Data processing agreement

Subject matter: running AnyPoster for you. Data: messages, comments, names, usernames, profile pictures and platform IDs of people who contact your connected accounts, any notes and tags you add, and the content you publish. Purpose: only to provide the service as you instruct through it. Duration: while you use the service, then deletion as below.

• We process the data only on your documented instructions (your use of the service and its settings), unless the law requires otherwise, in which case we tell you first where allowed.
• Everyone who can access it is bound by confidentiality.
• Security: encryption in transit, encrypted storage of platform logins, access limited by workspace and role, an audit log of administrative access.
• We help you answer requests from the people concerned (export and deletion are built in) and with security and impact assessments.
• We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
• At the end, the data is deleted 14 days after you delete the workspace (you can export it first); backups roll over within 30 days.
• We make available what's needed to show we meet these obligations, and allow audits on reasonable notice, at most once a year.

The current list, with the data each one handles, is also on the subprocessors page. You authorise these subprocessors. We tell workspace owners by email at least 30 days before adding or replacing one, and you may object; if we can't resolve it, you may end the service.

• Vercel Inc.: Hosting the app and storing uploaded media (United States / European Union)
• Neon Inc.: Database (United States / European Union)
• Upstash Inc.: Scheduling queue (when a post goes out) (United States / European Union)
• Anthropic PBC: AI writing help and suggested replies, when used (United States)
• Stripe Inc.: Payments and invoices (United States / Ireland)
• Resend Inc.: Sign-in links, invitations and report emails (United States)
• Serper: Checking whether published pages appear in Google (page addresses only) (United States)

Where data leaves the European Economic Area, the transfer relies on an adequacy decision, the EU–US Data Privacy Framework where the subprocessor is certified, or the European Commission's Standard Contractual Clauses. Where we ourselves transfer your data to a country without an adequacy decision, the Standard Contractual Clauses (Module Two, controller to processor) are incorporated into this agreement, with the options chosen as follows: optional docking clause not used; general authorisation of subprocessors with 30 days' notice; Spanish law (or the law named in the terms) and its courts; and the competent supervisory authority is the one for your establishment. For data covered by UK law, the UK International Data Transfer Addendum applies in the same way.

We help you answer requests from the people concerned (the inbox has tools to export and delete one person's conversation), carry out data protection impact assessments and consult authorities, and keep personal data secure, taking into account the nature of the processing and the information we have. If a person writes to us directly about data we process for you, we pass it to you and do not answer it ourselves unless the law requires.

Your instructions are the settings you choose and the actions you take in the service. When you switch on AI features, you instruct us to send the text needed for the task to the AI subprocessor (Anthropic), which may not use it to train its models. We tell you if we believe an instruction infringes data protection law.

Having a lawful basis to process the personal data you put into the service, giving the people concerned the information the law requires (including that they are talking to an automated system, where applicable), and not sending special-category data without a lawful need.

Each party's liability under this agreement is subject to the limits in the terms of service, except that nothing limits liability that cannot be limited by law or under the Standard Contractual Clauses. If this agreement conflicts with the terms about the processing of personal data, this agreement prevails. If it conflicts with the Standard Contractual Clauses, the clauses prevail.

the operator of this service, calle montano 4, 29012, Malaga, Spain. info@builtwithskills.com