Hanna Creative Co.
Business Subscription Terms
Version 1.0 | Last Updated: August 20, 2026
These Terms govern access to and use of the Studio Halo subscription platform, including accounts, subscriptions, integrations, AI-assisted analytics, Halo Scores, dashboards, and recommendations.
Hanna Creative Co., a Massachusetts corporation, operates the Studio Halo platform and offers services under the HALO SCORE brand.
These Terms of Service (these "Terms") are a binding agreement between Hanna Creative Co., a Massachusetts corporation ("Hanna Creative," "Company," "we," "us," or "our"), and the person or entity accepting these Terms ("Customer," "you," or "your"). Hanna Creative operates the Studio Halo platform and offers services under the HALO SCORE brand.
These Terms apply to the Studio Halo websites, applications, dashboards, scoring tools, customer-authorized integrations, AI-assisted analytics, generated reports and PDFs, beta features, and related products and services that reference or incorporate these Terms (collectively, the "Services"). Customer-facing API access, white-label functionality, reseller rights, and professional services are included only if and when Hanna Creative expressly makes them available under an applicable plan or Order. The Services are intended primarily for business and commercial use in the interior design industry, including by interior design professionals, firms, brands, manufacturers, showrooms, and agencies serving that industry, and not for personal, family, or household use.
BY CREATING AN ACCOUNT AFTER BEING PRESENTED WITH NOTICE THAT REGISTRATION CONSTITUTES AGREEMENT TO THESE TERMS, BY CHECKING AN ACCEPTANCE BOX OR TAKING ANOTHER CLEAR AFFIRMATIVE ACTION TO ACCEPT THESE TERMS, OR BY EXECUTING AN ORDER THAT EXPRESSLY INCORPORATES THESE TERMS, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THESE TERMS, REPRESENT THAT YOU HAVE AUTHORITY TO BIND THE CUSTOMER, AND AGREE THAT THE CUSTOMER IS LEGALLY BOUND BY THESE TERMS. IF YOU DO NOT AGREE, DO NOT CREATE OR USE A STUDIO HALO ACCOUNT.
1.1 Agreement. These Terms, each order form, online checkout page, proposal, statement of work, or other ordering document accepted by Hanna Creative (each, an "Order"), the AI, Data & Intellectual Property Rights Policy (the "AI and Data Policy"), and Schedule 1 (Data Processing Terms) constitute the agreement between the parties (collectively, the "Agreement"). Our Privacy Policy describes how we collect, use, disclose, and protect personal data. The Privacy Policy is a notice and is not the source of Hanna Creative's contractual licenses to Customer Data.
1.2 Priority. If there is a conflict, the following order controls: (a) an Order that expressly identifies the conflicting provision and states that it overrides the Agreement; (b) Schedule 1 for Hanna Creative's processing of Customer Personal Data on behalf of Customer; (c) the AI and Data Policy for ownership, licensing, data processing, AI training, Derived Data, Benchmark Data, Halo Scores, and proprietary methodology; and (d) these Terms. A customer purchase order, portal term, policy, or unilateral document does not modify the Agreement unless Hanna Creative expressly agrees in a writing signed by an authorized representative.
1.3 Definitions. Capitalized terms not defined in these Terms have the meanings given in the AI and Data Policy or the applicable Order.
2.1 Business Users. You must be at least 18 years old and legally capable of entering into a binding agreement. If you accept the Agreement for an organization, you represent and warrant that you have authority to bind that organization and any affiliated entities identified in an Order.
2.2 Account Information. Customer will provide complete, current, and accurate account, billing, and contact information and will promptly update it. Customer is responsible for all activity under its accounts and for ensuring that its employees, contractors, consultants, and other authorized users ("Authorized Users") comply with the Agreement.
2.3 Credentials and Administrators. Customer will safeguard credentials, use reasonable security practices, and promptly notify Hanna Creative of suspected unauthorized access. An account administrator may add or remove Authorized Users, manage connected systems, access Customer Data and outputs, and make binding account choices. Customer is responsible for selecting administrators and their actions.
2.4 No Account Sharing. Access credentials are individual and may not be shared except through features expressly designed for shared organizational access. Hanna Creative may require credential resets, multi-factor authentication, or other security measures.
3.1 Service Description. The Services provide AI-assisted analytics, benchmarking, scoring, dashboards, generated reports, and recommendation tools designed primarily for the interior design industry. The Services may combine quantitative metrics, including website traffic, search performance, social-media activity and engagement, and traditional- and digital-media visibility, with proprietary qualitative and interpretive analysis concerning brand perception, resonance, prestige, cultural recognition, and related attributes. Hanna Creative may use proprietary selection, normalization, weighting, synthesis, editorial frameworks, prompts, workflows, and recommendation methods to translate these inputs into Halo Scores, comparisons, trends, reports, and recommendations. Data refresh timing depends on source availability and may be real-time, near-real-time, or periodic.
3.2 Limited Right to Use. Subject to Customer's payment of applicable fees and compliance with the Agreement, Hanna Creative grants Customer, during the applicable subscription term, a limited, non-exclusive, non-transferable, non-sublicensable right for Authorized Users to access and use the Services for Customer's internal business purposes and other uses expressly permitted by the AI and Data Policy or an Order.
3.3 Documentation. Customer may use documentation Hanna Creative makes available solely to support authorized use of the Services. Customer may make a reasonable number of internal copies but may not distribute documentation outside Customer's organization except to contractors and advisers who are bound by confidentiality obligations.
3.4 Reservation of Rights. Hanna Creative and its licensors retain all rights not expressly granted. No rights arise by implication, estoppel, exhaustion, or otherwise.
3.5 Usage Limits. Plans may include limits on Authorized Users, connected accounts, data volume, data requests, dashboards, reports or exports if made available, storage, or other usage. Hanna Creative may measure usage and require Customer to reduce usage, purchase additional capacity, or pay applicable overage charges. Hanna Creative will use commercially reasonable efforts to give advance notice of material recurring overages where practical.
4.1 Orders and Fees. Customer will pay the fees, charges, and taxes shown in the applicable Order or checkout flow. Except as expressly stated, fees are quoted and payable in U.S. dollars and are based on access purchased, not actual use.
4.2 Payment Processing. Hanna Creative currently uses a third-party hosted payment processor for subscription checkout and billing administration. Customer authorizes Hanna Creative and its processor to charge the payment method on file for fees, taxes, renewals, overages, and other amounts due. Hanna Creative does not receive or store full payment-card numbers when payment is completed through the processor-hosted checkout flow.
4.3 Automatic Renewal. Unless an Order states otherwise, a self-service paid subscription renews automatically for successive billing periods at the then-current price until canceled. The checkout or Order will disclose the applicable billing interval and price before purchase. Customer may cancel future renewal using the account controls or billing portal made available for that purpose. Renewal disclosures presented at purchase are incorporated into the Agreement.
4.4 Cancellation. Cancellation stops future renewal and does not ordinarily terminate access before the end of the paid subscription period. Except as required by law or expressly stated in an Order, fees are non-cancelable and non-refundable, including for partial periods, unused features, or unused accounts.
4.5 Trials and Promotional Plans. A free trial, pilot, or promotional plan may have different limits and may end, convert to a paid subscription, or require affirmative enrollment as disclosed when offered. Hanna Creative may modify or discontinue a free or promotional offering at any time.
4.6 Late Payment and Suspension. Amounts not paid when due may accrue interest at the lesser of 1.5% per month or the maximum lawful rate, plus reasonable collection costs. Hanna Creative may suspend access after notice if fees remain unpaid, except to the extent Customer has raised a good-faith billing dispute before the due date and timely pays undisputed amounts.
4.7 Taxes. Fees exclude sales, use, excise, value-added, and similar taxes. Customer is responsible for taxes associated with its purchases, excluding taxes based on Hanna Creative's net income. If withholding is required, Customer will provide documentation and, unless prohibited by law, gross up payments so Hanna Creative receives the invoiced amount.
4.8 Price Changes. Hanna Creative may change subscription prices for a future renewal period by providing advance notice required by the Agreement or applicable law. A price change does not affect a prepaid current term.
5.1 Customer Data. Customer retains the rights it lawfully holds in Customer Data. Customer grants Hanna Creative the licenses described in the AI and Data Policy to host, copy, access, transform, analyze, combine, display, and otherwise process Customer Data to provide, secure, support, maintain, and improve Customer's customer-specific use of the Services. Generalized model, scoring-system, benchmark, or product improvement is governed exclusively by the AI and Data Policy and Schedule 1.
5.2 Customer Responsibility. Customer represents and warrants that it has all rights, permissions, notices, consents, and lawful bases necessary for Hanna Creative and its service providers to process Customer Data, access Customer Systems, and use Customer-authorized integrations as contemplated by the Agreement. Customer will not submit or connect data in violation of law, contract, confidentiality duties, intellectual property rights, privacy rights, or third-party platform terms.
5.3 Connected Systems. The current Services may permit Customer to connect Google Analytics 4, Google Search Console, and Instagram Business accounts through the applicable provider's OAuth authorization flow. Customer authorizes Hanna Creative to access and process the data made available through each authorized connection for the customer-facing analytics, scoring, reporting, and related features requested by Customer. Hanna Creative does not request or store Customer's provider password for these connections. Customer is responsible for maintaining valid permissions. Disconnecting or revoking a connection may limit or disable affected features, and Hanna Creative may discontinue a source when required by the source provider, law, security, or the Agreement.
5.4 Sensitive Data. Unless an Order expressly authorizes it, Customer will not submit government identification numbers, financial account credentials, payment-card data, health data, biometric data, precise geolocation, information about children, or other sensitive or regulated data. The Services are not designed to store passwords for Customer Systems except through secure authentication or integration mechanisms made available by Hanna Creative.
5.5 Data Copies and Exports. Customer is responsible for maintaining copies of information it independently controls. The current Services do not provide a general customer file-upload feature or a self-service data-export feature. Hanna Creative may provide a reasonable manual export where technically feasible or legally required. Generated reports and PDFs are Service outputs, not an archival or records-retention service. Customer-facing APIs, shareable badges, and similar export features are available only if expressly offered in the applicable plan or Order.
5.6 Customer-Controlled Personal Data. To the extent Hanna Creative processes personal data included in Customer Data on Customer's behalf as a processor, service provider, contractor, or subprocessor under applicable privacy or data-protection law, Schedule 1 applies. Customer remains responsible for the lawfulness of its instructions, notices, consents, legal bases, and processing purposes. Schedule 1 does not govern personal data that Hanna Creative processes for its own account administration, billing, security, sales, support, legal, or other controller purposes described in the Privacy Policy.
5.7 Independently Sourced Personal Data. Schedule 1 does not apply to personal data that Hanna Creative independently obtains from public, licensed, or commercially available sources and processes for purposes that Hanna Creative determines, such as operating and improving the Halo Score, verifying business information, maintaining data quality, creating industry benchmarks, conducting research, and generating non-customer-specific industry insights. For that processing, Hanna Creative acts as an independent Controller, Business, or similar responsible entity to the extent required by applicable law, as described in the Privacy Policy. Information does not become Customer Personal Data solely because it is displayed with Customer-specific data or used to generate a Customer-facing output.
5.8 Connected-Source Restrictions. Rights granted elsewhere in the Agreement are limited by mandatory restrictions imposed by an authorized data source. Data received through Google API Services will be used and transferred in accordance with the Google API Services User Data Policy, including applicable Limited Use requirements. In particular, Google-connected user data and data derived from it will be used only to provide or improve the customer-facing features for which access was granted; it will not be sold or used to train, fine-tune, or improve a generalized AI or machine-learning model or a cross-customer benchmark; and human access and service-provider transfers will be limited to circumstances permitted by the applicable Google policy. Customer-connected Instagram data will be used for the connected Customer's analytics experience and will not be resold or redistributed as a standalone dataset. Collection through a revoked or disconnected source will stop as reasonably practicable. If a source-specific term conflicts with a broader license in the Agreement, the source-specific restriction controls for data obtained from that source.
6.1 AI and Data Policy. The AI and Data Policy is incorporated into the Agreement and governs Customer Data licenses, AI Inputs, Customer-Facing Outputs, Halo Scores, Derived Data, Aggregated Data, De-Identified Data, Benchmark Data, model improvement, Feedback, proprietary methodologies, and restrictions on reverse engineering, score gaming, scraping, and competitive use.
6.2 Customer-Facing Outputs. Customer may use dashboards, generated reports, PDFs, recommendations, and other Customer-Facing Outputs only as permitted by the AI and Data Policy. Customer is responsible for independently reviewing outputs, confirming material facts, and determining whether an output is appropriate for Customer's intended use. Unless a designated sharing feature or Order expressly permits public distribution, Customer-specific reports are intended for Customer and its authorized business recipients.
6.3 Hanna Creative Technology. As between the parties, Hanna Creative owns the Services, Studio Halo Technology, Halo Score methodologies, models, algorithms, weighting systems, taxonomies, qualitative assessment frameworks, cultural-recognition and interpretive rubrics, curated recommendation libraries, narrative templates and original written expression, prompts, workflows, interfaces, designs, documentation, Derived Data, Benchmark Data, and improvements, subject to Customer's ownership of Customer Data in its original form and third-party rights in Third-Party Data.
6.4 Marks. "Studio Halo," "HALO SCORE," associated logos, and other Hanna Creative marks are trademarks or service marks of Hanna Creative or its licensors. No right to use a mark is granted except as expressly permitted in writing or through a designated shareable output or brand guideline.
