Terms of Service
Last Updated: June 14,
2023
Please
read these Terms of Service (the “Terms”)
and our Privacy Notice (https://glystn.com/privacypolicy) (“Privacy Notice”) carefully because they
govern your use of the websites located at https://glystn.com/ and https://app.glystn.com (collectively, the “Site”)
and the services accessible via the Site and corresponding mobile application
(“App”) offered by Glystn, Inc. (“Glystn,”
“we,” “our,” or “us”). To make these Terms easier to read,
the Site and our services are collectively called the “Services.”
IMPORTANT NOTICE
REGARDING ARBITRATION FOR U.S. CUSTOMERS: WHEN YOU AGREE TO THESE TERMS YOU ARE
AGREEING (WITH LIMITED EXCEPTION) TO RESOLVE ANY DISPUTE BETWEEN YOU AND GLYSTN
THROUGH BINDING, INDIVIDUAL ARBITRATION RATHER THAN IN COURT. PLEASE REVIEW
CAREFULLY SECTION 17 (DISPUTE RESOLUTION FOR INDIVIDUALS) AND SECTION 18 (DISPUTE
RESOLTUTION FOR ENTITIES) BELOW FOR DETAILS REGARDING ARBITRATION.
Glystn is not obligated to monitor access
to or use of the Services or to review or edit any content. However, we have
the right to do so for the purpose of operating the Services, to ensure compliance
with these Terms and to comply with applicable law or other legal requirements.
We reserve the right, but are not obligated, to remove or disable access to any
content, including User Content, at any time and without notice, including, but
not limited to, if we, at our sole discretion, consider it objectionable or in
violation of these Terms. We have the right to investigate violations of these
Terms or conduct that affects the Services. We may also consult and cooperate
with law enforcement authorities to prosecute users who violate the law.
“I hereby declare that I have a good faith belief
that the disputed use of the copyrighted material identified is not authorized
by the copyright owner, its agent, or the law. I hereby state that the
information in this Copyright Notice is accurate and, under penalty of perjury,
that I am the owner, or authorized to act on behalf of the owner, of the
copyright or of an exclusive right under the copyright that is allegedly
infringed.”
Glystn, Inc
(415) 212-8923
(b)
Third-Party
Services Terms. Certain
Third-Party Services, and your use thereof (including via the Services) may
require you to adhere and be subject to terms, conditions, and restrictions
(including terms of service or other end-user license agreements) applicable to
such Third-Party Services, including as set forth in Section 11(c) and 11(d) below.
(c)
YouTube
Terms of Service. If you
access or use YouTube as a Third-Party Services, you agree to adhere to and be
bound by YouTube’s Terms of Services, located at https://www.youtube.com/t/terms.
(d)
Discord
Terms. If you access or
use Discord as a Third-Party Service, you agree to adhere to and be bound by
Discord’s Developer Terms of Service (located https://discord.com/developers/docs/policies-and-agreements/developer-terms-of-service) and the Discord Terms of Services
(located at https://discord.com/terms), each of which will govern your use of Discord as a Third-Party
Service and control over these Terms in the event of any conflict or
inconsistency with these Terms.
The
arbitration will be conducted using remote conferencing technology (e.g., by
videoconference), in person in San Francisco, California, United States or at
some other location that we both agree to. Disputes that meet the requirements
for desk arbitrations as set forth in the AAA Consumer Rules, may be resolved
by the submission of documents only, as set forth in the AAA Consumer Rules,
unless the Arbitrator decides that a hearing is necessary. The parties agree
that the arbitrator shall have exclusive authority to decide all issues
relating to the interpretation, applicability, enforceability and scope of this
arbitration agreement.
Exhibit
A – Data Processing Addendum
This Data Processing
Addendum (including its Attachments) (“Addendum”)
forms part of and is subject to the terms and conditions of the Terms of
Service (the “Terms”) by and between
you (“Creator”) and Glystn.
1.
Subject Matter and
Duration.
1.1.
Subject Matter. This Addendum
reflects the parties’ commitment to abide by Data Protection Laws concerning
the Processing of Creator Personal Data in connection with Glystn’s execution
of the Terms. All capitalized terms that are not expressly defined in this
Addendum will have the meanings given to them in the Terms. If and to the extent language in this Addendum or any of
its Attachments conflicts with the Terms, this Addendum shall control.
1.2.
Duration and
Survival. This Addendum will become legally binding upon the effective date of the
Terms. Glystn will Process Creator Personal Data until the relationship
terminates as specified in the Terms.
2.
Definitions. For
the purposes of this Addendum, the following terms and those defined within the
body of this Addendum apply.
