Data Processing Agreement

1. Roles

You are the controller of the personal data we process for you. We are the processor. We process it only to provide and support the Service, and only on your instructions - your use of the Service and this DPA are those instructions.

If you are an agency using the Service for your own clients, you are their processor and we are your sub-processor. You confirm you have your clients' authority to appoint us, and you remain responsible to them for our performance.

2. What we process

The data subjects are your team, your agency clients, and the Instagram users you contact or who contact you. We process the following categories of personal data for as long as your agreement runs, plus the deletion period in section 7.

We do not ask for special category data. Please do not record it in free-text fields.

3. How the Service works

Outreach messages are sent from your own browser, using your own logged-in Instagram session, by a browser extension running on your device. We never receive or store Instagram passwords, and outreach is not sent from our servers.

Where Meta's official Instagram API is available - inbox sync, reading and sending replies - we use it under your own authorization, which you can revoke at any time directly with Meta.

The browser extension is not a sub-processor. It is software you run on your own machine, not a third party we send your data to.

4. Security

We keep appropriate technical and organizational measures in place and review them periodically. We may change them, provided protection is not reduced. Currently:

• Data is encrypted in transit and at rest. Instagram access tokens are additionally encrypted at the application layer before storage.
• We never receive Instagram passwords.
• Customer data is isolated at the database level, so one customer's data cannot be read by another.
• Access to production data is limited to personnel who need it, and administrative functions sit behind a separate restricted login.
• Databases are backed up automatically with point-in-time recovery.
• All changes are version controlled, reviewed, and tested before release.

Everyone we authorize to process your data is bound by confidentiality.

5. Sub-processors

You authorize us to use the sub-processors below.

We will give you reasonable notice before adding or replacing a sub-processor, by email or by updating this page. If you object on reasonable data protection grounds, we will discuss it with you in good faith and look for a workable alternative. If there is not one, either of us may terminate the affected part of the Service. We bind every sub-processor to obligations no less protective than these, and remain responsible to you for their performance.

6. Your obligations and our assistance

You are responsible for having a lawful basis for the outreach you send, for honoring opt-outs, and for complying with Instagram's own terms.

We will help you, so far as is reasonable and possible given the nature of the Service, with data subject requests, impact assessments, and consultations with a supervisory authority. If a data subject contacts us directly, we will point them to you and pass the request on.

7. Deletion

When your agreement ends we will delete your data, or return it if you ask, within 90 days. Backups age out on our ordinary cycle. We may keep data where the law requires it, and will keep it confidential and use it for nothing else. You can export or delete your data yourself at any time while your account is active - see Data Deletion.

8. Breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and give you what we know: what happened, roughly who and what is affected, the likely consequences, and what we are doing about it. Where we cannot give you everything at once, we will follow up as we learn more.

9. International transfers

As the table in section 5 shows, some of our sub-processors operate outside the UK and EEA. Those transfers are made under the European Commission's Standard Contractual Clauses and, where the UK GDPR applies, the UK International Data Transfer Addendum. Both are incorporated into this DPA by reference.

10. Audit and information

We will give you the information you reasonably need to demonstrate compliance, including our security documentation. Where that answers your questions, it satisfies this section.

If a supervisory authority requires an on-site audit, or you reasonably need one, we will cooperate: no more than once a year, on 30 days' notice, during business hours, subject to confidentiality, and at your cost unless the audit finds a material breach.

11. General

This DPA forms part of your agreement with us and prevails over it on anything concerning personal data. Liability under this DPA is subject to the limits in that agreement. Questions can be sent to johnny@nousify.ai.