ClientBriefStudio · Updated 2 November 2026
Data Processing Agreement
1. Parties and roles
This Data Processing Agreement (DPA) under Article 28 GDPR forms part of the ClientBriefStudio Terms of Service and applies automatically to every workspace. The agency or customer using ClientBriefStudio is the Data Controller. Tomas Gabalis, an individual sole trader based in Vilnius, Lithuania, trading as ClientBriefStudio, is the Data Processor for client brief and marketing data. Contact: support@clientbriefstudio.com.
2. Purpose and scope
The Processor processes client names, aggregated advertising metrics, performance KPIs, specialist notes and brief exports solely to generate, store, share and export marketing briefs for the Controller, for the duration of the subscription. Data subjects are the Controller’s clients and their contact persons as named in the workspace. The Controller should not upload personal-level advertising data or special categories of personal data.
3. Processor obligations
The Processor (a) processes personal data only on the Controller’s documented instructions, including those given through use of the service; (b) ensures anyone authorised to process the data is bound by confidentiality; (c) applies appropriate security measures, including encryption in transit (TLS) and at rest, role-based access controls, row-level access restrictions and password-protected sharing; (d) assists the Controller in responding to data subject rights requests and with security and impact assessments; (e) notifies the Controller of a personal data breach without undue delay after becoming aware of it; (f) makes available the information needed to demonstrate compliance.
4. Return and deletion
The Controller can export workspace data at any time in Settings. On account closure or termination of the contract, the Processor deletes all client brief and marketing data within 30 days, unless retention is required by law. Billing records required by tax law are kept separately.
5. Authorised sub-processors
The Controller authorises the following sub-processors: Lovable Cloud — hosting, database, authentication and storage; Lovable AI — brief drafting using client names, periods and verified aggregate KPIs (never public-link passwords); Stripe — billing and payment processing; Lovable Emails / Mailgun — transactional service emails. The Processor will inform the Controller of intended changes to this list, giving the Controller the opportunity to object, and imposes equivalent data protection obligations on each sub-processor.
6. International transfers
Where personal data is transferred outside the EEA, the Processor relies on European Commission adequacy decisions (including the EU–US Data Privacy Framework where applicable) or EU Standard Contractual Clauses (SCCs), with supplementary measures where needed.
7. Term and governing law
This DPA lasts as long as the Processor processes personal data for the Controller. Lithuanian law applies. Questions or audit requests: support@clientbriefstudio.com.