Sting

Legal

Private Beta and Waitlist Terms

Version 1.0 · Effective date: 10 September 2026

1. Who we are and what this covers

1.1 These Private Beta and Waitlist Terms (the "Terms") are an agreement between you and Sting Studio AB, a Swedish limited company with organization number 559179-6775 and VAT number SE559179677501, with its registered office in Stockholm, Sweden ("Sting", "we", "us").

1.2 They govern your use of the marketing site at sting.studio (including any landing or teaser page), your submission to the Sting waitlist or private beta list, and, if we invite you, your use of the Sting private beta (together, the "Beta Program"). They do not govern a paid subscription. Paid access, if and when offered, will be under a separate product terms of service.

1.3 These Terms include Annex A (Data Processing Agreement), Annex B (Subprocessors), and Annex C (Technical and Organizational Measures). Annex A takes precedence over the body of these Terms on any point of data protection.

1.4 "Sting" the product is job-record and closeout software for small creative studios. In the Beta Program you may see a limited, changing version of that product, including job records, client records, handover packages, file attachments, handover links, a client portal, reminders, and related email. During the beta those surfaces are used only with addresses your own studio controls, as 5.2 requires, and nothing produced in them is a commercial deliverable. Features may be incomplete, broken, or withdrawn.

1.5 The Beta Program is a non-production version, provided for evaluation only. It is not for live client work, and you must not put real client personal data into it. Section 5 sets out what that means in practice.

2. Acceptance and who is bound

2.1 You accept these Terms by submitting a waitlist or beta request, checking an acceptance box, creating or using a beta account, signing in with a magic link we send, or otherwise using the Beta Program after we have shown you these Terms.

2.2 If you use the Beta Program on behalf of a studio, company, or other organization, you confirm that you have authority to bind that organization, and "you" includes that organization. If you do not agree, do not submit the form and do not use the beta.

2.3 The beta is used by people in your studio. You are responsible for everyone you give access to, for what they do in the product, and for the addresses you send handovers and portal invitations to.

2.4 The Beta Program is not open to your clients or to other third parties. Section 5 says where you may send handover links and portal invitations during the beta.

3. Eligibility

3.1 The Beta Program is for business use by creative studios. You must be at least 18 years old. You must not use the Beta Program as a consumer for purely personal or household purposes.

3.2 We may accept or refuse any waitlist request, limit the number of beta studios, or invite you later or not at all. An invitation is not a promise of paid access, a price, or a launch date.

4. Waitlist and marketing site

4.1 The landing page is a teaser. It is not an offer to sell, not a price list, and not a description of a finished product.

4.2 Joining the waitlist asks us to consider you for the private beta. On that basis we will email you about it: confirmation that we received your request, an invitation if we send one, magic links, security notices, and notices under Section 19.

4.3 Everything in 4.2 is service mail needed to run the Beta Program. It does not depend on consent and there is no unsubscribe link for it, because you cannot join the waitlist or use the beta without it. We also run an optional email newsletter, which is not part of these Terms and requires its own separate sign-up; it is described in our Privacy Policy at sting.studio/privacy. To be removed from the waitlist, write to privacy@sting.studio.

4.4 How we handle personal data as controller is described in our Privacy Policy at sting.studio/privacy, which is a separate document.

4.5 Joining the waitlist does not create an account, a license, or any service-level commitment.

5. Private beta access and evaluation-only use

5.1 If we invite you, access is a revocable, non-exclusive, non-transferable right to use the then-current beta for your studio's internal evaluation. You may not resell access, share login links except with people in your studio, or use the beta to build a competing product.

5.2 You must not:

  • run a live client job, closeout, or handover through the beta, or treat anything it produces as a binding record between you and a client;
  • enter personal data about a real client, a real client's staff, or any other individual outside your studio;
  • send a handover link, portal invitation, or reminder to any address your studio does not control;
  • upload deliverable files you are not free to store and share for test purposes; or
  • use the beta as a system of record, or as your only copy of anything.

5.3 Use test data or your own studio's data. Where you need realistic material, anonymize or pseudonymize it first.

5.4 If we become aware that a tenant holds live client records, or that handovers are being sent outside your studio, we will ask you once to stop. If you do not, we may suspend the tenant under Section 18.