2.1.
“Creator Personal
Data” means User Content that is Personal Data Processed by Glystn on
behalf of Creator.
2.2.
“Data Protection
Laws” means the applicable data privacy and data protection laws, rules,
and regulations to which the Creator Personal Data are subject. “Data
Protection Laws” may include, but are not limited to, the California Consumer
Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); the EU General Data Protection
Regulation 2016/679 (“GDPR”) and its respective national implementing
legislations; the Swiss Federal Act on Data Protection; the United Kingdom
General Data Protection Regulation; the United Kingdom Data Protection Act
2018; and the Virginia Consumer Data Protection Act (in each case, as amended,
adopted, or superseded from time to time).
2.3.
“Personal Data”
has the meaning assigned to the term “personal data” or “personal information”
under applicable Data Protection Laws.
2.4.
“Process” or “Processing” means any operation or set
of operations which is performed on Personal Data or sets of Personal Data,
whether or not by automated means, such as collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination, or otherwise making available,
alignment or combination, restriction, erasure, or destruction.
2.5.
“Security
Incident(s)” means the breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of, or access
to Creator Personal Data attributable to Glystn.
2.6. “Subprocessor(s)”
means Glystn’s authorized vendors and third-party
service providers that Process Creator Personal Data. Third-Party Services are
not Subprocessors.
3.
Processing Terms for Creator Personal Data.
3.1.
Documented Instructions. Glystn shall Process Creator
Personal Data to provide the Services in accordance with the Terms, this
Addendum, and any instructions agreed upon by the parties. Glystn will, unless
legally prohibited from doing so, inform Creator in writing if it reasonably
believes that there is a conflict between Creator’s instructions and applicable
law or otherwise seeks to Process Creator Personal Data in a manner that is
inconsistent with Creator’s instructions.
3.2.
Authorization to Use Subprocessors. Creator hereby
authorizes Glystn to engage Subprocessors. Creator acknowledges that
Subprocessors may further engage vendors.
3.3.
Glystn and Subprocessor Compliance. Glystn shall (i)
enter into a written agreement with Subprocessors regarding such Subprocessors’
Processing of Creator Personal Data that imposes on such Subprocessors data
protection requirements for Creator Personal Data that are consistent with this
Addendum; and (ii) remain responsible to Creator for Glystn’s Subprocessors’
failure to perform their obligations with respect to the Processing of Creator
Personal Data as required by applicable Data Protection Laws.
3.4.
Right to Object to Subprocessors. Where required by
Data Protection Laws, Glystn will notify Creator prior to engaging any new
Subprocessors that Process Creator Personal Data and allow Creator two (2) days
to object. If Creator has legitimate objections to the appointment of any new
Subprocessor, the parties will work together in good faith to resolve the
grounds for the objection.
3.5.
Confidentiality. Any person authorized to Process Creator
Personal Data must be subject to a duty of confidentiality, contractually agree
to maintain the confidentiality of such information, or be under an appropriate
statutory obligation of confidentiality.
3.6.
Personal
Data Inquiries and Requests. Where
required by Data Protection Laws, Glystn agrees to provide reasonable assistance and comply with reasonable
instructions from Creator related to any requests from individuals
exercising their rights in Creator Personal Data granted to them under Data
Protection Laws.
3.7.
Data
Protection Assessment, Data Protection Impact Assessment, and Prior Consultation. Where required by
Data Protection Laws, Glystn agrees to provide reasonable assistance and
information to Creator where, in Creator’s judgement, the type of Processing
performed by Glystn requires a data protection assessment,
data protection impact assessment, and/or prior consultation with the relevant
data protection authorities. Creator shall reimburse Glystn for all non-negligible costs Glystn incurs in
performing its obligations under this Section.
3.8.
Demonstrable Compliance. Glystn agrees to provide information
reasonably necessary to demonstrate compliance with this Addendum upon
Creator’s reasonable request.
3.9.
