Data Processing Addendum

Last updated: October 12, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Infernal Moose Publishing, LLC, a Colorado limited liability company doing business as Familiar ("Familiar," "we," or "us"), and the organization that uses Familiar under those Terms ("Customer" or "you"). It applies whenever we process personal data on your behalf while providing the Service.

You accept this DPA by accepting the Terms, and it needs no separate signature. If you need a signed copy for your records, email privacy@infernalmoose.com with your organization's legal name and address, and we will countersign this version. The signed copy has exactly the same terms as this page.

Definitions
Roles and Scope
Your Responsibilities
Processing on Your Instructions
Confidentiality of Our Personnel
Security
Subprocessors
Requests From Individuals, and Other Assistance
Security Incidents
Return and Deletion
Information and Audits
International Transfers
U.S. State Privacy Laws
Liability, Precedence and Changes
Annex I: Details of Processing
Annex II: Technical and Organizational Security Measures
Annex III: Subprocessors

1. Definitions

"Data Protection Laws" means every law that applies to the processing of Customer Personal Data under the Terms. That includes the EU General Data Protection Regulation ("GDPR"), the GDPR as retained in UK law ("UK GDPR") together with the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and the comprehensive privacy laws of other U.S. states, such as the Colorado Privacy Act.
"Customer Personal Data" means personal data that we process on your behalf while providing the Service, as described in Section 2.1 and Annex I.
"Subprocessor" means a third party we engage that processes Customer Personal Data.
"Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
"SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
"Controller," "processor," "data subject," "personal data," "processing," "business," "service provider," "sell," and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and Scope

2.1 Where we act for you

For the following data you are the controller (or the business), and we are your processor (or your service provider or contractor). Annex I gives the details.

Contributor records you create or import: authors, illustrators, translators, estates and other rights holders, including their contact details, contracts, royalty and sales figures, and the payment and tax details you enter, such as bank account numbers and Social Security or Employer Identification Numbers.
Your readers: people who sign up for your newsletter, reader magnets or release reminders, send you a message, or apply to your ARC team on your author page, plus the people you invite to your ARC listings.
Your submitters: writers and agents who submit to your submission windows, including the manuscripts and materials they send and your team's notes, scores and decisions about them.
Your ARC campaigns: the decisions you make on applications to your listings, and our delivery of your files to the readers you approve, including the reader identifiers we embed in watermarked copies.
Your Shopify customers, when you use Familiar to deliver ebooks for your Shopify store.
Contract signers you send documents to through Familiar's e-signature feature.
Anyone else whose personal data appears in the files, messages, manuscripts, notes and other content you put into the Service.

If you use Familiar to act for someone else (for example, as an agency or a services firm working for an author or publisher), you are a processor for that person, we are your subprocessor, and you confirm that your own controller has authorized our appointment on the terms of this DPA.

2.2 Where we act for ourselves

This DPA does not cover data we process as an independent controller. Our Privacy Policy covers that data instead. It includes:

Account data for everyone who signs in to Familiar, including your own staff: names, email addresses, credentials, security and session records, consent preferences, product usage, support correspondence and billing records.
The ARC reader marketplace: reader accounts and profiles that readers create and maintain with us, and which they use to apply to listings from many publishers. When a reader applies to your listing, we share their application with you, and you control your copy of it independently.
Payments that pass through Familiar, such as submission fees processed through Stripe and our platform fee on them.
Data we must keep to comply with law, enforce the Terms, or protect the security of the Service and its users.

2.3 Third parties you connect

When you tell the Service to send data to a third party you chose, such as your email marketing provider (MailerLite, Kit or Mailchimp), your Shopify store, a retailer, distributor or printer, or a co-agent or contributor you share with, we send it on your instructions. That recipient is not our Subprocessor, and its processing is governed by your own relationship with it.

2.4 Aggregated and de-identified data

We may create aggregated or de-identified data from Customer Personal Data to operate, secure and improve the Service, for example to measure parsing accuracy or to compile industry benchmarks. Such data will not identify you, any individual, or any individual's household. We will not attempt to re-identify it, and we will contractually prohibit anyone we share it with from doing so.