5.5 We may change or suspend features at any time. Section 15 sets out what we do not warrant.

5.6 We may reset, migrate, or delete beta data on at least seven days' notice by email. In an emergency, meaning a security incident, abuse, a legal demand, or a failed migration, we may act first and notify without undue delay after.

5.7 If we close the Beta Program or withdraw your access other than under Section 18, we will give you at least 30 days' notice and keep an export route open for that period so you can download your records (jobs, licenses, and subscriptions) and your client records as CSV, and download the files you uploaded.

5.8 The Beta Program is a non-production version provided for testing and evaluation for a limited period. It runs until we notify you by email that it has closed, and in any event ends no later than 31 December 2027. On that basis the obligations in Chapter VI of Regulation (EU) 2023/2854 (switching between data processing services) do not apply to it, under Article 31(2) of that Regulation, and we tell you so before you accept these Terms as that Article requires. The export commitment in 5.7 is given voluntarily.

5.9 There is no charge for the Beta Program and we will not take payment under these Terms. Stripe or other paid checkout, if offered later, will require acceptance of separate product terms.

6. Accounts, mail, and security

6.1 Studio users sign in with a magic link sent to an email address. There is no password. You must keep control of that inbox. You are responsible for activity under your address and under links you forward.

6.2 Tell us promptly at legal@sting.studio if you believe an account or a handover link was used without authority. We may rotate tokens, revoke sessions, or suspend access.

6.3 You must give accurate studio name and contact details when asked. One studio in the beta means one tenant. Do not attempt to open a second studio under a false identity to bypass a waitlist or a cap.

7. Your content and our license to host

7.1 "Customer Content" means everything you or anyone in your studio uploads, types, or sends through the Beta Program: job and client records, names and emails, handover text and usage notes, deliverable files and URLs, comments such as "Needs changes", CSV imports, and similar material.

7.2 As between you and Sting, you and your licensors keep all rights in Customer Content. We do not claim ownership of your work product or of any license you write for your own client.

7.3 You grant Sting a worldwide, non-exclusive, royalty-free license to host, store, transmit, display, back up, and otherwise process Customer Content only as needed to run the Beta Program, to secure it, to prevent abuse, to comply with law, and to fix and improve the reliability of the beta, for example by debugging a failed send. This license ends when the Customer Content is deleted under Section 18, except for backup copies during the deletion window described there.

7.4 We will not sell Customer Content, and we will not use Customer Content to train, fine-tune, or evaluate any machine-learning or generative-AI model, whether our own or a third party's.

7.5 We may generate and keep aggregated, de-identified statistics about how the Beta Program is used, such as counts, timings, and error rates, and use them without restriction to run and improve the product. These statistics must not identify you or any individual and must not be reconstructable into Customer Content.

7.6 You represent and warrant that you have all rights and consents needed to upload Customer Content and to email the addresses you enter, that Customer Content complies with Sections 5 and 9, and that it does not infringe anyone's rights.

8. Host only — handovers, approve clicks, and usage text

8.1 Sting is a host and a record-keeping tool. We are not a party to any contract between a studio and anyone else.

8.2 Any usage note, license language, exclusivity, credit line, end date, or similar text a studio puts on a handover is the studio's text. An "Approve" or "Needs changes" click is a signal the studio asked us to record. We do not give that click independent legal effect, we do not witness or notarize it, and we do not warrant that it will be admissible or sufficient in any dispute.

8.3 A minted license or usage reminder in the product is a studio record for the studio's own list. It is not a legal instrument issued by Sting. During the beta it is a test artifact, and you must not present it to a client as a completed closeout.

8.4 Public handover links and portal sessions are capability tools. Anyone who has the link or the inbox may be able to open the package. You choose where a link goes and you are responsible for where it ends up, which is why 5.2 keeps them inside your studio during the beta.

9. Acceptable use

9.1 You must not use the Beta Program to do anything that is illegal, that infringes others' rights, or that creates material legal, security, or reputational risk for Sting or other users.