Customer will not, and will not permit any person to:
Hanna Creative may investigate suspected violations and may remove content, restrict features, suspend access, or take other protective action. Customer will reasonably cooperate with investigations involving its account.
8.1 Third-Party Services. The Services may interoperate with or rely on third-party platforms, APIs, datasets, hosting providers, payment processors, analytics tools, AI providers, and other services. Third-party products are governed by their own terms and privacy practices. Hanna Creative is not responsible for a third party's acts, omissions, availability, security, data accuracy, or changes to its services.
8.2 Source Availability. Hanna Creative may add, replace, suspend, or discontinue a source or integration if access becomes unavailable, restricted, unlawful, unreliable, commercially unreasonable, or inconsistent with third-party terms. Changes to a source may affect historical comparisons, Halo Scores, and outputs.
8.3 Customer-Directed Integrations. When Customer directs Hanna Creative to send data to or receive data from a third party, Customer authorizes the transfer and is responsible for the third party's use after the transfer. Hanna Creative may require Customer to accept additional pass-through terms.
8.4 Public, Licensed, and Third-Party Data. The Services may use information obtained from public, licensed, commercial, or third-party sources, including public business or social-media information, news-source metadata, and domain-authority or similar reference data. Public availability does not by itself grant an unrestricted right to collect, retain, combine, redistribute, benchmark, or commercialize information. Hanna Creative will use Third-Party Data only to the extent permitted by applicable law, source terms, licenses, or other rights reasonably relied upon. Use of an intermediary collection service does not expand Hanna Creative's rights against the original source or rights holder.
8.5 Accuracy, Correction, and Source Challenges. A person or organization may use the procedure described in the Privacy Policy to report materially inaccurate, outdated, misattributed, or allegedly unauthorized personal or business information obtained from a public, licensed, or third-party source. Hanna Creative may verify the requester and the supporting information, consult the underlying source, correct or remove information where appropriate, and recalculate an affected output where reasonably practicable. This process does not require Hanna Creative to disclose its proprietary methodology, weights, source arrangements, models, or trade secrets, and does not guarantee removal of information that Hanna Creative may lawfully retain or that remains available from an independent source.
8.6 Source-Rights Controls. Hanna Creative may restrict, replace, suspend, or remove any public or third-party source, dataset, image, thumbnail, link, benchmark, or related feature if source rights are uncertain, terms change, a rights holder objects, or continued use presents material legal, contractual, privacy, security, or intellectual-property risk. No provision of this Agreement represents that every public source authorizes every possible form of automated collection or redistribution.
9.1 Confidential Information. "Confidential Information" means non-public information disclosed by one party (the "Disclosing Party") to the other (the "Receiving Party") that is identified as confidential or should reasonably be understood as confidential given its nature and the circumstances. Customer Confidential Information includes non-public Customer Data and customer-specific outputs. Hanna Creative Confidential Information includes non-public Studio Halo Technology, scoring methodologies, weightings, qualitative and interpretive frameworks, model information, prompts, workflows, recommendation libraries, security information, roadmaps, documentation, and Benchmark Data.
9.2 Protection and Use. The Receiving Party will use Confidential Information only to exercise rights and perform obligations under the Agreement, protect it using at least reasonable care, and disclose it only to personnel, contractors, advisers, and service providers who need to know it and are bound by confidentiality obligations. The Receiving Party is responsible for their compliance.
9.3 Authorized Human Access. Authorized Hanna Creative personnel may access Customer Data, AI Inputs, and customer-specific outputs only where reasonably necessary for Customer-specific support, debugging, quality assurance, security, abuse prevention, legal compliance, or Customer instructions. Such access is subject to confidentiality obligations and appropriate access controls. Source-specific restrictions may be narrower: for example, human access to Google-connected user data is limited to circumstances permitted by the applicable Google policy. Hanna Creative does not conduct routine human review of Customer Content for generalized model or cross-customer scoring improvement.
9.4 Exclusions. Confidential Information does not include information the Receiving Party can document: (a) is lawfully public through no breach; (b) was already known without restriction; (c) was lawfully received from a third party without duty; or (d) was independently developed without use of the Disclosing Party's Confidential Information.
9.5 Required Disclosure. The Receiving Party may disclose Confidential Information to the extent legally required after, where lawful, providing prompt notice and reasonable assistance to seek protective treatment. The Receiving Party will disclose only the minimum required.
9.6 AI Tools. Neither party will submit the other party's Confidential Information to a publicly available generative AI tool, or to an AI tool whose terms permit unrelated model training or third-party disclosure, unless the Disclosing Party has authorized the use or the tool is approved and configured to protect confidentiality.
9.7 Equitable Relief. Unauthorized use or disclosure of Confidential Information or trade secrets may cause irreparable harm. The Disclosing Party may seek injunctive or equitable relief in addition to other remedies.
10.1 Safeguards. Hanna Creative will maintain reasonable administrative, technical, organizational, and physical safeguards appropriate to the nature of the Services and information processed. Verified current technical controls are summarized in Annex B to Schedule 1. Where applicable law requires a written or risk-based information-security program, retention controls, secure-destruction procedures, service-provider safeguards, or other specific measures, Hanna Creative will implement those requirements for processing within their scope. References to particular jurisdictions, including Massachusetts and Rhode Island, do not limit comparable obligations that may apply elsewhere and do not constitute a certification of universal compliance.
10.2 Security Incidents. Hanna Creative will notify affected customers without undue delay after becoming aware of a Security Incident involving Customer Data and will provide notices and cooperation as required by applicable law and written agreement. Hanna Creative will take reasonable steps to contain, investigate, mitigate, and remediate the incident and will provide information reasonably available concerning the nature of the incident, affected data, mitigation undertaken, and corrective measures, subject to legal, security, confidentiality, and law-enforcement restrictions. Customer notice does not replace any direct notice to individuals or regulators that Hanna Creative is legally required to provide in its own capacity.
10.3 Security Program Commitments. Hanna Creative will maintain reasonable administrative, technical, organizational, and physical safeguards appropriate to its size, the nature of the Services, and the information processed, and will implement any written security program, designated responsibility, risk assessment, personnel training, vendor oversight, retention, incident-response, or similar governance measures required by applicable law. Annex B to Schedule 1 describes verified technical controls and deliberately does not state certifications, backup practices, residency commitments, or governance controls that have not been confirmed. Compliance depends on the controls actually implemented and maintained.
10.4 Security Testing. Customer may not perform penetration testing, vulnerability scanning, adversarial model testing, or security assessments against the Services without Hanna Creative's prior written authorization and agreed testing procedures.
