A Product of SoundBetter Inc. | Last Updated: July 22, 2026
This Data Processing Addendum (“DPA”) supplements and forms part of the Imagine Plugins Terms of Use (the “Agreement”) between SoundBetter Inc. (“SoundBetter,” “Processor”) and the customer who builds and distributes plugins through the Service (“Customer,” “Controller,” “you”). It applies only to SoundBetter's processing of End-User Data (defined below) on your behalf through the Service's licensing and copy-protection system. It does not apply to data for which SoundBetter is itself the controller, which is governed by the Imagine Plugins Privacy Policy.
Capitalized terms not defined here have the meaning given in the Agreement.
1.1 “Data Protection Laws” means all privacy and data protection laws applicable to the processing of End-User Data, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended (CCPA).
1.2 “End-User Data” means personal data relating to your end users that SoundBetter processes on your behalf through the licensing and copy-protection system, as described in Annex I (for example license keys, activation and deactivation events, device or machine identifiers, and end-user email addresses provided during activation or trial requests).
1.3 “Controller,” “Processor,” “Data Subject,” “Personal Data Breach,” and “process” have the meanings given under Data Protection Laws. “Business,” “Service Provider,” and “sell” have the meanings given under the CCPA.
1.4 “Sub-processor” means any third party engaged by SoundBetter to process End-User Data.
2.1 As between the parties, you are the Controller (and Business) of End-User Data and SoundBetter is your Processor (and Service Provider). SoundBetter processes End-User Data only on your behalf and at your direction to provide the Service.
2.2 You are responsible for the lawfulness of the End-User Data and of your instructions, for establishing a lawful basis for processing, for providing all required notices to and obtaining all required consents from your end users, and for honoring end-user rights. You represent and warrant that you have done and will continue to do so.
2.3 SoundBetter is not responsible for your compliance obligations as Controller and does not determine the purposes of processing End-User Data.
3.1 SoundBetter will process End-User Data only on your documented instructions, including the instructions set out in this DPA, the Agreement, and your configuration and use of the Service, unless required to act otherwise by applicable law, in which case SoundBetter will inform you of that legal requirement before processing unless the law prohibits it on important grounds of public interest.
3.2 SoundBetter will inform you if, in its opinion, an instruction infringes Data Protection Laws. SoundBetter is not obligated to perform a legal review of your instructions and this does not diminish your responsibility for them.
SoundBetter will ensure that personnel authorized to process End-User Data are bound by appropriate confidentiality obligations and process the data only as necessary to provide the Service.
SoundBetter will implement and maintain technical and organizational measures designed to protect End-User Data appropriate to the risk, as described in Annex II, taking into account the nature, scope, and context of processing and the state of the art and cost of implementation. You acknowledge that the measures in Annex II are appropriate for the End-User Data processed and are your instruction as to the required security level. SoundBetter may update its measures from time to time provided the level of protection is not materially reduced.
6.1 You provide SoundBetter general authorization to engage Sub-processors to process End-User Data. The Sub-processors engaged as of the effective date are listed in Annex III.
6.2 SoundBetter will impose on each Sub-processor data protection obligations that are substantially the same as those in this DPA to the extent applicable to the services the Sub-processor provides. SoundBetter remains responsible for its Sub-processors' performance of those obligations.
6.3 SoundBetter will notify you of any intended addition or replacement of a Sub-processor, giving you a reasonable opportunity to object on reasonable data-protection grounds before that Sub-processor begins processing End-User Data. Notice may be given by updating Annex III or a linked page, or by email. If you object on reasonable grounds and the parties cannot resolve the objection, your sole remedy is to stop using the affected part of the Service.
Taking into account the nature of the processing, SoundBetter will provide reasonable assistance, insofar as possible and by appropriate measures, to help you respond to Data Subject requests to exercise their rights. If SoundBetter receives such a request directly from a Data Subject relating to End-User Data, it will, where legally permitted, direct the Data Subject to you rather than respond to the substance. You are responsible for responding to Data Subject requests. SoundBetter may charge a reasonable fee for assistance beyond the functionality made available through the Service.
8.1 SoundBetter will notify you without undue delay after becoming aware of a Personal Data Breach affecting End-User Data, and will provide information reasonably available to it to help you meet your own breach-notification obligations.
8.2 SoundBetter's notification is not an acknowledgment of fault or liability. You are responsible for any notifications to regulators or Data Subjects required in connection with a Personal Data Breach.
Taking into account the nature of the processing and the information available to it, SoundBetter will provide reasonable assistance with your data protection impact assessments and prior consultations with supervisory authorities, insofar as they relate to SoundBetter's processing of End-User Data. SoundBetter may charge a reasonable fee for such assistance.
On termination of the Agreement, SoundBetter will, at your choice, delete or return End-User Data processed on your behalf, and delete existing copies, unless applicable law requires continued storage. SoundBetter may retain End-User Data to the extent and for the period required by law, and copies in routine backups will be deleted in the ordinary course of SoundBetter's backup rotation. This DPA continues to apply to any retained End-User Data.
11.1 SoundBetter will make available to you information reasonably necessary to demonstrate compliance with this DPA, primarily through written responses to reasonable questionnaires and any third-party certifications or audit reports SoundBetter holds.
11.2 To the extent the mechanisms in 11.1 do not satisfy a mandatory audit right you have under Data Protection Laws, you may conduct an audit no more than once per twelve-month period, on at least thirty (30) days' written notice, during business hours, without unreasonably disrupting SoundBetter's operations, subject to confidentiality, and at your expense. On-site audits are limited to SoundBetter's own facilities and systems and exclude Sub-processor facilities and any data of other customers.
Where SoundBetter transfers End-User Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will rely on an appropriate transfer mechanism, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference and completed as set out in Annex IV, or another lawful mechanism. In the event of conflict between such clauses and this DPA as to transferred data, the clauses control.
13.1 With respect to End-User Data subject to the CCPA, SoundBetter acts as a Service Provider. SoundBetter will not sell or share End-User Data, will not retain, use, or disclose it for any purpose other than performing the Service or as otherwise permitted by the CCPA, and will not retain, use, or disclose it outside the direct business relationship between the parties.
13.2 SoundBetter will not combine End-User Data with personal data it receives from other sources, except as permitted by the CCPA. SoundBetter certifies that it understands and will comply with the restrictions in this Section.
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in the Agreement to a party's total liability applies in the aggregate to all claims under both the Agreement and this DPA. Nothing in this DPA limits liability that cannot be limited under Data Protection Laws.
15.1 This DPA forms part of the Agreement. In the event of a conflict between this DPA and the Agreement as to the processing of End-User Data, this DPA controls. In all other respects the Agreement remains in full force.
15.2 This DPA is governed by the same law and dispute-resolution terms as the Agreement, except where Data Protection Laws require otherwise.
15.3 This DPA takes effect on the effective date of the Agreement and continues while SoundBetter processes End-User Data on your behalf.
| Sub-processor | Service provided | Location |
|---|---|---|
| Keygen | License issuance, validation, and activation | United States |
| Google Cloud Platform | Hosting and storage | United States |
| Supabase | Database hosting | United States |
| Resend | Transactional license-delivery email | United States |
These transfer elections apply where End-User Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision. See the incorporation note below for how the official clause text is incorporated.
This Annex sets out the parties' elections only. The operative clauses are the official texts, incorporated by reference and completed with the elections above:
By entering into this DPA, the parties agree to those official clauses as completed by this Annex.