9.2 Without limiting 9.1, you must not:

  • use the beta for live client work, enter real client personal data, or send handovers outside your studio, contrary to Section 5;
  • upload or send malware, exploits, or content designed to damage systems or harvest credentials;
  • upload or send child sexual abuse material, non-consensual intimate images, or content that exploits minors;
  • use the service for fraud, phishing, impersonation, or unsolicited bulk mail beyond the product's own transactional messages;
  • upload content you do not have the right to store or share, including pirated media and client work you are not authorized to send;
  • store passwords, government-ID scans, full payment-card data, or other secrets the product is not built to hold;
  • attempt to probe, scan, or bypass authentication, rate limits, tenant isolation, or signed file URLs;
  • share a magic link or a handover token in a public channel, or scrape other studios' data;
  • interfere with another studio's tenant, a recipient's inbox, or our vendors for hosting, mail, files, or DNS;
  • enter special-category personal data under Article 9 GDPR, such as health or political opinions, or data about criminal convictions and offences under Article 10 GDPR, for which there is no written-agreement exception during the beta;
  • misrepresent an approve click, forge a recipient identity, or use Sting as a false "legal close" for work you did not send; or
  • reverse engineer the product except as mandatory law allows, or use beta access to build a competing tool.

9.3 We may remove content, rotate links, suspend a studio, or refuse an invite if we reasonably believe this section was broken. You will cooperate with a good-faith investigation.

10. Reporting illegal content

10.1 Sting stores files and text at the direction of its users, so we operate a reporting route under Articles 16 and 17 of Regulation (EU) 2022/2065 (the Digital Services Act).

10.2 Anyone may report content in the Beta Program they consider illegal by writing to legal@sting.studio, which is our single point of contact for this purpose. Notices may be submitted in Swedish or English. A notice should explain why the content is illegal, give the URL or handover link, confirm that the sender believes in good faith that the notice is accurate, and give the sender's name and email, which is not required for reports concerning offences under Articles 3 to 7 of Directive 2011/93/EU.

10.3 We will confirm receipt without undue delay, decide in a timely, diligent, non-arbitrary, and objective way, and tell both the notifier and the studio what we decided and why, including whether the decision was automated and what redress is available. As a micro-enterprise we are exempt under Article 19 from the online platform obligations in Chapter III Section 3, including the Article 20 internal complaints system, and our statement of reasons will say so.

10.4 Nothing in this section limits Section 9 or Section 18.

11. Data protection

11.1 Sting is the controller for the personal data it processes for its own purposes, including waitlist entries, account and studio administration, authentication and security logs, and correspondence. That processing is described in our Privacy Policy at sting.studio/privacy, which is a separate document and is not part of these Terms.

11.2 Sting is a processor for any personal data contained in Customer Content. Section 5 requires you to keep real client personal data out of the beta, but the product will still hold personal data about your own people, and Annex A governs it. You do not need to sign a separate document, though we will provide a countersigned copy on request.

11.3 You are responsible for having a lawful basis for the personal data you put into the beta, for keeping it within the limits in Section 5, for giving the people concerned the information required by Articles 13 and 14 GDPR, and for the accuracy and lawfulness of your instructions to us.

11.4 If someone asks us to exercise a right over data you control, we will not answer on your behalf. We will pass the request to you and help you respond as set out in Annex A.

11.5 Compute, uploaded files, and the database are in the EU. Every vendor we use is a United States company, so platform logs, deployment and account metadata, analytics, and vendor support access involve processing in the United States, and US law may reach data those companies hold wherever it is stored. Traffic to our domains is also proxied through Cloudflare's network before it reaches our EU-pinned compute, which means Customer Content in transit passes through infrastructure a United States company operates. Annex B lists each vendor, its data location, and the basis for its transfer, and section A.9 governs. We will not change the pinned regions without updating Annex B and notifying you under section A.5.

11.6 Read this before you send anything through the product. Our mail vendor stores message content, delivery logs, webhook payloads, and account records in the United States, and selecting an EU sending region changes only where mail is dispatched from. The body of any email the product sends, together with the recipient's address, is stored outside the EU. Annex B has the detail.

12. Confidentiality and beta embargo

12.1 "Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential given its nature. On our side that includes unreleased features, roadmap, pricing under discussion, screenshots of the beta, defect reports, and performance data. On your side it includes Customer Content and your client list.

12.2 Each party will keep the other's Confidential Information confidential, use it only for the Beta Program, and give it only to people who need it and are under equivalent duties. These duties last for the beta and for one year after your access ends, except that Customer Content stays confidential for as long as we hold it.

12.3 The usual exclusions apply: information that is or becomes public without breach, that the receiving party already had without a duty of confidence, that it independently develops, or that it receives lawfully from a third party. Disclosure required by law or a court is permitted if the other party is told first where lawful.

