Data Processing Agreement

1. Scope and Roles

This Data Processing Agreement (the "DPA") applies where a customer usesFoPost to process personal data for which that customer is the controller, for example the audience and client data behind the accounts it connects. It forms part of, and is governed by, the Terms of Service.

The customer is the controller. Porter Bridge, LLC, a Delaware limited liability company at 131 Continental Dr, Suite 305, Newark, DE 19713, United States, operatingFoPost, is the processor. Porter Bridge, LLC is a separate and independent controller for its own account, billing, support and service-security records, which this DPA does not cover; those are described in the Privacy Policy.

A counterpart of this DPA for signature, incorporating the European Commission's Standard Contractual Clauses and the UK Addendum, is available on request through our contact form. The terms are the same as those published here.

2. Subject Matter and Nature of Processing

Required by Art. 28(3). The details of the processing carried out under this DPA:

3. Instructions

We process personal data only on the customer's documented instructions, which comprise the Terms of Service, this DPA, the configuration the customer sets in the product, and the actions the customer takes through the dashboard, API, SDKs or MCP server. Using a feature is an instruction to carry out the processing that feature performs.

Where the law requires us to process for another purpose, we tell the customer before doing so unless the law prohibits that notice. We tell the customer if, in our opinion, an instruction infringes applicable data protection law.

We do not sell personal data, do not share it with advertising networks or data brokers, and do not use customer content to train AI models without explicit opt-in.

4. Confidentiality and Security

Everyone authorised to process personal data under this DPA is bound by an obligation of confidentiality that survives the end of their engagement.

Under Art. 32 we maintain technical and organisational measures appropriate to the risk, including industry-standard encryption of data in transit and at rest, encrypted storage of connected-account credentials, role-based access control, separation of customer data by workspace, and regular dependency and vulnerability review. A description of the measures in force is available to customers on request. We do not publish implementation detail, because that detail is useful to an attacker and to nobody else.

5. Subprocessors

The customer gives general authorisation for us to engage subprocessors. Each is bound by written terms no less protective than this DPA, may process personal data only on our documented instructions, and remains our responsibility.

We engage subprocessors in the following categories: cloud infrastructure, payment processing, transactional email, AI processing, error monitoring, and product analytics. Their purposes and processing locations are set out on our GDPR page.

We maintain a current list naming each individual subprocessor. Customers can obtain it through our contact form, and it forms part of this DPA. We give notice of an intended addition or replacement before it takes effect, and the customer may object on reasonable data protection grounds; if we cannot accommodate the objection, the customer may terminate the affected part of the Service.

6. Connected Views and Derived Signal

A connected account can see content on its platform that is not the customer's own: replies, comments and mentions from other people, and the public posts of accounts the customer asks us to track. We call this the customer's connected view. It is read through each platform's official interfaces, under the authorisation the customer gave when connecting the account, and only for accounts the customer connected or named.

6.1 What we may derive

We may derive aggregate and derived signal from a connected view: counts, scores, benchmarks and trend statistics describing patterns rather than individual items. We use that signal to provide and improve the Service, including the analytics, timing and benchmarking features the customer sees in its own workspace.

6.2 What is never disclosed

The contents of a connected view are never disclosed to another customer, in any form. This covers the text of posts, comments, replies and messages, the identity of the people appearing in the view, direct messages, follower and audience lists, and anything from which those could be reconstructed. No anonymisation is treated as making those contents shareable: text is identifiable on its face.

6.3 The aggregation condition

A statistic derived from a customer's connected view is released outside that customer's workspace only once it covers enough distinct sources and enough distinct customers that no single item, account or customer can be recovered from it. A statistic that does not meet that condition is withheld rather than published. This is enforced by the product itself, not left to operational judgement.

6.4 The customer's own responsibility

The customer warrants that it is authorised to connect the accounts it connects, that it has a lawful basis for the connected-view processing it instructs, and that what it asks us to track is permitted by the relevant platform's terms. We carry out no unauthenticated collection and no scraping.

7. Data Subject Requests

Taking into account the nature of the processing, we assist the customer with appropriate technical and organisational measures in meeting its obligations to respond to requests under Chapter III, and with its obligations under Art. 32 to 36, including data protection impact assessments and prior consultation.

Most requests can be satisfied by the customer directly in the dashboard: exporting its data, correcting records, disconnecting an account, or deleting a workspace. If a data subject contacts us directly about data we process for a customer, we do not respond substantively; we refer them to that customer and, where we can identify it, tell the customer.

8. Personal Data Breach

We notify the customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, and provide the information the customer reasonably needs to meet its own obligations under Art. 33 and 34: what happened, the categories and approximate volume of data and data subjects involved, the likely consequences, and the measures taken or proposed.

9. International Transfers

Personal data processed under this DPA may be transferred to and processed in the United States and other countries. Where personal data of individuals in the EU, EEA or UK is transferred outside those areas, we rely on the European Commission's 2021 Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum, together with the supplementary measures described on our GDPR page. Where a subprocessor is certified under the EU-US Data Privacy Framework, we may rely on that certification instead.

10. Deletion and Return

At the customer's choice, we delete or return the personal data processed under this DPA at the end of the Service, and delete existing copies unless the law requires us to keep them. Data the customer can export at any time from the dashboard and API satisfies the return obligation.

Specific paths:

• Connected-account credentials: revoked with the platform and deleted immediately on disconnection or account deletion
• Connected-view records: deleted when the account they were read through is disconnected, when the workspace holding them is deleted, or when closing an account leaves that workspace with no members
• Account and content data: deleted within 30 days of account deletion
• Billing and tax records: retained for 7 years, as tax and accounting law requires

One exception, stated plainly. Aggregate statistics that already cover enough distinct sources and customers that no single item, account or customer can be recovered from them may be retained after deletion. At that point they are no longer personal data and no longer describe the customer, which is the same basis on which the Privacy Policy retains aggregated, anonymised data. Anything that does not meet that condition was never released outside the workspace and is deleted with it.

Content the customer has already published to a third-party platform lives on that platform and is not affected by deletion here.

11. Audit and Information

We make available the information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by the customer or an auditor it mandates. Audits are on reasonable notice, no more than once in any twelve months except where a supervisory authority requires otherwise or following a personal data breach, during business hours, subject to confidentiality, and conducted so as not to disrupt the Service or the security of other customers.

12. Term and Precedence

This DPA takes effect when the customer begins using the Service to process personal data for which it is the controller, and continues while that processing does. In the event of a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service, in each case as to the processing of personal data covered here.

We may update this DPA to reflect changes in the Service or in applicable law. Material changes are reflected in the "Last updated" date above, and where they reduce a customer's protection we give notice before they take effect.

13. Signature and Contact

To request a signed counterpart, the named subprocessor list, or a description of our security measures, reach us through the contact form: