where applicable, in carrying out an impact assessment.

Article 9 – End of the processing

9.1 During the Service, data is deleted within the periods set out in Article 2.1. At the end of the Service, Parisia deletes from the Service all data still being processed on the Customer’s behalf, unless the law requires it to be kept. The corresponding technical files hosted with its sub-processors are erased according to their rules. Before this deletion, the Customer may download their Visuals from their history.

Article 10 – Audit and information

10.1 Parisia makes available to the Customer the information necessary to demonstrate compliance with this Agreement. It allows audits, including inspections, to be carried out by the Customer or by an auditor the Customer appoints, and contributes to them.

10.2 Except in the event of a data breach or a request from a supervisory authority, an audit is requested in writing at least 30 days in advance, at most once a year. It is carried out first on the basis of the documents provided by Parisia, and leads to an inspection only if those documents are not sufficient. Its costs are borne by the Customer, and the auditor is bound by confidentiality.

Annex – Sub-processors

List of the sub-processors that process Uploaded Images and Visuals (Article 6.1).

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Role: creation of Visuals and Alt Texts (Gemini and Nano Banana models). Country of processing: European Union or United States depending on the service. Transfer safeguard: standard contractual clauses of the European Commission.

BytePlus Pte. Ltd., Singapore. Role: creation of Visuals (Seedream model). Transfer safeguard: standard contractual clauses of the European Commission.

Bubble Group, Inc., 22 West 21st Street, Floor 2, New York, NY 10010, United States. Role: hosting of the application and the database. Country of processing: United States. Transfer safeguard: standard contractual clauses of the European Commission.

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. Role: hosting of the Service’s API, which sends images to the AI Providers. Transfer safeguard: standard contractual clauses of the European Commission.