12.4 You must not publish screenshots, recordings, feature descriptions, benchmarks, or pricing discussions about Sting outside your studio without our prior written consent, until we have announced the relevant feature or fact publicly. This does not stop you telling your own clients that you are evaluating a tool for handovers, and it does not stop you making truthful factual statements about anything we have already announced.

12.5 Feedback is governed by Section 14, not by this section.

13. Publicity

13.1 Neither party may use the other's name, logo, or marks in public marketing without prior written consent. Consent for a single use is not consent for later uses. If you agree in writing to be named as a beta studio, you may withdraw that agreement on 30 days' notice and we will remove the reference from material we control at the next reasonable opportunity.

14. Our intellectual property

14.1 Sting, the site, the app, our name and marks, and all software and design that is not Customer Content remain ours or our licensors'. These Terms give you no right to copy the product, reuse our marks, or use "Sting" in a way that suggests partnership or endorsement.

14.2 Feedback you send, such as bugs, ideas, and copy notes, may be used by us without restriction, attribution, or payment, and you grant us a perpetual, irrevocable, worldwide license to do so. Do not send us feedback that contains your or a third party's confidential information or that you are not free to give. You keep your own pre-existing IP.

15. No warranty

15.1 THE BETA PROGRAM IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMITTED BY MANDATORY SWEDISH LAW, WE DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT, AND NON-INFRINGEMENT.

15.2 We do not promise uptime, support hours, response times, or backups you can rely on, and we do not promise that any feature will ship. We do not warrant that the beta will be uninterrupted, secure, or error-free; that files will remain downloadable; that mail will arrive; that an approve click will be stored; or that the product is suitable as a system of record. It is not offered as one.

15.3 This section does not limit our obligations under Annex A or Section 12.

16. Limitation of liability

16.1 The Beta Program is free and is for evaluation only.

16.2 TO THE FULLEST EXTENT PERMITTED BY MANDATORY SWEDISH LAW, NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST FILES, LOST GOODWILL, OR THE COST OF SUBSTITUTE TOOLS, WHETHER IN CONTRACT, TORT INCLUDING NEGLIGENCE, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY.

16.3 Each party's total aggregate liability arising out of or related to the Beta Program or these Terms is limited to SEK 10 000. When a paid product terms of service exists, that later document will state its own cap, which is not part of these Terms.

16.4 Neither the exclusion in 16.2 nor the cap in 16.3 applies to liability that cannot be limited under Swedish law, including liability for intent or gross negligence (uppsåt eller grov vårdslöshet) and for death or personal injury caused by negligence; to either party's breach of Section 12; to your breach of Section 9; or to your obligations under Section 17. Liability owed directly to a data subject or a supervisory authority under Articles 82 and 83 GDPR is a matter of law and is unaffected by this section.

17. Indemnity

17.1 You will indemnify and hold Sting Studio AB harmless from and against third-party claims, and reasonable legal costs and damages awarded or agreed in settlement, arising from: (a) Customer Content; (b) your use of the Beta Program in breach of these Terms or of law, including use for live client work contrary to Section 5; (c) a dispute about a handover, an approve click, or usage text produced during your evaluation; or (d) your infringement of a third party's rights.

17.2 This indemnity does not apply to the extent the claim is caused by our own breach of these Terms, our negligence, or our failure to follow your lawful instructions under Annex A.

17.3 To rely on this indemnity we will notify you in writing without undue delay after we become aware of the claim, a delay reducing the indemnity only to the extent it prejudices you; give you reasonable information and cooperation at your expense; and, at your written request, let you assume and control the defense with counsel of your choice. We may participate with our own counsel at our cost. You may not settle a claim in a way that admits fault on our part, imposes a non-monetary obligation on us, or fails to release us fully, without our written consent, not to be unreasonably withheld. If you do not assume the defense within a reasonable time, we may defend and settle reasonably at your cost.

18. Term, suspension, and deletion

18.1 These Terms start when you accept them and continue until the Beta Program ends or we or you terminate access.

18.2 You may stop using the beta at any time by writing to legal@sting.studio. To be removed from the waitlist, write to privacy@sting.studio.