11.1 Beta Status. Hanna Creative may offer alpha, beta, pilot, preview, early-access, or evaluation features ("Beta Services"). Beta Services may be incomplete, inaccurate, unstable, confidential, or subject to change. They may have lower or no service commitments, may be discontinued at any time, and may not be suitable for production use. Unless an Order states otherwise, Beta Services are provided "AS IS" without warranties, support commitments, or liability for lost data or business interruption. Customer will provide reasonable feedback and will not publicly disclose non-public Beta Services without permission.
11.2 Beta Data and Improvement. During a beta or pilot, Hanna Creative may access Customer Data and Customer-specific outputs as reasonably necessary to provide support, debug defects, evaluate quality, and validate the Customer's own account. Hanna Creative will not use identifiable or customer-identifying non-public Customer Data from a beta to train, fine-tune, or improve a model, scoring system, benchmark, or product for unrelated customers unless Customer gives a separate affirmative, informed written authorization that describes the broader use. A beta designation alone is not such authorization.
12.1 Changes and Data Refresh. Hanna Creative may modify the Services to improve quality, security, performance, compliance, cost efficiency, or functionality. Hanna Creative will use commercially reasonable efforts to provide advance notice of a material reduction in core paid functionality when practical. Data sources may refresh on different schedules, and the Services do not guarantee that a dashboard, Halo Score, or output is continuously updated or reflects information in real time. Changes to data sources, models, refresh schedules, or methodology may change current or historical outputs.
12.2 Availability. Unless an Order includes a service level agreement, Hanna Creative does not guarantee uninterrupted availability or a specific uptime. Scheduled maintenance, emergency maintenance, third-party outages, internet failures, Customer Systems, force majeure events, and security measures may affect access.
12.3 Support. Support is provided through the channels and service levels described in the applicable plan or Order. Hanna Creative may require sufficient information to reproduce and diagnose an issue.
13.1 Suspension. Hanna Creative may suspend or restrict access if: (a) fees are overdue; (b) Customer breaches the Agreement; (c) use presents a security, legal, operational, intellectual property, or third-party platform risk; (d) suspension is required by law or a third-party provider; or (e) Customer's use threatens the Services or other users. Where practical, Hanna Creative will provide notice and an opportunity to cure, but may act immediately for urgent risks.
13.2 Termination for Cause. Either party may terminate an Order or the Agreement for a material breach not cured within 30 days after written notice, except that no cure period is required for a breach that cannot be cured, misuse of trade secrets, deliberate security compromise, unlawful use, or repeated breach.
13.3 Termination by Customer. Customer may stop using the Services at any time, but termination does not relieve Customer of payment obligations or create a refund right unless the Agreement expressly provides otherwise. Self-service subscriptions may be canceled as described in Section 4.4.
13.4 Effect. On expiration or termination, Customer's right to access the Services ends and Customer will pay amounts accrued. Cancellation of a subscription, deletion of an individual user login, disconnection of a source, and deletion of an organization or brand are distinct actions and may have different data effects. Customer should submit any organization- or brand-level deletion or export request using the available account or privacy-contact method. Hanna Creative will handle Customer Personal Data according to the Privacy Policy, AI and Data Policy, Schedule 1, applicable backup cycles, and legal obligations. Customer should not rely on the Services as its sole archive.
13.5 Survival. Provisions that by their nature should survive will survive, including payment obligations, confidentiality, ownership, restrictions, disclaimers, indemnification, liability limits, dispute resolution, and rights in De-Identified Data, Aggregated Data, Derived Data, Benchmark Data, Feedback, and improvements as provided in the AI and Data Policy. Obligations concerning trade secrets survive for so long as the information remains a trade secret under applicable law.
14.1 Feedback. Customer may provide suggestions, ideas, corrections, and other Feedback. Feedback rights are governed by the AI and Data Policy. Customer will not submit Feedback it considers confidential unless the parties agree otherwise in writing.
14.2 Customer Name and Marks. Hanna Creative will not use Customer's name or marks in a public customer list, case study, or endorsement without Customer's permission, except to the extent Customer has publicly identified itself as a Studio Halo customer or an Order expressly grants permission.
15.1 Mutual Authority. Each party represents that it has authority to enter into the Agreement.
15.2 Hanna Creative Limited Warranty. During a paid subscription term, Hanna Creative warrants that it will provide the Services in a professional and workmanlike manner and that the Services will materially conform to the applicable documentation under normal authorized use. Customer's exclusive remedy for breach is for Hanna Creative to use commercially reasonable efforts to correct the nonconformity; if Hanna Creative cannot do so within a reasonable period, Customer may terminate the affected Order and receive a prorated refund of prepaid fees for the unused period. This warranty does not apply to Beta Services, free services, third-party services, Customer Systems, unauthorized use, or modifications not made by Hanna Creative.
15.3 Customer Warranties. Customer represents and warrants that Customer Data, Customer Systems, instructions, connected accounts, and use of the Services comply with the Agreement and applicable law and that Customer has all rights needed for Hanna Creative to perform the Services.
The Services use automated, statistical, and AI-assisted methods and may combine quantitative data with qualitative, cultural-recognition, editorial, and interpretive judgment. Halo Scores, benchmarks, analytics, and recommendations are estimates that may be incomplete, inaccurate, delayed, non-unique, or affected by data quality, source availability, refresh timing, methodology changes, model behavior, market conditions, and subjective judgment. Outputs may differ from human assessments or other tools and may change over time.
A Halo Score is an evaluative estimate and expression of Hanna Creative's methodology and judgment, not an objectively verifiable statement that a brand is definitively prestigious, resonant, or valuable. Underlying factual data may be incomplete, delayed, disputed, or incorrect and remains subject to correction and source review. Hanna Creative may provide high-level factor descriptions, dates, and versions without disclosing weights, source arrangements, models, or trade secrets.
Customer-Facing Outputs are for informational and business-planning purposes. They do not guarantee brand prestige, reputation, media coverage, traffic, search ranking, leads, revenue, customer acquisition, or any other result. Customer remains responsible for human review, professional judgment, compliance, and decisions made using outputs.
Unless expressly agreed in writing, the Services do not provide legal, financial, accounting, investment, medical, employment, or other regulated professional advice.
Where applicable law requires a disclosure that a person is interacting with an AI system, or requires marking or labeling of AI-generated or AI-manipulated content, Hanna Creative will provide or preserve the required disclosure, notice, or technical marking for the applicable Service and use case. This includes obligations that may apply under Article 50 of the EU AI Act for Services placed on or used in the European Union. Customer will not remove a legally required AI-origin notice or machine-readable marking supplied with an output.
