Back to home
Legal

Data Processing Agreement

Last updated: October 5, 2026

This Data Processing Agreement ("DPA") supplements the Terms of Use between AutoPostr ("AutoPostr", "we") and the customer using the service ("Customer"). It applies automatically to the extent AutoPostr processes Customer Personal Data on the Customer's behalf and the GDPR, the UK GDPR, the Swiss FADP, or the CCPA/CPRA applies. A countersigned copy is available on request at privacy@autopostr.app.

1. Roles

For personal data contained in content, briefs, media, and connected-account data that the Customer submits or that we retrieve on the Customer's instruction (such as comments or direct messages from a connected Instagram account) ("Customer Personal Data"), the Customer is the controller (or processor for its own clients) and AutoPostr is the processor (or sub-processor). For account, billing, security, and product usage data about the Customer's own users, AutoPostr is an independent controller as described in our Privacy Policy and GDPR notice; this DPA does not apply to that processing.

2. Details of processing

  • Subject matter and purpose: providing the AutoPostr service — researching, drafting, critiquing, generating media for, scheduling, and publishing content, and showing performance analytics.
  • Duration: the term of the Customer's account plus the deletion period in section 9.
  • Data subjects: the Customer's authorized users; people named, depicted, or quoted in content the Customer provides; and people whose comments or messages arrive via connected accounts.
  • Categories of data: names, handles, email addresses, voice and image likeness in uploaded media, message and comment text, and any other personal data the Customer chooses to include. The service is not intended for special-category data (Art. 9) or criminal-offence data, and the Customer should not submit it.
  • Nature of processing: storage, transmission, transformation by AI models (text, image, audio, and video generation, transcription, and embeddings), and delivery to the third-party platforms the Customer connects.

3. Our obligations

AutoPostr will:

  • process Customer Personal Data only on the Customer's documented instructions — the Terms, this DPA, and the Customer's use of the service's features — unless required by law (in which case we will inform the Customer unless the law forbids it);
  • ensure personnel authorized to process it are bound by confidentiality;
  • implement the security measures in section 5;
  • not sell Customer Personal Data or use it for advertising, and not retain, use, or disclose it outside the direct business relationship (CCPA service-provider terms);
  • not use Customer Personal Data to train AI models, and use AI providers only through their API/business offerings; we do not opt customer content into provider model training;
  • tell the Customer if we believe an instruction infringes data-protection law.

4. Sub-processors

The Customer gives general authorization for the sub-processors listed at autopostr.app/subprocessors. We impose data-protection obligations on each that are no less protective than this DPA and remain responsible for their performance. We will give 30 days' notice of new sub-processors, and the Customer may object as described on that page.

5. Security measures

  • Encryption in transit: HTTPS/TLS for the web app, API, and provider connections.
  • Encryption of credentials at rest: platform OAuth tokens and customer-supplied AI API keys are stored encrypted (Fernet / AES-based authenticated encryption) with a key held outside the database; passwords are handled by Supabase Auth and stored hashed, never in plaintext.
  • Access control: authenticated, per-user data scoping; a separate administrator role; and an append-only audit log of administrator actions such as suspending users or changing cost caps.
  • Isolation and least privilege: production secrets live in the hosting provider's secret store, not in source code; third-party calls are made server-side so provider keys are never exposed to browsers.
  • Data minimization: pipeline run events are automatically purged after 30 days; trend data is pruned on a schedule; AI providers receive only what is needed for the request.
  • Resilience: managed, backed-up PostgreSQL; background jobs are retried and monitored with automatic failure alerts.
  • Review: we review this list, our sub-processors, and access rights at least quarterly.

6. Security incidents

We will notify the Customer without undue delay, and aim to do so within 72 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, with the information reasonably available to help the Customer meet its own notification obligations, and will take reasonable steps to contain and remediate it.

7. Assistance

Taking into account the nature of the processing, we will reasonably help the Customer to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection), carry out data-protection impact assessments, and consult regulators. Requests we receive directly about Customer Personal Data will be forwarded to the Customer rather than answered, unless the law requires otherwise. Reasonable assistance is included; we may charge for unusually burdensome requests.

8. International transfers

Our primary database is in the United Kingdom, and our application hosting and several sub-processors are in the United States (see the sub-processor list). Where Customer Personal Data from the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, the parties incorporate by reference the EU Standard Contractual Clauses (Commission Decision 2021/914) — Module Two (controller to processor) or Module Three (processor to processor) — and, for UK transfers, the UK International Data Transfer Addendum, with the details in sections 1 to 5 and the sub-processor list serving as their annexes. Our sub-processors are bound by equivalent clauses or rely on an adequacy mechanism such as the EU–US Data Privacy Framework where certified.

9. Return and deletion

The Customer can export or delete content and disconnect platforms at any time in the app. When an account is deleted, we pause all activity, revoke stored platform tokens where the platform allows it, and permanently delete the account and its content after a 30-day recovery period, after which backups roll off in the normal course. We may retain data where law requires (for example, tax and billing records) and will keep it protected and use it only for that purpose.

10. Audits and information

On reasonable written request, we will provide information necessary to demonstrate compliance with this DPA — including our security measures and sub-processor list — and allow for audits by the Customer or its appointed auditor, no more than once a year (or after a breach), with reasonable notice, during business hours, without access to other customers' data, and subject to confidentiality. Where available, we may satisfy audit requests with sub-processor certifications and reports.

11. Customer responsibilities

The Customer is responsible for having a lawful basis and any required notices and consents for the personal data it submits (including likeness, voice, and the data of people in its content), for configuring publishing and approval settings, for reviewing AI output before publishing, and for not submitting special-category data. AI output may be inaccurate; the Customer remains responsible for what it publishes.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent permitted by law and without limiting the Standard Contractual Clauses. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

13. Contact

Data-protection questions and requests: privacy@autopostr.app.