Last updated: 2026-11-05 · Applies to customers in the EEA, UK and other jurisdictions that require a GDPR Article 28 DPA.
LensWave ("we", "us") acts as a data processor on behalf of the customer ("Controller") for personal data submitted through the service. You remain the controller of your end-users' personal data.
This DPA governs processing of personal data by LensWave when you use the service: account data (email, username), project metadata (prompts, canvas graphs, generated assets), and support tickets. We process this only to provide the service, per your documented instructions.
We engage the following sub-processors: Resend (transactional email), PostHog (product analytics), Creem (payments), Cloudflare (CDN/WAF/DDoS). Model inference runs on your own provider keys (BYOK) — we do not operate the model providers; data is sent directly to the provider you configure under your own contract with them.
TLS in transit, encryption at rest, role-based access, audit logging, and annual penetration tests. See our Privacy Policy for detail.
We will assist you (by suitable technical and organisational measures) in responding to Data Subject requests and personal-data breach notifications, within 72 hours of becoming aware of a breach.
We may process data in jurisdictions outside the EEA (notably Japan, where our primary infrastructure is hosted). We rely on standard contractual clauses (SCCs) and supplementary measures for transfers.
On termination, we delete or return personal data within 30 days, except where retention is required by law (e.g. payment records retained for 7 years under tax law).