EXCEPT FOR THE EXPRESS LIMITED WARRANTY IN SECTION 15.2 AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, BETA SERVICES, THIRD-PARTY DATA, THIRD-PARTY SERVICES, HALO SCORES, DASHBOARDS, ANY REPORTS OR EXPORTS MADE AVAILABLE, ANALYTICS, BENCHMARKS, AND RECOMMENDATIONS ARE PROVIDED "AS IS" AND "AS AVAILABLE." HANNA CREATIVE DISCLAIMS ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
HANNA CREATIVE DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS; THAT DATA OR OUTPUTS WILL BE ACCURATE, COMPLETE, CURRENT, UNIQUE, OR SUITABLE FOR ANY PARTICULAR PURPOSE; OR THAT CUSTOMER WILL ACHIEVE ANY PARTICULAR BUSINESS, MARKETING, REPUTATIONAL, OR FINANCIAL RESULT.
18.1 Customer Indemnity. Customer will defend, indemnify, and hold harmless Hanna Creative, its Affiliates, and their officers, directors, employees, contractors, and agents from third-party claims and resulting losses, liabilities, damages, judgments, penalties, costs, and reasonable attorneys' fees arising from: (a) Customer Data, Customer Systems, connected accounts, or Customer instructions; (b) Customer's or an Authorized User's violation of the Agreement, law, or third-party rights; (c) Customer's use, publication, redistribution, or commercialization of outputs; or (d) a dispute between Customer and its client, employee, contractor, partner, or other third party, except to the extent caused by Hanna Creative's breach of the Agreement.
18.2 Hanna Creative IP Indemnity. For a paid subscription other than Beta Services, Hanna Creative will defend Customer against a third-party claim that Customer's authorized use of the unmodified Services infringes a U.S. patent, copyright, or trademark, and will pay damages finally awarded or settlement amounts approved by Hanna Creative. Hanna Creative has no obligation for claims arising from Beta Services, Customer Data, Third-Party Data, Customer Systems, third-party services, combinations not supplied by Hanna Creative, modifications not made by Hanna Creative, use after notice to stop, or use outside the Agreement. If a claim appears likely, Hanna Creative may procure continued use, modify or replace the affected Service, or terminate the affected feature or Order and refund prepaid fees for the unused period. This Section states Hanna Creative's entire liability for intellectual property infringement claims.
18.3 Procedure. The indemnified party will promptly notify the indemnifying party, provide reasonable cooperation at the indemnifying party's expense, and allow the indemnifying party to control the defense and settlement. A settlement may not admit fault by or impose non-monetary obligations on the indemnified party without consent, not to be unreasonably withheld.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS, LOSS OF GOODWILL, LOSS OR CORRUPTION OF DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATING TO THE AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO HANNA CREATIVE FOR THE SERVICES GIVING RISE TO THE CLAIM DURING THE 12 MONTHS BEFORE THE EVENT FIRST GIVING RISE TO LIABILITY.
The exclusions and cap do not apply to: (a) Customer's payment obligations; (b) Customer's infringement, misappropriation, or misuse of Hanna Creative intellectual property, trade secrets, or Confidential Information; (c) Customer's violation of Section 7; or (d) liability that cannot lawfully be limited. For Hanna Creative's breach of confidentiality or security obligations involving Customer Data, the aggregate cap will be two times the general cap stated above. The parties agree that these limitations allocate risk and are an essential basis of the bargain.
20.1 Informal Resolution. Before filing a claim, a party will send written notice describing the dispute and requested relief. Authorized representatives will attempt in good faith to resolve the dispute for at least 30 days. This requirement does not prevent a party from seeking emergency injunctive relief or preserving a limitations period.
20.2 BINDING INDIVIDUAL ARBITRATION. EXCEPT FOR ELIGIBLE SMALL-CLAIMS MATTERS AND CLAIMS SEEKING INJUNCTIVE RELIEF FOR MISUSE OF INTELLECTUAL PROPERTY, CONFIDENTIAL INFORMATION, OR SECURITY, ANY DISPUTE ARISING OUT OF OR RELATING TO THE AGREEMENT WILL BE RESOLVED BY BINDING ARBITRATION, NOT IN COURT. THE ARBITRATION WILL BE ADMINISTERED BY THE AMERICAN ARBITRATION ASSOCIATION UNDER ITS COMMERCIAL ARBITRATION RULES BY ONE ARBITRATOR. THE SEAT WILL BE BOSTON, MASSACHUSETTS, AND PROCEEDINGS MAY BE CONDUCTED REMOTELY UNLESS THE ARBITRATOR DETERMINES AN IN-PERSON HEARING IS NECESSARY.
20.3 CLASS AND JURY WAIVER. EACH PARTY WAIVES THE RIGHT TO A JURY TRIAL. CLAIMS MAY BE BROUGHT ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN A CLASS, COLLECTIVE, CONSOLIDATED, MASS, OR REPRESENTATIVE ACTION. THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OR PRESIDE OVER A REPRESENTATIVE PROCEEDING WITHOUT ALL PARTIES' WRITTEN CONSENT.
20.4 Arbitration Opt-Out. Customer may opt out of Sections 20.2 and 20.3 by sending written notice through the legal/privacy contact method designated on the Studio Halo website or within the Services within 30 days after first accepting these Terms. The notice must identify Customer, the account email, and clearly state that Customer opts out of arbitration. Opting out does not affect other provisions.
20.5 Confidentiality and Award. The parties will maintain the confidentiality of the arbitration to the extent permitted by law. The arbitrator may award any individual remedy available under applicable law consistent with the Agreement. Judgment may be entered in any court with jurisdiction.
The Agreement is governed by the laws of the Commonwealth of Massachusetts, without regard to conflict-of-laws rules. The Federal Arbitration Act governs the interpretation and enforcement of Section 20. For claims not subject to arbitration, each party consents to exclusive jurisdiction and venue in the state and federal courts located in Suffolk County, Massachusetts, and waives objections based on venue or inconvenient forum.
Customer will not access or use the Services in violation of U.S. export controls, economic sanctions, or trade restrictions. Customer represents that it and its Authorized Users are not prohibited parties and are not located in a comprehensively sanctioned jurisdiction. Customer will not use the Services for prohibited end uses.
22.2 International Access and Local Law. The Services may be accessible from multiple countries, but accessibility does not mean that every Service, feature, plan, or data practice is offered or lawful in every jurisdiction. Customer will use the Services only where legally permitted and will comply with laws applicable to Customer's use, data, communications, and connected systems. Hanna Creative will process personal data as described in the Privacy Policy, Schedule 1, and applicable law. Hanna Creative may restrict availability, require jurisdiction-specific terms, or suspend affected processing where reasonably necessary to address legal, regulatory, sanctions, privacy, data-transfer, or operational requirements. Non-waivable rights under applicable law remain unaffected.
