Data Processing Agreement

Last updated: October 28, 2026

For accounts created before October 23, 2026, the changes in this version take effect on December 1, 2026.

Backblaze (Annex III) is used only after the 14 days' notice described in Section 7.2.

This Data Processing Agreement ("DPA") is between HoverReel LLC ("HoverReel," "we," "us," or "our") and the business that holds a HoverReel account ("Merchant," "you"). It covers personal data about the people who visit your website and see a HoverReel video Player there ("Visitors"), which HoverReel processes for you when you use the HoverReel dashboard and Players (together, the "Service").

Capitalized terms not defined here have the meaning given in our Terms of Service or Privacy Policy.

1. Scope

This DPA applies to HoverReel's processing of Visitor personal data collected by a HoverReel Player on your website, as described in Annex I. It applies to the extent that processing is subject to one of these laws (together, "Data Protection Law"):

the EU General Data Protection Regulation (GDPR);
the UK GDPR;
the Swiss Federal Act on Data Protection;
the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA);
a substantially similar data protection law.

This DPA does not cover your own account data. That's information about you and your team, such as login emails, billing details and the content you upload. HoverReel is the controller of that data, and our Privacy Policy governs it.

2. Definitions

"Controller," "processor," "data subject," "personal data," "processing," "special categories of personal data," "personal data breach" and "supervisory authority" have the meanings given in the GDPR. Equivalent terms under other Data Protection Law (for example "business," "service provider," "sell" and "share" under the CCPA) are read the same way.
"Sub-processor" means a third party HoverReel engages to process Visitor personal data in providing the Service, as listed in Annex III.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, together with the UK's International Data Transfer Addendum where applicable.

3. Roles of the Parties

For Visitor personal data, you are the controller and HoverReel is the processor. You decide to show HoverReel Players on your website. HoverReel processes the resulting data only to provide the Service to you, following your instructions in this DPA and the Terms of Service. We don't sell it, share it for advertising, or use it for our own marketing.
Where the CCPA applies, HoverReel acts as your "service provider" for the same data, on the same terms.
HoverReel uses Visitor data to protect the Service: limiting abuse, and spotting and capping unusual viewing. We treat this as part of providing the Service to you.

4. Your Instructions

HoverReel processes Visitor personal data only on your documented instructions:
- (a) this DPA and the Terms of Service; and
- (b) the settings you choose in the Service, such as the websites your Players may run on.
If HoverReel believes an instruction breaks Data Protection Law, we'll tell you before acting on it, unless the law prohibits telling you.
You're responsible for your own compliance with Data Protection Law. That includes having a legal basis for using HoverReel on your website, mentioning it in your privacy notice, and getting any consent your Visitors' local laws require. For example, the EU and UK may require consent for the visitor ID the Player keeps in the browser. Our Cookies Policy describes exactly what the Player stores, so you can describe it accurately.

5. Description of Processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

6. Confidentiality

HoverReel makes sure that anyone it authorizes to process Visitor personal data, including its own staff, is bound by a duty of confidentiality.

7. Processor Obligations

7.1 Security

HoverReel maintains appropriate technical and organizational measures to protect Visitor personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage. These measures are described in Annex II.

7.2 Sub-processors

You authorize HoverReel to use the sub-processors listed in Annex III.
We'll give you at least 14 days' notice before adding a new sub-processor, by updating Annex III and emailing your account's Owners or showing a notice in the dashboard.
- You may object on reasonable data protection grounds within that time by emailing [email protected].
- If we can't resolve the objection, either of us may end the part of the Service that needs that sub-processor.
We bind each sub-processor to data protection obligations at least as protective as this DPA. We remain responsible to you for its work as if we did it ourselves.

7.3 Help with Data Subject Requests

The Player doesn't know who a Visitor is, so HoverReel generally can't identify a Visitor or act on their request on its own. You're best placed to receive and answer those requests. If you need our help with a verified request, we'll give reasonable technical assistance. For example, if you can give us a Visitor's random visitor ID, we can delete the viewing data stored under it. For Shopify stores, we act on Shopify's customer data-erasure and data-request messages automatically: we delete that customer's video-sales orders, or email the account's Owners what we hold about them.

7.4 Help with Compliance

HoverReel will reasonably help you with data protection impact assessments and prior consultations with a supervisory authority where Data Protection Law requires them, as far as they relate to our processing and the information available to us.

7.5 Personal Data Breach Notification

HoverReel will notify you without undue delay after becoming aware of a personal data breach affecting Visitor personal data, and will aim to do so within 72 hours. The notice will include the information reasonably available to us at the time: the nature of the breach, its likely consequences, and the measures taken or proposed. Where not all of that is known yet, we may provide it in stages as we learn more. A notice is not an admission of fault or liability.