3. Your Responsibilities

You are responsible for:

Having a lawful basis to collect Customer Personal Data and to have us process it. For example, you need consent to email readers who sign up on your author page, and you need to tell contributors that you keep their payment and tax details in Familiar.
Giving individuals the notices that Data Protection Laws require, and choosing the settings that suit your obligations. For example, you decide whether to turn on double opt-in for your newsletter signups or AI detection for your submission windows.
Making sure your instructions to us comply with Data Protection Laws.
Not putting special categories of personal data (such as health information) or children's data into the Service unless you need to and it is lawful. Except for the Security measures in Annex II, the Service has no special handling for such data.

4. Processing on Your Instructions

We will process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, the way you use and configure the Service, and any further written instructions we agree to. The one exception is processing required by law. In that case, we will tell you about the legal requirement before processing unless the law prohibits it. If we believe an instruction violates Data Protection Laws, we will tell you, and we may suspend the affected processing until you confirm or change the instruction.

5. Confidentiality of Our Personnel

Only personnel who need access to Customer Personal Data to provide, support or secure the Service will have it. Everyone with access is bound by written confidentiality obligations or by a statutory duty of confidentiality. Our staff do not access your organization's data unless that is needed to resolve a support request, investigate a problem, keep the Service running, or comply with law.

6. Security

We implement and maintain the technical and organizational measures described in Annex II. They are designed to give Customer Personal Data a level of security appropriate to the risk. We may change these measures over time, but we will not lower the overall level of protection they provide.

7. Subprocessors

General authorization. You authorize us to engage Subprocessors. Our current Subprocessors, what each one does, and where each one processes data are listed at familiar.pub/subprocessors.
Notice of new Subprocessors. We will update that page and its date at least 7 days before a new Subprocessor starts processing Customer Personal Data. If you would like an email when that happens, ask us at privacy@infernalmoose.com. In an emergency, such as a provider failing or becoming unsafe to use, we may replace it on shorter notice and will tell you as soon as we reasonably can.
Your right to object. You may object to a new Subprocessor on reasonable data protection grounds by emailing us within 7 days of the notice. We will discuss your concern in good faith. If we cannot resolve the objection, you may stop using the part of the Service that relies on the new Subprocessor, or end the Terms.
Our obligations. Each Subprocessor is bound by a written contract that protects Customer Personal Data at least as well as this DPA, to the extent that matters for the service it provides. We remain liable to you for our Subprocessors' performance of those obligations.

8. Requests From Individuals, and Other Assistance

Self-service tools. The Service lets you find, correct, export and delete most Customer Personal Data yourself. For example, you can edit or delete contributor records, export or delete author page signups, and decide on and remove submissions.
Requests that reach us. If someone asks us to access, correct, delete or otherwise exercise their rights over Customer Personal Data, we will not respond except to tell them to contact you. We will forward the request to you within five business days if we can identify you as the relevant customer. Where your tools are not enough, we will help you respond, taking into account the nature of the processing.
Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your security obligations, breach notifications, data protection impact assessments and consultations with supervisory authorities. Where that help goes beyond the documentation we already publish, we may charge reasonable fees for it.
Requests from authorities. If a government authority asks us for Customer Personal Data, we will try to redirect it to you. We will tell you about the request unless the law prohibits it, and we will disclose only what the law requires.

9. Security Incidents

If we become aware of a Security Incident, we will notify you without undue delay, and in any case within 48 hours. We will send the notice to your organization's administrators by email. To the extent we know it at the time, the notice will describe:

The nature of the incident, including the categories and approximate number of individuals and records concerned
Its likely consequences
The measures we have taken or propose to take, including measures to limit its effects
A contact who can give you more information

Where we cannot give all of this information at once, we will provide it in stages as we learn it. We will take reasonable steps to contain and investigate the incident and to prevent it from happening again. Notifying you of a Security Incident is not an admission of fault or liability.

10. Return and Deletion

While you use the Service, you can export Customer Personal Data with the Service's export features and delete it with its deletion features.
When the last member of your organization deletes their account, we delete the organization's records from our production database immediately, and its stored files shortly afterwards.
After the Terms end, if you ask us in writing within 30 days, we will help you export your data. Unless you have deleted it already, we will then delete Customer Personal Data from our production systems within 30 days of your request.
Backups and logs. Database backups expire on a rolling schedule, currently 7 days and never more than 35 days. Operational logs are also kept on a limited rolling retention. Until they expire, we keep both protected under Annex II and use them only to restore the Service after a failure. We do not restore deleted data from them for any other purpose.
Legal retention. We may keep Customer Personal Data longer only where the law requires us to, and only for as long as it requires. While we do, this DPA continues to apply to that data.

