This addendum applies between Order Dynamics Inc. (“Lookbook”, the processor) and the production company licensing Lookbook (the “Production”, the controller), and forms part of the Terms of Service. It exists so a production's legal and security teams can sign off quickly.
1. Roles
The Production is the controller of the personal information processed through its Lookbook production — including continuity photographs of performers, crew names and times. Lookbook processes that information only to provide the service.
2. Instructions
Lookbook processes production data solely to operate the service (sync, storage, display to authorized members, notifications, report generation, AI parsing of paperwork submitted by members) and on no other instructions. We do not use production data for advertising, analytics products, or AI training.
3. Confidentiality
Production content is treated as confidential. Access by Lookbook personnel is limited to what is necessary to operate and support the service and is bound by confidentiality obligations. We understand production NDAs; on request we will execute a production's standard NDA.
4. Subprocessors
Current subprocessors: Supabase (database/storage/auth, on AWS), xAI (parsing of submitted paperwork text only), Expo/Apple/Google (push notification delivery), Stripe (payments). We will give notice before adding subprocessors that handle production content.
5. Security
TLS in transit; encryption at rest; private storage buckets with signed, expiring URLs; per-production isolation enforced with database row-level security; role-restricted administration (owner/HoD); automatic access expiry for scheduled day players; authenticated, validated writes. Details: Security overview.
6. Breach notification
We notify the affected production without undue delay and within 72 hours of confirming a personal-data breach affecting its data, with the information needed for the production's own obligations.
7. Deletion and return
At wrap, the production may export its complete record (Wrap Archive and raw data export). On written request we permanently delete a production's records within 30 days, subprocessor copies included, except minimal billing records required by law.
8. Assistance and audits
We will reasonably assist the production with data-subject requests and privacy assessments concerning its Lookbook data, and will answer reasonable written security questionnaires.
Contact: ordynapp@gmail.com