Data Processing Agreement

1. Parties & scope

This DPA is between ArcPixel (Moonlight Arc, "we", "us") and the individual or business that has created an ArcPixel account (the "Customer", "you"). It applies wherever we process personal data on your behalf as described in our Privacy Policy. It does not replace that policy — it exists so you can point your own clients, auditors, or regulators to a dedicated processor agreement if one is required.

2. Roles

For personal data belonging to third parties that you include in your portfolio or career profile (for example, client names, team members, or collaborators) and processed through your account, you are the controller (GDPR) / data fiduciary (DPDP Act), and ArcPixel is the processor / data processor acting on your behalf. You determine what data is included and why; we process it only to provide the service and on your documented instructions.

For your own account data (login credentials, billing, and profile information), Moonlight Arc is the controller, as described in our Privacy Policy.

3. Subject matter & duration

The subject matter of processing is the operation of the ArcPixel platform for your account — the categories of data, data subjects, and processing activities are described in our Privacy Policy (see "Data we collect" and "How we use it"). Processing continues for as long as your account is active, and for the retention period described in Section 10 after it is deleted.

4. Processing instructions

We process personal data only to provide, maintain, and support the ArcPixel platform, and otherwise only on your documented instructions (for example, portfolio content you upload and publish, or configuration choices you make in the editor) or as required by law. If we believe an instruction violates GDPR, the DPDP Act, or another applicable data protection law, we will inform you before carrying it out.

5. Sub-processors

We use a small number of sub-processors to operate the platform, listed on our Sub-processors page. Each is bound by contractual terms that require a level of data protection equivalent to this DPA. We will update that page and, where required, give you the opportunity to object before adding a new sub-processor that materially changes how your data is handled.

6. Security measures

We maintain technical and organizational measures appropriate to the risk, including encryption in transit, access controls scoped by role, and audit logging of sensitive changes — as described in our Privacy Policy.

7. Assisting with data subject requests

Where a third party exercises a data subject/principal right (access, correction, erasure, portability, or objection) directly with us regarding data you control, we will route the request to you and otherwise assist you in responding within a reasonable timeframe, as described in our Privacy Policy.

8. Data breach notification

If we become aware of a personal data breach affecting your account's data, we will notify you without undue delay after becoming aware of it, with the information reasonably available to us at the time, so you can meet your own notification obligations under GDPR, the DPDP Act, or other applicable law.

9. International transfers

Where personal data is transferred outside your country — for example, to infrastructure or sub-processors located elsewhere — we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognized under GDPR and the DPDP Act, as described in our Privacy Policy.

10. Return or deletion of data

If you delete your account, we remove your portfolio content, files, and profile data promptly, except where we are required to retain records for legal, tax, or audit purposes. If you cancel a paid subscription without deleting your account, your work remains saved as private drafts. You may export your portfolio data at any time before account deletion by contacting us.

11. Contact

Questions about this DPA, or requests for a signed/countersigned copy, can be sent to support@arcpixel.io.