18.3 We may suspend or end your access immediately for breach of Section 9, for use of the beta for live client work after we have asked you to stop, for a security or legal risk to the service or to another studio, or on a valid legal demand. Where the risk allows, we will suspend rather than delete, tell you what happened, and give you a chance to fix it. Where we end your access for any other reason, 5.7 applies.

18.4 When your beta access ends we will delete or return Customer Content within 30 days, except for copies in encrypted backups, which are overwritten on a rolling cycle of no more than 90 days, and except where law requires us to keep something. Mail data held by our mail vendor is subject to that vendor's retention, which we do not control beyond requesting deletion.

18.5 Deleting a studio in the product is intended to delete that studio's rows and files. During the beta that deletion is best-effort rather than certified, and may be delayed or imperfect. Export what you need before you ask us to wipe a tenant.

19. Changes

19.1 We may update these Terms. For a material change we will email the address you gave us at least 14 days before the change takes effect and post a notice on sting.studio, and the new Terms apply from the stated effective date. Continued use after that date is acceptance. If you do not agree, stop using the Beta Program and ask to be removed from the list. Changes to Annex A follow section A.12.

20. Notices

20.1 Legal notices to Sting must be sent to legal@sting.studio.

20.2 We may notify you at the email address you used for the waitlist or beta login. A notice is given when sent, unless we receive a hard bounce and have no other address, in which case we will use any other address we hold for you.

21. Governing law and venue

21.1 These Terms and any dispute arising out of them or the Beta Program are governed by the laws of Sweden, without regard to conflict-of-law rules.

21.2 The courts of Sweden have exclusive jurisdiction. The Stockholm District Court (Stockholms tingsrätt) is the court of first instance.

21.3 These Terms are written in US English. That English text controls over any translation.

22. General

22.1 These Terms, together with Annexes A to C, are the entire agreement for the Beta Program. Our Privacy Policy is a separate document, referred to in these Terms but not part of them, and may be updated on its own cadence. They do not create a partnership, employment, or agency relationship. You may not assign them without our written consent; we may assign them to a successor of the Sting product on notice to you. If a provision is unenforceable, the rest remains in force. A failure to enforce a provision is not a waiver.

22.2 No one other than you and Sting has any right to enforce these Terms.

22.3 Sections that by nature should survive termination survive, namely 7 as limited by 7.3 and Section 18, and Sections 8, 9, 10, 12, 13, 14, 15, 16, 17, 18, 21, and 22, together with Annex A for as long as we hold any Customer Content.

22.4 We may use subprocessors and infrastructure vendors to run the Beta Program. We remain responsible to you for their work under these Terms, subject to Sections 15 and 16 and to section A.5.

23. Contact

23.1

Sting Studio AB

Organization number 559179-6775

VAT SE559179677501

Registered office: Stockholm, Sweden

Legal notices, illegal content reports, and security reports: legal@sting.studio

Data protection questions and rights requests: privacy@sting.studio

Annexes

Annex A — Data Processing Agreement

This Annex is the data processing agreement required by Article 28(3) GDPR. It applies where Sting processes personal data on your behalf. Terms used here have the meaning given in Regulation (EU) 2016/679 ("GDPR").

Section 5 of the Terms limits the personal data that may be entered into the beta. This Annex applies to whatever personal data is nonetheless processed on your behalf, and it is not a permission to exceed that limit.

A.1 Subject matter, duration, nature, and purpose

A.1.1 Subject matter. Sting's provision of the Beta Program to you for evaluation.

A.1.2 Duration. From your acceptance of the Terms until Customer Content is deleted or returned under Section 18 and section A.11.

A.1.3 Nature and purpose. Hosting, storing, transmitting, displaying, backing up, and deleting personal data so that you can create and evaluate job and client records, assemble and send test handover packages, host handover links and a client portal, send transactional and reminder email to addresses you enter, and record approve or changes-requested signals. Also the security, abuse prevention, debugging, and support work needed to keep that running.

A.1.4 Types of personal data. Names, business email addresses, telephone numbers where you enter them, job titles and employer, correspondence and comment text, handover and usage text, and file content and metadata uploaded by people in your studio. Where you configure the product to record it, this also includes whether and when a handover recipient opened it, clicked Approve, or clicked Needs changes, together with the email address recorded for that recipient. That record is created at your instruction, as Section 8.2 of the Terms describes, and is Customer Content.