Hanna Creative may update these Terms by posting or providing the revised version and identifying its effective date. Material changes will be communicated in a commercially reasonable manner and ordinarily apply prospectively. Hanna Creative will not use a quiet or retroactive policy change to materially broaden its right to use previously collected identifiable or confidential Customer Data for unrelated generalized AI training. Where applicable law, an existing commitment, or the nature of the change requires it, Hanna Creative will obtain affirmative consent, a new Order, or other valid authorization. If Customer does not agree to a prospective material change, Customer may stop using the Services and cancel future renewal; continued use after the effective date constitutes acceptance only to the extent permitted by law. Changes to dispute resolution will not apply to a dispute for which the parties had actual written notice before the change.
24.1 Notices. Hanna Creative may provide operational and contractual notices electronically through the Services or to Customer's account email. Formal legal notices to Hanna Creative may be sent through the legal/privacy contact method designated on the Studio Halo website or within the Services; Hanna Creative will provide its then-current mailing address on request. Customer is responsible for keeping its contact information current.
24.2 Assignment. Customer may not assign or transfer the Agreement without Hanna Creative's prior written consent. Hanna Creative may assign the Agreement to an Affiliate or in connection with a merger, reorganization, financing, sale of assets, or change of control. An unauthorized assignment is void.
24.3 Force Majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding Customer's payment obligations. The affected party will use reasonable efforts to mitigate the impact.
24.4 Independent Contractors. The parties are independent contractors. The Agreement does not create an agency, partnership, franchise, fiduciary, employment, joint venture, or exclusive relationship.
24.5 No Third-Party Beneficiaries. The Agreement benefits only the parties and permitted successors and assigns, except indemnified persons may enforce applicable indemnity rights.
24.6 Waiver; Severability. A waiver must be written and signed and applies only to the stated instance. If a provision is unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions remain effective.
24.7 Entire Agreement. The Agreement is the complete agreement concerning its subject matter and supersedes prior or contemporaneous discussions, proposals, and representations. Headings are for convenience. "Including" means "including without limitation." Electronic acceptance and signatures are effective.
Questions about these Terms or formal notices may be directed to Hanna Creative through the legal/privacy contact method designated on the Studio Halo website or within the Services. Hanna Creative will provide its current mailing address on request.
Legal entity: Hanna Creative Co.
DATA PROCESSING TERMS
These Data Processing Terms (this "Schedule" or "DPA") apply when Hanna Creative processes Customer Personal Data on behalf of Customer in connection with the Services. This DPA provides a controller-processor, business-service provider, contractor, and processor-subprocessor framework under applicable privacy and data-protection laws and is designed to address mandatory processor-contract elements, including GDPR Article 28 where it applies. Mandatory jurisdiction-specific terms prevail to the extent required by law. International transfer clauses, representatives, or other local mechanisms are effective only when the applicable facts require them and the parties complete the necessary terms.
| Processing Element | Description |
|---|---|
| Subject matter | Processing Customer Personal Data to provide, configure, support, secure, maintain, and improve Customer-specific Services, including connected analytics, scoring, dashboards, and report generation. Customer Personal Data is not used for generalized cross-customer model training, scoring-system training, or benchmarks without separate affirmative authorization. |
| Duration | The subscription or Order term and the period reasonably necessary to support account closure, security, legal retention, and documented deletion and backup processes. |
| Nature and purpose | Collection, receipt, OAuth-authorized access, hosting, storage, authentication, organization, normalization, analysis, comparison, scoring, display, transmission, report generation, support, security, troubleshooting, disconnection, and deletion or return as applicable. |
| Types of personal data | Business contact and account data; customer-authorized Google Analytics 4 metrics; Google Search Console query and performance data; customer-authorized Instagram Business profile, media, and insight data; Customer-specific report inputs and outputs; technical, usage, security, and communications data. The current Service does not provide a general customer file-upload feature. Sensitive or highly regulated data is not authorized unless an Order expressly permits it. |
| Categories of individuals | Customer personnel and Authorized Users; business contacts or other individuals whose information is contained in Customer-authorized connected sources; and other individuals whose Customer Personal Data Customer lawfully directs Hanna Creative to process. |
| Controller rights and duties | Customer determines and documents lawful purposes and instructions; provides required notices and consents; responds to individual requests; and uses the Services in compliance with applicable law. |
| Customer role | Controller or Business for Customer Personal Data; Processor where Customer acts on behalf of a third-party Controller. |
| Hanna Creative role | Processor, Service Provider, or Contractor; Subprocessor where Customer acts as a Processor for a third-party Controller. |
| Frequency and transfer method | Continuous, periodic, or event-driven during the subscription using platform interactions, OAuth or similar provider authorization, customer-directed API connections, and other Customer-authorized transfers. The current connected sources include Google Analytics 4, Google Search Console, and Instagram Business. |
| Processing locations | Primarily the United States and other countries or regions used by disclosed subprocessors or source platforms. Hanna Creative does not make a data-residency commitment unless an Order or current subprocessor disclosure expressly provides one. |
| Sensitive data | None anticipated or authorized. The Service is not designed for government identifiers, payment-card numbers, health data, biometric data, precise geolocation, children's data, or other sensitive or highly regulated information unless an Order expressly permits a specific use and safeguards. |
| Return and deletion timing | Current criteria: application logs are retained for 14 days; top-page snapshot records older than approximately 190 days are pruned weekly; other active Customer Data is generally retained for the life of the account. On connected-source disconnect or brand deletion, local OAuth credentials are designed to be destroyed and further scheduled collection is designed to stop. Brand-level deletion begins with an immediate soft-delete/inaccessibility stage followed by administrative hard deletion. No fixed hard-purge, backup-expiration, or export SLA is promised unless stated in an Order or current retention schedule. Legal, security, fraud-prevention, tax, accounting, and dispute records may be retained as permitted by law. |
1. Definitions. "Customer Personal Data" means personal data, personal information, or a materially similar term under applicable Data Protection Laws that is included in Customer Data and processed by Hanna Creative on Customer's behalf. "Data Protection Laws" means privacy, data-protection, data-security, breach-notification, direct-marketing, and similar laws applicable to the processing, including applicable U.S. federal and state laws and, where applicable, the EU GDPR, UK GDPR, Swiss data-protection law, Canadian privacy law, Brazil's LGPD, and materially similar laws. Terms such as Business, Controller, Contractor, Processor, Service Provider, Sell, Share, and Consumer have the meanings given by the applicable law.
2. Roles and Compliance. For Customer Personal Data, Customer is the Business or Controller and Hanna Creative is the Service Provider, Contractor, or Processor, except where the facts and applicable law require a different characterization. Where Customer processes Customer Personal Data on behalf of a third-party Controller, Customer is a Processor and Hanna Creative is Customer's Subprocessor. Customer represents that it is authorized to appoint Hanna Creative and that its instructions reflect the lawful instructions of the applicable Controller. Each party will comply with the obligations applicable to its role. Hanna Creative may process separate personal data as a Controller or Business for the purposes described in the Privacy Policy, including account administration, security, support, and independently sourced public, licensed, or commercially available information. Such independently controlled processing is outside this Schedule unless applicable law requires otherwise.