11. Information and Audits

We will make available the information you reasonably need to demonstrate that we comply with this DPA. That includes this DPA, its Annexes, our Subprocessor list, and written answers to a reasonable security questionnaire once a year. We do not currently hold a third-party security certification such as SOC 2 or ISO 27001. If we obtain one, we will provide the report on request, under confidentiality.

If that information is not enough to show our compliance, or if a supervisory authority or Data Protection Law requires it, you may audit our compliance with this DPA, or appoint an independent auditor bound by confidentiality to do so. Audits are limited to once in any 12 months unless a regulator requires more or a Security Incident affecting you has occurred. You must give at least 30 days' written notice, keep disruption to a minimum, and pay the cost of the audit. We will not give an auditor access to other customers' data.

12. International Transfers

We are based in the United States, and we and our Subprocessors process Customer Personal Data in the United States and the other locations listed at familiar.pub/subprocessors. We are not currently certified under the EU-U.S. Data Privacy Framework, so transfers to us rely on the following clauses, which are incorporated into this DPA by reference.

From the EEA: the SCCs. Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor. You are the data exporter and we are the data importer. The following options apply:
- Clause 7 (the docking clause) applies.
- In Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 7 of this DPA.
- The optional language in Clause 11 does not apply.
- In Clause 13, the competent supervisory authority is the one determined by Clause 13(a).
- Clause 17 is governed by the law of Ireland, and under Clause 18 disputes go to the courts of Ireland.
- Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.
From the United Kingdom: the SCCs as amended by the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0). Its Tables 1 to 3 are completed by Annex I and Annex II of this DPA, and in Table 4 neither party may end the Addendum under its Section 19.
From Switzerland: the SCCs, adapted so that the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP. References to a "Member State" include Switzerland, so that Swiss data subjects can bring claims in their place of habitual residence, and references to the GDPR include the FADP.

If any of these mechanisms is invalidated or replaced, we will work with you to rely on a lawful alternative. Where the SCCs conflict with this DPA or the Terms, the SCCs control.

13. U.S. State Privacy Laws

Where the CCPA or another U.S. state privacy law applies, we act as your service provider, contractor or processor. We process Customer Personal Data only for the limited and specified business purpose of providing the Service to you, as described in the Terms, this DPA and Annex I. We will not:

Sell or share Customer Personal Data
Retain, use or disclose it for any purpose other than that business purpose, including any commercial purpose, except as the CCPA and its regulations permit a service provider to do
Retain, use or disclose it outside our direct business relationship with you
Combine it with personal data we receive from or on behalf of anyone else, or collect from our own interactions with individuals, except as those laws permit

We will comply with the obligations those laws place on us, and we will give Customer Personal Data the level of privacy protection they require. If we determine that we can no longer meet these obligations, we will tell you. You may then take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data. You may also take reasonable steps, including those in Section 11, to make sure we use it consistently with your obligations. We pass these obligations on to our Subprocessors by written contract. We certify that we understand and will comply with the restrictions in this section.

14. Liability, Precedence and Changes

Liability. Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs do not allow those limitations, including any liability to data subjects under the SCCs.
Precedence. For the processing of Customer Personal Data, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms.
Duration. This DPA lasts for as long as we process Customer Personal Data, even after the Terms end.
Changes. We may update this DPA to reflect changes in law, guidance, or the Service. We will not make a change that materially reduces the protection of Customer Personal Data unless the law requires it. We will give at least 30 days' notice of any material change by email to your administrators, and an updated "Last updated" date marks every change.

Annex I: Details of Processing

A. The parties

Data exporter: the Customer, identified by the organization name, address and administrator contacts in its Familiar account. Its role is controller, or processor where Section 2.1 says so. Its activities are publishing and related activities, using the Service. Accepting the Terms counts as its signature, dated when it accepted.
Data importer: Infernal Moose Publishing, LLC (doing business as Familiar), Colorado, United States. Contact: privacy@infernalmoose.com. Its role is processor (or subprocessor), and its activities are providing the Service. It signs by publishing this DPA and providing the Service under it.

