Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between PostEngine AI Solutions ("Processor", "we", "us") and the customer who has accepted the PostEngine Terms of Service ("Controller", "you"). This DPA supplements and forms part of the Terms of Service.

2. Subject Matter & Duration

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the PostEngine platform. Processing will continue for the duration of the service agreement and will cease upon account termination, subject to applicable data retention obligations.

3. Nature & Purpose of Processing

The Processor processes personal data solely to provide the PostEngine service, which includes:

• Authenticating users via LinkedIn OAuth (OpenID Connect)
• Storing and displaying LinkedIn profile information within the platform
• Publishing content to LinkedIn via the LinkedIn API on the Controller's authorization — approval of the individual post, or the standing instruction given by enabling Auto Publish
• Generating AI-assisted content drafts using third-party AI providers
• Collecting and displaying content analytics and engagement metrics
• Sending service notifications related to account activity

4. Categories of Data Subjects

Data subjects include:

• Registered users of the PostEngine platform
• LinkedIn account holders whose profiles are connected to PostEngine

5. Types of Personal Data

The following categories of personal data are processed:

• Identity data: name, email address, LinkedIn profile URL, profile picture URL
• Authentication data: OAuth access tokens and refresh tokens (encrypted at rest with AES-256-GCM)
• Content data: drafts, ideas, brand voice settings, publishing preferences
• Analytics data: post impressions, reactions, comments, follower metrics
• Usage data: anonymized feature usage patterns, application performance data

6. Sub-Processors

The Processor engages the following sub-processors to provide the service. The Controller consents to the use of these sub-processors:

We will notify the Controller at least 14 days before engaging a new sub-processor. The Controller may object in writing within that period.

7. Security Measures

The Processor implements the following technical and organizational measures to protect personal data:

• All LinkedIn access tokens and refresh tokens are encrypted at rest using AES-256-GCM with unique initialization vectors
• All data in transit is protected with TLS 1.2 or higher
• Database access is restricted to application service accounts with least-privilege permissions
• Authentication uses secure, httpOnly, SameSite session cookies
• Security response headers are applied to all routes (HSTS, CSP, X-Frame-Options, Referrer-Policy)
• Audit logging records sign-in and two-factor authentication events, draft approval and rejection, publishing, changes to Publishing Mode and changes to auto-reply settings, auto-sent replies and every attempt to stop one, LinkedIn connection and disconnection, workspace and team changes, and billing — each with the user or system actor that performed it, the time it happened, and the action type, in a chained log where no row can be altered without that showing
• SOC 2 Type II certification is on the product roadmap

8. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights requests, including:

• Right of access — providing a copy of personal data held
• Right to rectification — correcting inaccurate data
• Right to erasure — deleting account and all associated data
• Right to data portability — exporting data in a standard format
• Right to restrict processing — limiting data use upon request

Requests should be directed to [email protected] and will be acknowledged within 72 hours and fulfilled within 30 days.

9. Data Breach Notification

In the event of a personal data breach, the Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include:

• The nature of the breach, including categories and approximate number of data subjects affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects
• Contact details for the Processor's privacy contact

10. Return & Deletion of Data

Upon termination of the service agreement, the Processor will:

• Delete all personal data within 30 days of account deletion or service termination
• Revoke all LinkedIn OAuth tokens at LinkedIn's revocation endpoint
• Clear all cached data from Redis and temporary storage
• Retain only aggregated, anonymized data that cannot identify individuals

Data required by law to be retained (such as financial transaction records) will be kept for the legally mandated period and then securely deleted.

11. Governing Law

This DPA is governed by the same laws that govern the Terms of Service. In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.

12. Contact

For questions about this Data Processing Agreement or data protection matters, contact us at [email protected].