Data Processing Addendum

This addendum (“DPA”) is part of the Terms of Service between the account holder (“you”, the controller) and Programmable, LLC (“we”, the processor). It applies to personal data we process for you in providing Programmable Social (“Customer Personal Data”). If it conflicts with the Terms, this DPA wins for that data.

1. Details of the processing

• Subject matter and purpose: keeping your conversations and contacts on LinkedIn, Reddit, X, Instagram and TikTok (the platforms), drafting replies, comments and first messages on your AI provider, approval, the do-not-contact list, follow-up sequences, discovery (Scout), meeting briefs, exports, and the webhooks and HubSpot delivery you turn on. We do not send messages or comments on any platform: your team's extensions do, in their own browsers.
• Duration: while you use the Service, then until deletion under section 9.
• Data subjects: people your team talks to on the platforms, people you import or add, people Scout finds for you, and your senders and team.
• Categories of data: names, headlines, companies, handles, profile, conversation and post addresses on the platforms; the text of captured conversations and when each message was sent; optional screenshots of captured messages (kept 30 days); drafts and what was sent; meetings and their briefs; public post excerpts found by Scout; senders' profile PDFs and voice descriptions; and records of the extension's runs and the platforms' warnings. You agree not to collect special categories of data, government identifiers, payment card details or passwords through the Service.

2. Your instructions

We process Customer Personal Data only on your documented instructions: these Terms, this DPA, and what you set up and do in the Service. That includes transfers to the services you connect (your AI provider, programmable.info, your webhook endpoint, HubSpot), which you instruct by connecting them: your AI provider receives the context of each draft (the workspace, the sender's profile, the contact and the conversation), on your key. We will tell you if we think an instruction breaks data protection law, unless the law forbids us to. If the law requires us to process data otherwise, we will tell you first unless it forbids that.

3. Confidentiality

Everyone we allow to process Customer Personal Data is bound by confidentiality, and has access only as far as their work needs.

4. Security

We keep appropriate technical and organisational measures, including:

• encryption in transit (TLS) on every connection, and encryption at rest for AI keys, connected services' keys, webhook addresses and secrets, which are never written to logs; extension, API and invitation keys stored only as hashes;
• separation between accounts in every query, with access by role inside a team (owner, approver, editor, viewer), and each extension key tied to one person;
• no sending from the Service: every send switch starts off, drafts start pending, and the do-not-contact check refuses to send when it can't be made;
• outbound requests to addresses you give us (webhooks) checked against private and reserved networks;
• production access limited to the people who run the Service;
• rate limits on sign-in and keys, caps on autopilot and Scout kept in the database; signed webhooks;
• daily backups, the off-site copy encrypted, kept for 14 days;
• software kept up to date, and changes reviewed and tested before release.

We may improve these measures over time, but won't reduce the overall protection.

5. Subprocessors

You authorise us to use the subprocessors below. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for them. We will tell account owners by email, and in the dashboard, at least 14 days before adding or replacing one, and list the change below until it takes effect. You may object on reasonable data protection grounds within that time; if we can't resolve it, you may end the affected part of the Service.

programmable.info is operated by us. Stripe, which bills accounts for paid plans, is not a subprocessor either: it handles only account holders' own billing details, never contacts' data, and we use it as controller under our Privacy Policy. The services you connect yourself (your AI provider, your webhook endpoint, HubSpot) are not our subprocessors: you choose them, on your own keys and under your own agreements with them. Nor are the platforms: the Service sends them nothing; your team's extensions use them as they do.

6. Helping you

• Requests from people: the Service lets you export and delete contacts and their conversations, and add people to the do-not-contact list. If a person writes to us directly about your account, we pass it to you without undue delay and don't answer it ourselves, unless you ask us to; but if they object to being contacted, we add them to the do-not-contact list at once.
• Assessments and consultations: we give you the information you reasonably need for data protection impact assessments and consultations with authorities about the Service.

7. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with what we know (what happened, the data and people likely affected, the likely consequences, and what we are doing), and keep you updated. We will help you meet your own duties to notify authorities and people.

8. Transfers

We and our subprocessors process data in the United States. Where the GDPR, the UK GDPR or Swiss law applies to a transfer, the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor) are incorporated into this DPA, with the UK International Data Transfer Addendum for UK transfers, and adapted for Swiss transfers as the Swiss authority requires. For the Clauses: clause 7 (docking) applies; clause 9 option 2 (general authorisation, with the notice in section 5); clause 11's optional language does not apply; clauses 17 and 18 are governed by and brought before the courts of Ireland; Annex I is section 1 of this DPA with you as data exporter and us as data importer; Annex II is section 4; Annex III is section 5.

9. Deleting or returning data

You can export and delete Customer Personal Data at any time. When your account ends, we delete it 30 days later, and it leaves our backups within the following 15 days, unless the law requires us to keep it. Some records are deleted sooner, as the Privacy Policy describes (screenshots after 30 days, webhook deliveries after 30 days, extension runs and safety events after 180 days, email records after 13 months). Do-not-contact entries you added are the exception: they are kept, without any link to your account, so the people on them are never contacted through the Service again. We keep only what identifies the profile and the reason, and use it for nothing else.

10. Showing we comply

We give you the information reasonably needed to show we meet this DPA, and answer your reasonable written questions about it. If that isn't enough, or an authority requires it, you may have us audited, at most once a year (unless after a breach), with 30 days' notice, during working hours, by an auditor bound by confidentiality, at your cost.

11. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we act as your service provider (or processor). We will not sell or share Customer Personal Data, nor retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; nor combine it with personal data from elsewhere, except as those laws allow. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorised use.

12. Liability and order

Each side's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or the law don't allow it. If this DPA and the Clauses conflict, the Clauses win.