7.6 Deletion

When an account's Owner deletes the account, the account is closed straight away: its Players stop showing and no new Visitor data is recorded. Seven days later HoverReel permanently deletes the account's Visitor viewing data, unless an Owner keeps the account before then. After that, copies remain only in our encrypted backups, which are deleted automatically within 14 days. On your written request we'll also delete specific Visitor data sooner, where we can identify it. The only exception is data that a law requires us to keep; we'll keep protecting that data and use it only for that purpose.

7.7 Audits

On reasonable request, no more than once in any 12 months, HoverReel will give you a written summary of the measures in Annex II that is sufficient to show compliance with this DPA. If that isn't enough for your own legal obligations, we'll reasonably cooperate with a more detailed audit on these conditions:

you give reasonable advance notice;
the audit is scoped by agreement and held during normal business hours with minimal disruption;
you cover your own costs and our reasonable costs.

8. International Data Transfers

Where processing involves transferring Visitor personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision (including the United States), the Standard Contractual Clauses are incorporated into this DPA with these elections:

Module Two (controller to processor) applies. You are the data exporter and HoverReel is the data importer.
Clause 7 (the optional docking clause) is included.
Clause 9(a): Option 2 (general written authorization) applies, with a time period of 14 days, as in Section 7.2.
Clause 11(a): the optional independent dispute resolution body language is not included.
Clause 17: the law of Ireland governs, unless you're established in an EU member state whose law must govern, in which case that law applies.
Clause 18(b): disputes are resolved in the courts of Ireland, or of the member state selected under Clause 17.
Annexes to the SCCs:
- Annex I.A, I.B and I.C are as set out in Annex I of this DPA. The competent supervisory authority is that of the EU member state where you're established, or Ireland's if there is none.
- The SCCs' Annex II is Annex II of this DPA.

For transfers from the United Kingdom, the UK International Data Transfer Addendum applies with the same elections, adapted as the Addendum requires.

9. CCPA and US State Privacy Laws

Where HoverReel is your "service provider" under the CCPA, or acts in an equivalent role under a similar US state law, HoverReel understands and will comply with the restrictions that apply to service providers. In particular, HoverReel will not:

sell or share Visitor personal data;
keep, use or disclose it for any purpose other than providing the Service to you as described in this DPA and the Terms of Service, including for cross-context behavioral advertising;
combine it with personal data from other sources, except as that law allows.

10. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, as if this DPA were part of them. That limit is a single, combined limit for claims under this DPA and the Terms of Service together, as far as Data Protection Law allows.

11. Term

This DPA applies from the date it becomes part of your agreement with HoverReel (see Section 12). It continues for as long as HoverReel processes Visitor personal data for you.

12. How This DPA Applies

This DPA forms part of your agreement with HoverReel wherever our Terms of Service incorporate it by reference. No separate signature is needed. If your procurement process needs a countersigned copy, email [email protected] and we'll provide one on the same terms.

13. Order of Precedence

If this DPA and the rest of the Terms of Service conflict on the processing of Visitor personal data, this DPA controls. In every other respect, the Terms of Service apply.

14. Changes to This DPA

We may update this DPA, for example when what the Player collects, how we secure it, or our sub-processors change. We'll post the new version here with a new "Last updated" date. For changes that materially reduce the protection this DPA gives, we'll email account Owners before the changes take effect.

15. Contact Us

HoverReel LLC
5151 Monroe St, Ste 250F
Toledo, OH 43623
[email protected]