A.1.5 Logs are outside this Annex; the decision record is not. Sting also generates authentication, access, and security logs, including the session and connection metadata — time, IP address, user-agent, and which link or tenant was accessed — recorded when a handover link or portal session is used. Sting decides what those contain and how long to keep them, and processes them as controller for its own security and audit purposes rather than on your behalf. They are described in Sting's Privacy Policy and are outside this Annex. The recorded outcome of a handover is different: whether and when it was opened, approved, or marked as needing changes, together with the recipient's email address, is the record described in A.1.4. The studio asked for that record, so Sting processes it on your instruction under this Annex, not as controller. Where Sting uses a controller-side log to answer a question you raise about your own tenant, it does so under this Annex.

A.1.6 Categories of data subjects. Your personnel and contractors, and any individual whose personal data appears in Customer Content you upload within the limits of Section 5.

A.1.7 Special categories. None. Section 9 prohibits Article 9 and Article 10 data outright during the beta.

A.2 Instructions

A.2.1 Sting will process personal data only on your documented instructions, including on transfers to a third country, unless required to do otherwise by EU or Swedish law. Where such law applies, Sting will tell you before processing unless that law prohibits it on important grounds of public interest.

A.2.2 Your instructions are these Terms, this Annex, the configuration and actions you take in the product, and any further written instruction we accept. If we consider an instruction infringes the GDPR or other EU or Member State data protection law, we will tell you without undue delay and may suspend that processing until it is resolved.

A.3 Confidentiality

A.3.1 Sting will ensure that people authorized to process personal data are bound by an appropriate obligation of confidentiality, contractual or statutory, that survives the end of their engagement, and will limit access to those who need it for the purposes in section A.1.

A.4 Security

A.4.1 Sting will implement appropriate technical and organizational measures under Article 32 GDPR, taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects. Annex C describes the measures in place at the effective date. Because this is a beta, measures may change; we will not reduce the overall level of protection.

A.5 Subprocessors

A.5.1 You give general written authorization for Sting to engage subprocessors. Annex B lists those engaged at the effective date.

A.5.2 Sting will tell you by email at least 14 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that period. If you object and we cannot offer a workaround, either of us may terminate your beta access without liability, and Section 18's deletion rules apply.

A.5.3 Sting will impose on each subprocessor, by contract, data protection obligations that are no less protective than this Annex, and remains fully liable to you for a subprocessor's performance of its obligations.

A.6 Assisting with data subject rights

A.6.1 Taking into account the nature of the processing, Sting will help you by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise rights under Chapter III GDPR. If a data subject contacts us directly about data you control, we will not respond substantively and will forward the request to you without undue delay, and in any event within five business days.

A.7 Assisting with Articles 32 to 36

A.7.1 Sting will help you, taking into account the nature of processing and the information available to it, to comply with Articles 32 to 36 GDPR: security, personal data breach notification and communication, data protection impact assessments, and prior consultation.

A.8 Personal data breach

A.8.1 Sting will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data processed on your behalf. The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where all information is not available at once, we will provide it in phases without further undue delay.

A.8.2 Sting will not notify a supervisory authority or a data subject on your behalf unless you ask us to in writing or law requires it of us.

A.9 International transfers

A.9.1 Compute, uploaded files, and the database are located in the EU. Every subprocessor in Annex B is established in the United States, and each processes some personal data there, including platform logs, deployment and account metadata, analytics, support access, and, for mail, message content. Traffic to our domains, including Customer Content in transit, is also proxied through Cloudflare's network before it reaches our EU-pinned compute, as Annex B describes. Each transfer is made on one of: an adequacy decision under Article 45 GDPR, including the EU-U.S. Data Privacy Framework where the recipient is certified; the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three, processor to processor; or another lawful mechanism identified in Annex B. The Clauses in each vendor's own data processing agreement govern that vendor's transfer, and Sting holds a copy of each and will make a copy, or the relevant clauses, redacted where a vendor's commercial terms require it, available on request.

A.10 Audit

A.10.1 Sting will make available to you the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

A.10.2 In practice, we will first respond to a reasonable written information request or provide a completed security questionnaire or third-party report where we hold one. If that is not sufficient, you may audit on 30 days' written notice, no more than once in any twelve months except after a personal data breach or at a supervisory authority's direction, during business hours, without unreasonable disruption, subject to confidentiality, and at your cost unless the audit reveals material non-compliance.