3. Documented Instructions and Limited Purposes. Hanna Creative will process Customer Personal Data only on Customer's documented instructions as reflected in the Agreement, Customer's configuration and use of the Services, and other lawful written instructions. Where Customer acts as a Processor, those instructions must reflect the instructions of the applicable third-party Controller. The limited and specified purposes are to provide, configure, host, secure, support, maintain, troubleshoot, and improve the Customer-specific Services; authenticate users; administer integrations; generate Customer-Facing Outputs; prevent fraud and misuse; respond to Customer requests; and comply with law. Hanna Creative will notify Customer if, in its reasonable opinion, an instruction violates applicable data-protection law, unless prohibited from doing so, and Customer may take reasonable steps to stop and remediate unauthorized processing.
4. Prohibited Secondary Uses. Except as permitted by applicable law and the Agreement, Hanna Creative will not: (a) sell or share Customer Personal Data; (b) process Customer Personal Data for cross-context behavioral or targeted advertising; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer; (d) process Customer Personal Data for a purpose other than the limited and specified purposes in Section 3; or (e) combine Customer Personal Data with personal data received from another person or collected from Hanna Creative's own interaction with an individual except as permitted by applicable law and reasonably necessary to provide the Customer-specific Services or maintain security. Creation of Aggregated Data or De-Identified Data does not expand Hanna Creative's rights to use Customer Data for generalized cross-customer model training or benchmarking beyond the AI and Data Policy.
5. Customer Responsibilities. Customer will provide lawful instructions, limit Customer Personal Data to what is adequate, relevant, and reasonably necessary for the disclosed purposes, provide required privacy notices, obtain required consents or other lawful bases, and respond to individual requests for Customer-controlled data. Customer will not instruct Hanna Creative to process personal data in violation of law or submit sensitive or highly regulated data unless an Order expressly authorizes it.
6. Confidentiality. Hanna Creative will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations and receive access only as reasonably necessary to perform their duties.
7. Security. Taking into account the nature, scope, context, purposes, and risks of the processing, Hanna Creative will maintain reasonable administrative, technical, organizational, and physical safeguards designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. Annex B describes current technical controls verified in the August 11, 2026 code review. Hanna Creative does not represent that it holds a certification, follows a particular penetration-testing cadence, maintains a particular backup or disaster-recovery architecture, or provides a particular data-residency arrangement unless an Order or current security documentation expressly states that verified commitment.
7.1 Security Program. Where required by applicable law, Hanna Creative will maintain a written or otherwise documented risk-based information-security program; designate responsible personnel; assess reasonably foreseeable risks; train personnel as appropriate; manage privileged access; oversee material service providers; maintain retention and disposal practices; and review the program periodically and after material changes or incidents. Current technical controls are not a substitute for program-level governance obligations.
7.2 Jurisdiction-Specific Security Requirements. Hanna Creative will comply with non-waivable security, retention, secure-destruction, service-provider, and breach-response obligations that apply to its role and processing. This includes, where applicable, M.G.L. c. 93H and 201 CMR 17.00, R.I. Gen. Laws ch. 11-49.3 and 6-48.1, and comparable laws in other jurisdictions. No reference to a jurisdiction is a certification that every law in that jurisdiction applies to every processing activity.
8. Individual Rights Assistance. Taking into account the nature of the processing and information available to Hanna Creative, Hanna Creative will provide reasonable assistance to Customer in responding to verified access, correction, deletion, portability, opt-out, consent, restriction, objection, automated-decision, or appeal requests relating to Customer Personal Data. If Hanna Creative receives a request concerning Customer-controlled data, it may direct the requester to Customer and notify Customer, unless prohibited by law. Where Customer acts as a Processor, Customer is responsible for communicating with the applicable Controller and ensuring that Hanna Creative receives lawful instructions.
9. Security Incidents and Assessments. Hanna Creative will notify Customer without undue delay after becoming aware of a Security Incident involving Customer Personal Data and within any shorter period required by applicable law or an Order. Hanna Creative will provide information reasonably available concerning the nature of the incident, categories of affected data and individuals, likely consequences, containment and mitigation measures, and corrective actions, and will provide reasonable updates as material information becomes available. Hanna Creative will provide reasonable cooperation for Customer's legally required response, data-protection assessment, or regulatory consultation to the extent required by applicable Data Protection Laws and based on information available to Hanna Creative.
10. Subprocessors and Transparency. Customer grants Hanna Creative general written authorization to use subprocessors to provide the Services. Hanna Creative will impose written data-protection obligations on subprocessors that are materially consistent with this Schedule for the services they perform and will remain responsible for their performance to the extent required by applicable law. Hanna Creative will maintain a current Service Providers, Subprocessors & Data Sources Notice identifying material providers and their functions. Where reasonably practicable, Hanna Creative will provide advance notice of a material new or replacement subprocessor through the Services, the public notice, or Customer account email. Customer may object on reasonable, documented data-protection grounds within thirty days after notice. The parties will work in good faith to address the objection; if they cannot do so, Hanna Creative may avoid the subprocessor for Customer where commercially reasonable, discontinue the affected feature, or permit Customer to terminate the affected Order without liability for future unused service.
11. Return and Deletion. Following termination or completion of the applicable Services, Customer may request return or export of Customer Personal Data where technically feasible or required by applicable law. The current product does not provide a general self-service export function. On organization- or brand-level deletion, connected-source credentials are designed to be destroyed locally and further scheduled collection for that brand is designed to stop; associated records may first be rendered inaccessible through a soft-deletion process before final hard deletion. Hanna Creative will complete final deletion within a reasonable operational period consistent with applicable law and its then-current documented retention practices, subject to legal, security, fraud-prevention, dispute, tax, accounting, and backup-integrity exceptions. No fixed hard-purge or backup-expiration period applies unless stated in an Order or current retention schedule. Retained Customer Personal Data will remain protected and used only for the permitted retention purpose. This Section does not require deletion of information that is not Customer Personal Data, including independently sourced public data and non-customer-identifying service metadata, except as applicable law requires.
12. Compliance Information and Reviews. On reasonable request, Hanna Creative will make available information reasonably necessary to demonstrate compliance with this Schedule. Hanna Creative may satisfy review requests through written responses, policies, security summaries, independent assessment reports, or certifications where available. If those materials are insufficient and applicable law requires an audit, Customer may conduct one reasonable audit no more than annually, and additionally following a material security incident, subject to advance notice, confidentiality, reasonable scope, protection of other customers and trade secrets, and reimbursement of Hanna Creative's reasonable costs. Auditors may not be direct competitors of Hanna Creative.
13. Inability to Comply; Remediation. Hanna Creative will notify Customer if it determines that it can no longer meet an applicable obligation under this Schedule. Customer may take reasonable and appropriate steps to stop and remediate unauthorized processing, including directing suspension of the affected processing. Hanna Creative may suspend an unlawful instruction or affected feature while the parties address the issue.