Annex I: Description of Processing

Parties	Data exporter: the Merchant (controller). Data importer: HoverReel LLC, 5151 Monroe St, Ste 250F, Toledo, OH 43623, USA (processor), [email protected].
Subject matter	Showing the Merchant's videos on their website and reporting how they perform.
Duration	Viewing events are kept for 13 months, then reduced to totals that contain no Visitor data. Everything is deleted when the account is deleted, as described in Section 7.6.
Nature of processing	Automated collection, storage, aggregation and display of anonymous viewing events sent by the HoverReel Player from the Merchant's website. If the Merchant turns it on, passing video events to analytics tools already on the Merchant's website, in the Visitor's browser.
Purpose of processing	(1) The Merchant's Insights: views, watch time, completion, clicks, likes, add-to-carts and A/B test results. (2) Running the Player's features, such as remembering a like and making sure a view is counted once. (3) Protecting the Service: rate limits, limits on how much one browser can play in a day, and alerts about unusual viewing.
Data subjects	People who visit the Merchant's website and see or use a HoverReel Player ("Visitors"), and the Merchant's store customers whose orders included an item added from a video (order details only, no names or contact details).
Personal data	A random visitor ID, created in the Visitor's browser and kept there until cleared; it isn't based on anything about the person. Viewing events: a video was shown, viewed, expanded or unmuted; how far it was watched (25/50/75/90%) and seconds watched; likes; button clicks; add-to-cart attempts and whether they worked, with the product and size/color involved; which version of a Player was shown in an A/B test. The page address without its query string, and the referring page reduced to its domain and path. Device type (desktop, tablet or phone). IP addresses are used only briefly, in memory, to limit abuse, and are not stored with viewing events. If a Visitor uses a Player's share feature, the preview image they create is stored for 7 days. For video sales: on BigCommerce stores, a one-way hash of the store cart's ID sent with an add-to-cart, kept for up to 60 days to match orders to videos; and, from the Merchant's orders that included an item added from a video, the order number, date, currency, total and status and those items' product, quantity and amount (Shopify, through our app; WooCommerce, through the HoverReel plugin; BigCommerce, through the Merchant's API account). Never the customer's name, contact details, address or payment details.
Special categories	None. The Player doesn't collect them and can't work out who a Visitor is.
Frequency of transfer	Continuous, while the Merchant's Players run.

Annex II: Technical and Organizational Security Measures

HoverReel maintains the following measures, which are designed to protect Visitor personal data. They may change over time, but not in a way that materially lowers the overall level of protection.

Encryption in transit: HTTPS/TLS for the dashboard, the Player's requests and video delivery.
Encryption at rest for secrets: store access details (Shopify, BigCommerce, TikTok, Instagram and the WooCommerce plugin's key) and two-factor login secrets are stored encrypted.
Encrypted backups: database and uploaded-image backups are encrypted, and deleted automatically within 14 days. A weekly copy is also kept with a second provider, locked so it can't be changed or deleted early, and encrypted with a key that provider doesn't have.
Account security:
- salted one-way password hashing (scrypt);
- a check against passwords exposed in known breaches;
- limits on login attempts;
- optional two-factor login, required for HoverReel staff;
- recovery codes stored only as hashes;
- email alerts for sign-ins from a new browser;
- sign-in sessions stored only as one-way hashes;
- staff admin access limited to a fixed list of people, with an email alert on every staff admin sign-in.
Access control: dashboard requests are designed to reach only the signed-in account's own data (apart from authorized HoverReel staff, as described in the Terms of Service). Team roles (Owner, Editor, Viewer) limit what each user can do.
Embed protection: an account's Players run only on the websites its Merchant allows (default deny).
Time-limited links for hosted videos.
Rate limiting on public endpoints: viewing events, Player configuration, login, password reset and public uploads.
Upload validation: files are checked by their actual content, not their name or claimed type.
Signed webhooks: messages from our video, store and payment providers are verified by signature before they're trusted.
Dashboard hardening: a strict Content Security Policy, and generic error messages designed not to expose internal details.
Minimal Visitor data: no names, emails or payment details, and no IP addresses stored with viewing events.

Annex III: Sub-processors

These services process Visitor personal data for HoverReel:

Sub-processor	What it does	Location
Railway	Hosts the HoverReel application and its database, where viewing events are stored	Netherlands (Amsterdam). Requests reach it through Railway's global edge network, which may pass through other countries, including the United States. Railway is a US company.
Bunny.net (BunnyWay d.o.o.)	Stores, processes and delivers hosted videos; receives Visitors' playback requests	Company in Slovenia (EU). Storage in Frankfurt, Germany, with a replica in Los Angeles, USA. Delivered from servers near the viewer
GitHub	Stores encrypted backups of the database and uploaded images (14 days)	United States
Backblaze	Stores a second, weekly copy of the database and uploaded-image backups, encrypted with a key Backblaze doesn't have (deleted within 14 days)	United States

These services don't store Visitor data for HoverReel, but a Visitor's browser contacts them when needed:

Service	What it does	Location
jsDelivr	Serves the open-source hls.js playback library to browsers that need it	Global network
Cloudflare (cdnjs)	Serves the open-source gif.js library when a Visitor uses the share feature	Global network

On a Merchant's Shopify store, videos the Merchant uploads through our Shopify app are also saved in that store's own Files and play there from Shopify. Shopify is the Merchant's own provider, under the Merchant's agreement with Shopify, not a sub-processor of HoverReel; HoverReel sends Shopify no Visitor data.

Providers that handle only Merchant account data or our own website's data (for example our email, payment and analytics providers) are listed in our Privacy Policy. They aren't sub-processors of Visitor data under this DPA.