Data Processing Agreement (DPA)

1 Subject matter and duration

2 Nature, purpose, and scope of processing

In short: ZenFeed processes personal data solely to provide automated comment moderation — analysing comment content for toxicity/hate speech and carrying out the action you've configured (removing or hiding a comment). Details:

3 Your responsibilities as Administrator

4 ZenFeed's obligations as Processor

• check_circle Processes personal data only on your documented instructions — in practice, the moderation settings you configure yourself (sensitivity threshold, remove/hide action, connected pages) — unless required otherwise by EU or Member State law, in which case we'll inform you of that requirement first, where the law permits.
• check_circle Ensures that anyone authorised to process personal data on our side is bound by confidentiality.
• check_circle Implements the technical and organisational measures described in Section 7 (GDPR Art. 32).
• check_circle Only uses sub-processors under the conditions set out in Section 5.
• check_circle Helps you, to the extent reasonably possible, respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection).
• check_circle Helps you meet your obligations around processing security, breach notification (GDPR Art. 33-34), and, where relevant, data protection impact assessments (Art. 35-36), taking into account the nature of the processing and the information available to us.
• check_circle Notifies you of a personal data breach without undue delay, and no later than 72 hours after becoming aware of it.
• check_circle Deletes or returns all personal data to you once the relevant services end, and deletes existing copies, unless EU or Member State law requires us to keep it — in line with the retention policy in Section 2.
• check_circle Makes available all information reasonably necessary to demonstrate compliance with Art. 28 GDPR, and allows for audits, including inspections, on terms agreed separately (scope, form, cost, and frequency no more than once a year, unless prompted by a supervisory authority's recommendation or an actual incident).

5 Sub-processors

You give ZenFeed general authorisation to use the sub-processors listed below to provide the Service. We'll notify you of any intended changes — adding or replacing a sub-processor — with reasonable advance notice, giving you 30 days from that notice to object.

Every sub-processor is bound by the same data protection obligations as ZenFeed under this agreement, and ZenFeed remains fully responsible to you for their performance.

6 Transfers outside the EEA

7 Technical and organisational measures

• check_circle Facebook access tokens are stored encrypted with AES-256-GCM (ciphertext, initialisation vector, and authentication tag stored separately).
• check_circle Hosting infrastructure (Hetzner) and the AI model (Google Vertex AI, region europe-west4) run entirely within the EU — data doesn't leave the EEA in the standard processing flow.
• check_circle Raw comment text is automatically deleted after 30 days; only anonymised aggregate data is retained beyond that.
• check_circle Access to production systems is limited to authorised personnel.

8 Liability