14. De-Identified Data. If Hanna Creative creates De-Identified Data from Customer Personal Data, it will maintain the data in de-identified form, take reasonable measures designed to prevent association with an identified individual or Customer, and not attempt re-identification except as permitted by law to test de-identification controls. Notwithstanding broader rights that may otherwise exist for de-identified information, Hanna Creative does not currently use Customer Personal Data, including de-identified or aggregated versions derived from customer-connected analytics, search, or social data, to train, fine-tune, or improve a model, scoring system, or cross-customer benchmark for unrelated customers without separate affirmative authorization.
15. Government Requests. If Hanna Creative receives a legally binding request for Customer Personal Data, it may disclose the minimum required information and, where legally permitted, will provide Customer with notice sufficient to allow Customer to seek protective treatment.
16. International Processing and Transfers. This DPA applies to approved processing wherever applicable Data Protection Laws apply. If the EU GDPR, UK GDPR, Swiss law, or another regime requires a data-transfer mechanism, local representative, transfer assessment, or additional processor terms, the parties will reasonably cooperate to implement the required mechanism before the restricted processing or transfer begins. The EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, the UK International Data Transfer Agreement or UK Addendum, Swiss modifications, and similar statutory terms are not automatically incorporated unless the applicable facts require them and an Order or addendum properly completes them. Hanna Creative may suspend an affected transfer or processing activity if a required mechanism is unavailable or cannot reasonably be implemented.
17. Conflict and Survival. For Customer Personal Data processed on Customer's behalf, this Schedule controls over conflicting provisions of the Terms or AI and Data Policy, unless an Order expressly states otherwise. Obligations that by their nature should survive termination, including confidentiality, security, deletion, audit, and restrictions on secondary use, will survive as applicable to retained Customer Personal Data.
Annex B describes selected technical and application controls in the current Service. It is intentionally limited to controls that can be stated with confidence. Additional security commitments apply only where required by applicable law, the Agreement, an Order, or then-current security documentation.
| Control Area | Verified Measure / Status |
|---|---|
| Access control and authentication | Invite-only registration; email verification for dashboard access; email/password authentication using bcrypt cost factor 12; expiring magic-link tokens; customer role hierarchy of owner, admin, and viewer; subscription-status gate on paid features. |
| Encryption in transit | HTTPS on the application domain; TLS for third-party API calls; SMTP over TLS. |
| Data segregation and environments | Logical row-level tenant segregation by brand identifier and membership middleware in a shared application database. |
| Logging and monitoring | Sentry error monitoring is deployed with PII sending disabled and SQL parameter bindings excluded; application logs rotate daily with a 14-day retention period. |
| Application security controls | CSRF protection is enabled application-wide except for the Stripe webhook endpoint, which is verified using Stripe signatures. |
| Payments | Verified: Stripe-hosted Checkout and Billing Portal are used; payment-card data does not reach Hanna Creative infrastructure; Hanna Creative stores a Stripe customer identifier and subscription status; Stripe webhooks are signature-verified. |
| AI data lifecycle | Verified: no vector database, embeddings, retrieval index, RAG pipeline, fine-tuning, or customer file-upload feature. Customer-specific report data is sent to Anthropic for inference. Anthropic Files API usage in the reviewed code contains Hanna Creative report templates and prompt instructions, not Customer Data. |
| AI provider training and retention | Anthropic commercial API inputs and outputs are not used for Anthropic model training by default. Provider retention is governed by Anthropic terms and account-specific configuration; no zero-data-retention commitment is made unless expressly confirmed. |
| Connected-source credentials | Local Google Analytics, Google Search Console, and Instagram credential configurations are destroyed on source disconnect or brand deletion, and scheduled collection excludes soft-deleted brands. |
| Retention and deletion | Brand deletion is designed to destroy local connected-source credentials, cancel the associated Stripe customer/subscription through API calls, soft-delete dependent records transactionally, and stop scheduled processing for the brand. Final hard deletion is an administrative process subject to Hanna Creative's retention practices and applicable law. |
| Human access | Customer users are scoped to authorized brands. Designated super-administrator and engineering access may permit access to application data for authorized support, security, administration, and legal purposes, subject to the confidentiality and access-control commitments in the Agreement. |
| Vendor access | No vendor has standing access to Hanna Creative's application or database; vendors process only data sent to the relevant service, subject to applicable contracts and provider settings. |
| Security governance | Program-level security governance commitments apply as required by applicable law and contractual commitments. Specific certifications are not incorporated unless expressly identified. |
| Backup, recovery, and continuity | Backup, recovery, and continuity commitments, if any, are governed by applicable Orders and then-current security documentation; this Annex does not establish a specific RTO, RPO, recovery-testing cadence, or backup-expiration SLA. |
| Privacy and correction workflows | Contractual/operational requirement: maintain a process for verified privacy requests, source challenges, correction, deletion, objections where applicable, and recalculation of affected Halo Scores where reasonably practicable. |
Hanna Creative will maintain a current list of material subprocessors that process Customer Personal Data and may separately identify other material service providers. Provider-specific retention, geographic processing, and contractual terms may change. Source platforms selected and authorized directly by Customer, such as Google and Meta, may have independent roles under their own terms and are not necessarily Hanna Creative subprocessors. If Hanna Creative continues to use a third-party public-data collection service for independently sourced personal data, that provider should be identified in the public service-provider list even if it does not process Customer Personal Data.
| Subprocessor | Purpose | Data or Service Category | Primary Processing Location |
|---|---|---|---|
| Amazon Web Services (AWS EC2) | Application hosting and infrastructure | Application, self-managed MySQL database, and self-managed Redis on Hanna Creative-controlled EC2 infrastructure | United States / account-configured AWS region; no contractual residency commitment unless stated in an Order. |
| Anthropic Claude API | AI inference, classification, and Customer-specific report generation | Customer-specific report inputs/outputs sent for API inference; current Files API use contains Hanna Creative template/prompt materials, not Customer Data | United States for the reviewed configuration; retention governed by Anthropic terms and account settings. |
| Twilio SendGrid | Transactional email delivery | Business email address and message/delivery metadata needed for invites, magic links, report-ready, and billing notices | Provider/account configured; see the current public service-provider notice. |
| Sentry | Application error monitoring | Error diagnostics, stack traces, and breadcrumbs; PII sending disabled and SQL parameter bindings excluded in reviewed configuration | Provider/account configured; see the current public service-provider notice. |
| Stripe | Hosted checkout, billing portal, subscription administration, and payment processing | Billing identifiers and subscription status; payment-card data is collected by Stripe and does not reach Hanna Creative infrastructure | Provider-controlled / global; governed by Stripe services terms. |