California Specific Terms. To the extent that
Glystn’s Processing of Creator Personal Data is subject to the CCPA, this
Section shall also apply. Creator discloses or otherwise makes available
Creator Personal Data to Glystn for the limited and specific purpose of Glystn
providing the Services to Creator in accordance with the Terms and this
Addendum. Glystn shall: (i) comply with its applicable obligations under the
CCPA; (ii) provide the same level of protection as required under the CCPA;
(iii) notify Creator if it can no longer meet its obligations under the CCPA;
(iv) not “sell” or “share” (as such terms are defined by the CCPA) Creator
Personal Data; (v) not retain, use, or disclose Creator Personal Data for any
purpose (including any commercial purpose) other than to provide the Services
under the Terms or as otherwise permitted under the CCPA; (vi) not retain, use,
or disclose Creator Personal Data outside of the direct business relationship
between Creator and Glystn; and (vii) unless otherwise permitted by the CCPA,
not combine Creator Personal Data with Personal Data that Glystn (a) receives
from, or on behalf of, another person, or (b) collects from its own,
independent consumer interaction. Creator may: (1) take reasonable and
appropriate steps agreed upon by the parties to help ensure that Glystn
Processes Creator Personal Data in a manner consistent with Creator’s CCPA
obligations; and (2) upon notice, take reasonable and appropriate steps agreed
upon by the parties to stop and remediate unauthorized Processing of Creator
Personal Data by Glystn.
3.10.
Aggregation
and De-Identification. Glystn may: (i) compile aggregated and/or
de-identified information of User Content and otherwise in connection with
providing the Services provided that such information cannot reasonably be used to identify Creator or any
data subject to whom Creator Personal Data relates (“Aggregated and/or
De-Identified Data”); and (ii) use Aggregated and/or De-Identified Data for its
lawful business purposes.
4.
Information Security Program. Glystn shall
implement and maintain reasonable administrative, technical, and physical
safeguards designed to protect Creator Personal Data.
5.
Security Incidents. Upon becoming aware
of a Security Incident, Glystn agrees to provide written notice without undue
delay and within the time frame required under Data Protection Laws to Creator.
Where possible, such notice will include all available details required under
Data Protection Laws for Creator to comply with its own notification
obligations to regulatory authorities or individuals affected by the Security
Incident.
6.
Cross-Border
Transfers of Creator Personal Data.
6.1.
Cross-Border Transfers of Creator Personal Data. Creator authorizes Glystn and its Subprocessors to transfer Creator Personal Data across international
borders, including from the European Economic Area, Switzerland, and/or the
United Kingdom to the United States.
6.2. EEA, Swiss, and UK
Standard Contractual Clauses. If Creator Personal Data originating in
the European Economic Area, Switzerland, and/or the United Kingdom is
transferred by Creator to Glystn in a country that has not been found to
provide an adequate level of protection under applicable Data Protection Laws,
the parties agree that the transfer shall be governed by Module Two’s
obligations in the Annex to the Commission Implementing Decision (EU)
2021/914 of 4 June 2021 on standard contractual clauses for the transfer of
personal data to third countries pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council (“Standard Contractual Clauses”) as
supplemented by Attachment 1 attached hereto, the terms of which are
incorporated herein by reference. Each party’s execution of the Terms shall be
considered a signature to the Standard Contractual Clauses to the extent that
the Standard Contractual Clauses apply hereunder.
7.
Audits and
Assessments. Where Data Protection Laws afford Creator an audit or assessment right,
Creator (or its appointed representative) may carry out an audit or assessment
of Glystn’s policies, procedures, and records relevant to the Processing of
Creator Personal Data. Any audit or assessment must be: (i) conducted during
Glystn’s regular business hours; (ii) with reasonable advance notice to Glystn;
(iii) carried out in a manner that prevents unnecessary disruption to Glystn’s
operations; and (iv) subject to reasonable confidentiality procedures. In
addition, any audit or assessment shall be limited to once per year, unless an
audit or assessment is carried out at the direction of a government authority
having proper jurisdiction.
8.
Creator Personal Data
Deletion. At the expiry or termination of the Terms, Glystn will delete all
Creator Personal Data (excluding any back-up or archival copies which shall be
deleted in accordance with Glystn’s data retention schedule), except where
Glystn is required to retain copies under applicable laws, in which case Glystn
will isolate and protect that Creator Personal Data from any further Processing
except to the extent required by applicable laws.
9.
Creator’s
Obligations. Creator represents and warrants that: (i) it
has complied and will comply with Data Protection Laws; (ii) it has provided
data subjects whose Creator Personal Data will be Processed in connection with
the Terms with a privacy notice or similar document that clearly and accurately
describes Creator’s practices with respect to the Processing of Creator
Personal Data; (iii) it has obtained and will obtain and continue to have,
during the term, all necessary rights, lawful bases, authorizations, consents,
and licenses for the Processing of Creator Personal Data as contemplated by the
Terms; and (iv) Glystn’s Processing of Creator Personal Data in accordance with
the Terms will not violate Data Protection Laws or cause a breach of any
agreement or obligations between Creator and any third party.
10. Processing Details.
10.1.
Subject Matter. The subject matter of the Processing is the
Services pursuant to the Terms.
10.2.
Duration. The Processing will continue until the expiration
or termination of the Terms.
