SocialMediaIQAll networks publishing
Sign in

Data processing agreement

A customer is the controller of the personal data they put into the service and of the personal data about other people that reaches it through the service. The operator of this deployment is the processor.

This page is generated from the running deployment, so it changes when the service does.
This is an engineering draft. Counsel has not reviewed it and it is not the executed document, so the clause wording below is not final and is not binding. Everything stated as a fact is generated from what the service actually enforces and is accurate today.

1. Roles under each regime

UK and EU GDPR: the customer is the controller, the operator is the processor under Article 28.CPRA: the operator is a service provider, and does not sell or share personal information.India DPDP Act: the customer is the Data Fiduciary, the operator is the Data Processor.

2. Clause sets carried

UK GDPR Art. 28CPRA service providerDPDP processor

3. The annex is generated

Categories of data subject and categories of personal data are not restated in the agreement. They are generated from the schema and published as the data map, which is the annex — so the agreement cannot fall out of step with the system it describes.

Privacy notice

Sub-processors and transfers

Every company that processes personal data for this deployment, where it processes it, and under what transfer mechanism.

CompanyWhat forWhereTransfer mechanism
Amazon Web ServicesHosting, database, object storage, queues and logseu-west-2No transfer: processing stays in the deployment’s own region
AnthropicAI providerZero retentionAI assist: captions, rewrites, replies and narratives (M29)us-east-1 (United States)UK–US Data Bridge (DPF certification)
StripePayments, invoices and tax identifiers (M15)Ireland and United StatesUK Addendum to the EU SCCs
AyrshareAggregatorAggregator fallback for networks pending direct app review (M1.14)us-east-1 (United States)UK Addendum to the EU SCCs
SentryClient error reporting; personal data is redacted before send (C3)GermanyUK Addendum to the EU SCCs

Changes are notified 30 days before they take effect.

4. Signing it

The agreement is offered at sign-up and can be signed from the account at any time. A signed copy records its version, who signed it, their title, the time, and a hash of the exact document text.

5. Where your data is held

This deployment stores data in eu-west-2. The region is chosen when a deployment is created and never changes, because there is no cross-region replication of content to move.

6. Who to contact

What counsel still has to supply

These clause groups are named rather than drafted. An engineering draft of contract language is worth less than an honest gap, so the gap is listed.

  • Counsel review of the full agreement, and which clauses are non-negotiable across white-label deployments operated by separate legal entities
  • The standard contractual clauses annexes for each transfer route