A.11 Deletion or return

A.11.1 At your choice, Sting will delete or return all personal data processed on your behalf at the end of the Beta Program or your access, and delete existing copies, unless EU or Swedish law requires storage. Tell us which you want before the end of the notice period in 5.7 or Section 18. If you tell us nothing, we will delete under Section 18.

A.11.2 Encrypted backups are overwritten on a rolling cycle of no more than 90 days, and personal data in a backup remains subject to this Annex until it is overwritten. Mail data held by our mail subprocessor is subject to that vendor's retention, and we will request deletion where the vendor supports it.

A.12 Changes, precedence, and liability

A.12.1 This Annex may be updated where required by a change in law, in guidance from a supervisory authority, or in the mechanism for transfers. We will notify you as under Section 19.

A.12.2 If this Annex conflicts with the body of the Terms, this Annex prevails on data protection. If this Annex conflicts with the Standard Contractual Clauses, the Clauses prevail.

A.12.3 Each party's liability under this Annex is subject to Section 16. Nothing in this Annex limits a data subject's rights or either party's liability under Article 82 GDPR.

Annex B — Subprocessors

B.1 The subprocessors engaged for the Beta Program are:

SubprocessorPurposeEntity and countryData locationTransfer basis
VercelApplication hosting and compute, object storage for uploaded files (Blob), platform logs and observability, web analyticsVercel, Inc., United StatesCompute and Blob store pinned to Frankfurt (fra1); platform logs, deployment and account metadata, and analytics processed in the United StatesEU-U.S. Data Privacy Framework certification, with the Standard Contractual Clauses in Vercel's data processing addendum as fallback
NeonManaged Postgres database, provisioned through the Vercel MarketplaceNeon, Inc., United StatesDatabase in AWS Frankfurt (eu-central-1); control plane, account metadata, and support access in the United StatesEU-U.S. Data Privacy Framework certification, with the Standard Contractual Clauses in Neon's data processing agreement as fallback
CloudflareDNS, TLS termination, and reverse proxy for sting.studio and app.sting.studio, plus web analyticsCloudflare, Inc., United StatesGlobal edge; traffic to our domains, including Customer Content in transit, is proxied through Cloudflare's network; account and analytics data in the United StatesEU-U.S. Data Privacy Framework certification, with Standard Contractual Clauses as fallback
ResendTransactional and handover email: magic links, handover notifications, remindersResend, Inc., United StatesMail dispatched from the EU sending region; message content, delivery logs, webhook payloads, and account records stored in the United StatesEU-U.S. Data Privacy Framework certification, plus Standard Contractual Clauses in Resend's data processing agreement

B.2 Every vendor above is a United States company. Pinning a region controls where data is stored and processed, not which law reaches the company holding it. Sting has accepted each vendor's data processing agreement and holds a copy.

Annex C — Technical and Organizational Measures

C.1 The beta is a non-production evaluation environment that should not hold real client personal data. The measures below are proportionate to that risk as Article 32(1) GDPR allows.

C.2 Sign-in is passwordless, by single-use, time-limited magic link. Sessions expire and can be revoked.

C.3 Administrative access to production is limited to named personnel, requires multi-factor authentication, and is removed when an engagement ends.

C.4 Studios are separated into logical tenants, and access to Customer Content is scoped to the tenant that owns it.

C.5 Personal data is encrypted in transit using TLS and at rest in the database and file storage.

C.6 Deliverable files are served by expiring signed URLs. Handover tokens are stored hashed and can be revoked by the studio.

C.7 Compute, uploaded files, and the database are in the EU. Inbound traffic to our domains is proxied through Cloudflare's network before it reaches that EU-pinned compute, as Annex B describes. Outbound mail goes through the provider named in Annex B, which stores mail data in the United States.

C.8 Authentication, access, and administrative events are logged and retained as stated in Sting's Privacy Policy.

C.9 The product does not accept special-category data under Article 9 GDPR or data on criminal convictions and offences under Article 10 GDPR.

C.10 Personnel with access to personal data are bound by written confidentiality obligations.

C.11 Incidents follow a documented response process with a named owner and notification under section A.8.

See our Privacy Policy for details on how we collect, process, and use personal data.

© 2026 Sting Studio AB