B. Categories of data subjects and personal data

Contributors (authors, illustrators, translators, estates and other rights holders): names, pen names, email addresses, postal addresses, countries, biographies and links, contract terms and signed contracts, advances, royalty rates, sales and earnings, royalty statements, payment records, payment details (bank account and routing numbers, IBAN, SWIFT and branch codes, PayPal or Venmo handles), tax identification numbers and their type, onboarding answers, and notes.
Literary agents who represent contributors: names, email addresses, agency details, and the statements and records shared with them.
Submitters to your submission windows: names, author names, email addresses, biographies and links, pitches, synopses, manuscripts and other materials, answers to your questions, payment status for submission fees, AI-detection results where you enable that feature, and your team's notes, scores, tags, decisions and correspondence.
Readers on your author pages: email addresses and names, signup and confirmation time, consent wording, referring site and campaign tags, the reader magnets and release reminders they asked for, unsubscribe status, contact-form messages, and ARC-team applications (name, email, review profile link, preferred formats, note). Page analytics record country, device type, referring site and campaign tags without identifying visitors.
ARC invitees and approved readers: email addresses you upload or enter, invitation status, your decisions on applications, reader identifiers embedded in watermarked files, download records, and review links verified for your campaign.
Shopify customers: email addresses, Shopify customer and order identifiers, the products bought, and download access records.
Contract signers: names, email addresses, signatures, and the signing audit trail.
Other individuals whose personal data appears in content you put into the Service, such as manuscripts, contracts, messages, tasks and files.

C. Sensitive data

The Service is not designed for special categories of personal data. Manuscripts and other content you upload may contain such data incidentally; it gets the protections in Annex II. Some U.S. state laws treat Social Security numbers and financial account numbers as sensitive, and the Service holds them only where you enter them for royalty payment and tax reporting. Tax identification numbers are encrypted at the field level, as Annex II describes.

D. Nature, purpose and duration

Nature of the processing: hosting, storage, organization, calculation (such as royalties), analysis (including the AI features you choose to run), transmission (email, file delivery, and connections you configure), electronic signature, retrieval, and deletion.
Purpose: providing, supporting and securing the Service for you under the Terms.
Frequency: continuous, for as long as you use the Service.
Duration and retention: the term of the Terms, plus the deletion periods in Section 10.
Transfers to Subprocessors: for the subject matter, nature and duration listed for each at familiar.pub/subprocessors.

Annex II: Technical and Organizational Security Measures

Encryption

Connections to the Service use TLS, and our servers accept web traffic only through Cloudflare's network.
File deliveries to distributors over SFTP verify each server against a pinned host key.
Our database and file storage are encrypted at rest by their providers.
Some fields are also encrypted inside our database with AES-256 authenticated encryption before they are stored: tax identification numbers, distributor session credentials captured by our browser extension, distribution delivery credentials, Shopify access tokens and buyer email addresses, and the API keys of email marketing providers you connect. Bank account and routing numbers are protected by storage encryption, but not by field-level encryption.

Access control

Every API request is authorized centrally against the user's organization membership and role before any data is returned.
Passwords are hashed with bcrypt.
Users can sign in with passkeys, and organizations can require passkeys for their members.
Repeated failed sign-ins are rate-limited, and account creation is protected by bot checks.
Sessions are stored server-side, and only a hash of each session identifier is kept.
Only designated staff accounts can open support sessions in a customer's account. Each support session is tied to the staff member who opened it.
Stored files are private, and downloads use short-lived signed links.

Operations

We run on managed infrastructure (Microsoft Azure and Cloudflare). The database has automated backups with point-in-time restore. Application logs and metrics are centralized, and alerts go to our engineering team.
Infrastructure secrets are kept out of source code, in managed secret stores.
Code changes are reviewed and pass automated tests before deployment, and third-party build actions are pinned to exact versions.

Privacy by design

Session replay never runs for visitors who aren't signed in, or for anyone in the EU, UK or Switzerland, unless they turn it on. Signed-in users elsewhere agree to it at signup and can turn it off. Replays mask passwords, financial and tax fields, and mailing addresses.
Text sent to our AI model provider is not used to train its models.
Deleting an organization queues deletion of its stored files in the same database transaction, so its files are cleaned up even if part of the process fails.

People

Staff with access to Customer Personal Data are bound by confidentiality obligations, and their access is limited to what their role requires.

Annex III: Subprocessors

Our current list of Subprocessors, with the service each provides, the data it processes and where it processes it, is at familiar.pub/subprocessors. Section 7 describes how we change that list.

Contact

Questions about this DPA, requests for a countersigned copy, and objections to Subprocessors go to privacy@infernalmoose.com. You can also write to Infernal Moose Publishing, LLC, doing business as Familiar, Colorado, United States.