10.3.
Categories of
Data Subjects. Data subjects
whose Creator Personal Data will be Processed pursuant to the Terms.
10.4.
Nature and
Purpose of the Processing. The purpose
of the Processing of Creator Personal Data by Glystn is the performance of the
Services.
10.5.
Types of Creator Personal Data. Creator Personal Data that is Processed pursuant to the Terms.
Attachment 1 to the Data Processing
Addendum
This
Attachment 1 forms part of the Addendum and supplements the Standard
Contractual Clauses. Capitalized terms not defined in this Attachment 1 have
the meaning set forth in the Addendum.
The
parties agree that the following terms shall supplement the Standard
Contractual Clauses:
2.
Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data
Exporter: Creator.
Address: As set forth in the Notices section of the Terms.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Terms.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Controller.
Data Importer: Glystn.
Address: As set forth in the Notices section of the
Terms.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Terms.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Processor.
B. Description of the Transfer:
Categories of data subjects whose personal
data is transferred: The
categories of data subjects whose personal data is transferred under the
Clauses.
Categories of personal data transferred: The categories of personal data
transferred under the Clauses.
Sensitive data transferred (if applicable)
and applied restrictions or safeguards that fully take into consideration the
nature of the data and the risks involved, such as for instance strict purpose
limitation, access restrictions (including access only for staff having
followed specialised training), keeping a record of
access to the data, restrictions for onward transfers or additional security
measures: To
the parties knowledge, no sensitive data is transferred.
The frequency of the transfer (e.g. whether
the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard
functionality of the Services, or as otherwise agreed upon by the parties.
Nature of the processing: The Services.
Purpose(s) of the data transfer and further
processing: The Services.
The period for which the personal data will
be retained, or, if that is not possible, the criteria used to determine that
period: Data importer will retain personal data in
accordance with the Addendum.
For transfers to (sub-) processors, also
specify subject matter, nature and duration of the processing: For the subject matter, nature, and duration as identified above.
C. Competent
Supervisory Authority: The supervisory authority mandated by Clause
13. If no supervisory authority is mandated by Clause 13, then the Irish Data
Protection Commission (DPC), and if this is not possible, then as otherwise
agreed by the parties consistent with the conditions set forth in Clause 13.
D. Additional Data Transfer
Impact Assessment Questions:
Will data importer
process any personal data under the Clauses about a non-United States person
that is “foreign intelligence information” as defined by 50 U.S.C. § 1801(e)?
Not to data importer’s knowledge.
Is data importer subject to any laws in a
country outside of the European Economic Area, Switzerland, and/or the United
Kingdom where personal data is stored or accessed from that would interfere
with data importer fulfilling its obligations under the Clauses? For example,
FISA Section 702. If yes, please list these laws:
As of the effective date of the Addendum, no court
has found data importer to be eligible to receive process issued under the laws
contemplated by this question, including FISA Section 702, and no such court
action is pending.
Has data importer ever received a request
from public authorities for information pursuant to the laws contemplated by
the question above? If yes, please explain:
No.
Has data importer ever received a request
from public authorities for personal data of individuals located in European
Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain:
No.
E. Data Transfer Impact Assessment Outcome: Taking into account the information and
obligations set forth in the Addendum and, as may be the case for a party, such
party’s independent research, to the parties’ knowledge, the personal data
originating in the European Economic Area, Switzerland, and/or the United
Kingdom that is transferred pursuant to the Clauses to a country that has not
been found to provide an adequate level of protection under applicable data
protection laws is afforded a level of protection that is essentially
equivalent to that guaranteed by applicable data protection laws.
3.
Annex II. Annex II of the Standard Contractual Clauses shall read as follows:
Data importer shall
implement and maintain technical and organisational
measures designed to protect personal data in accordance with the Addendum.
Pursuant to Clause 10(b),
data importer will provide data exporter assistance with data subject requests
in accordance with the Addendum.
4.
Annex III. A new Annex III shall be added to the Standard Contractual Clauses and
shall read as follows:
The UK Information Commissioner’s Office
International Data Transfer Addendum to the EU Commission Standard Contractual
Clauses (“UK Addendum”) is
incorporated herein by reference.
Table 1: The
start date in Table 1 is the effective date of the Addendum. All other
information required by Table 1 is set forth in Annex I, Section A of the
Clauses.
Table 2: The
UK Addendum forms part of the version of the Approved EU SCCs which this UK
Addendum is appended to including the Appendix Information, effective as of the
effective date of the Addendum.
Table 3: The
information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The
parties agree that Importer may end the UK Addendum as set out in Section 19.