Woltx Automation: Data Processing Agreement

Subject and duration

Processing of Instagram commenters' personal data to post replies, send messages, keep entry records and run winner draws, and of any personal data in content the customer schedules for publishing, for as long as the customer's workspace exists.

Data and people

Instagram usernames and ids, comment text and times, and delivery status, about people who comment on the customer's posts.

Our obligations

• Process only on the customer's documented instructions (the settings in their workspace).
• Make sure people with access are bound by confidentiality.
• Keep appropriate technical and organisational security measures in place.
• Use only the sub-processors listed below, and give 30 days' notice before adding one.
• Help the customer answer data subject requests and meet security, breach and impact-assessment duties.
• Tell the customer of a personal data breach without undue delay, and within 72 hours of becoming aware of it.
• Delete or return the data when the workspace is deleted, except where the law requires us to keep it.
• Make available the information needed to show compliance, and allow reasonable audits.

Sub-processors

• Supabase (database and sign-in), data stored in Tokyo, Japan
• Vercel (hosting and serverless functions), Tokyo region
• Meta Platforms (Instagram API: comments, replies, messages and publishing your posts)
• Cloudflare R2 (storage for photos and videos you schedule, deleted a day after they are posted)
• Stripe (payments and invoices; we never see full card numbers)
• Resend (account and alert emails)

Transfers

Where data leaves the customer's jurisdiction, transfers rely on the appropriate safeguards, such as standard contractual clauses.