Data processing agreement

This Data Processing Agreement ("DPA") is part of our Terms of Service and applies automatically to every customer. It consists of the Key Terms on this page, Annexes I to III below, the US State Privacy Addendum below, and the Common Paper DPA Standard Terms Version 1.1 at https://commonpaper.com/standards/data-processing-agreement/1.1/ ("DPA Standard Terms"), incorporated by reference. This page controls over the DPA Standard Terms if they conflict. Customers who need a countersigned copy can ask at support@senti.now. The DPA Standard Terms are by Common Paper, Inc., used under CC BY 4.0.

• Agreement: our Terms of Service, or a signed order form for the account.
• Approved Subprocessors: the categories and locations in Annex III. Names are given to the customer on request. We notify customers by email at least 30 days before adding or replacing a subprocessor; the customer may object as the DPA Standard Terms provide.
• Provider Security Contact: support@senti.now, 8 The Green, Suite R, Dover, Delaware 19901, USA.
• Security Policy: the measures in Annex II.
• DPA Covered Claim, DPA Liability Cap: none; the Agreement's limits apply.
• Governing Law and Chosen Courts: as in the Agreement (Delaware), except where the Standard Contractual Clauses require otherwise.
• Service Provider Relationship: applies (California Consumer Privacy Act service provider terms of the DPA Standard Terms), together with the US State Privacy Addendum.
• Restricted Transfers: Governing Member State for EEA transfers: Ireland. UK transfers: England and Wales.
• Public posts: the public posts and author details in reports are collected and stored by Provider as an independent controller under its Privacy Policy. They are not Customer Personal Data under this DPA.

A. Parties

• Data exporter: the Customer named in the account (name and email of the account owner; address on request). Role: controller (or processor for its own clients, when an agency).
• Data importer: Voy Travel Inc., 8 The Green, Suite R, Dover, Delaware 19901, USA; contact support@senti.now. Activities: providing Senti. Role: processor.

B. Processing

• Service: Senti.
• Categories of data subjects: Customer's users and teammates; people the Customer invites; public figures the Customer adds for analysis.
• Categories of personal data: names and email addresses; account, team and invite records; user activity in the service (reports, settings, alert rules, review answers, label corrections); API key fingerprints and webhook endpoint addresses and delivery logs; agency logo and "Prepared by" line; names of public figures added for analysis.
• Special category data: none.
• Frequency of transfer: continuous.
• Nature and purpose: receiving, holding, using, protecting, returning and erasing data to provide the service under the Agreement.
• Duration: as in the DPA Standard Terms (the Agreement's term, then deletion).

C. Competent supervisory authority

As in the DPA Standard Terms.

1. Encryption: TLS for all traffic; data at rest encrypted by the database and hosting providers.
2. Confidentiality and integrity: row-level security on every customer table; provider keys and the service role key only on the server; API keys stored as fingerprints; signed webhooks.
3. Availability and restore: daily database backups kept 7 days; a documented restore drill into staging.
4. Testing: automated unit and end-to-end tests and CI on every change; external uptime check every 10 minutes.
5. Identification and authorization: one-time email sign-in links or Google; admin rights stored as a database role; bot check on sign-in.
6. Data in transit: HTTPS only.
7. Data at rest: provider-managed encryption.
8. Physical security: provided by our hosting and database providers' data centers.
9. Logging: error monitoring and server logs, kept up to 90 days.
10. Configuration: infrastructure and configuration in code, reviewed and versioned; no default credentials.
11. Governance: access limited to the people who run the service.
12. Certification: none of our own; our main providers hold SOC 2 or ISO 27001 reports.
13. Minimization: AI providers receive only post text or report figures, never account data.
14. Data quality: customers can correct labels in their own reports.
15. Retention: public post text, author and link removed 400 days after publication.
16. Accountability: written runbooks for deletion, takedown and incidents.
17. Portability and erasure: self-serve export and account deletion.

This addendum applies to Customer Personal Data subject to the California Consumer Privacy Act as amended by the CPRA and its regulations, and the comprehensive consumer privacy laws of other US states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island), each as in force ("US State Privacy Laws"). Provider is Customer's "service provider" or "processor" under them. Provider will: (a) process Customer Personal Data only for the business purposes in the Agreement and Customer's instructions; (b) not sell or share it, or use it for targeted advertising; (c) not retain, use or disclose it outside the direct business relationship with Customer, or combine it with personal information from other sources except as US State Privacy Laws allow; (d) comply with US State Privacy Laws and give the same level of protection they require; (e) tell Customer if it can no longer meet these obligations, and let Customer take reasonable steps to stop and remedy unauthorized use; (f) help Customer answer consumer requests; (g) bind its personnel to confidentiality and its subprocessors to written terms at least as protective; (h) delete or return Customer Personal Data at the end of the Agreement, unless the law requires keeping it; and (i) make available the information needed to show compliance, and allow a reasonable assessment once a year at Customer's cost, with 30 days' notice. If this addendum and the DPA Standard Terms conflict for US State Privacy Laws, this addendum controls.

Customers who need a signed data processing agreement, the names of our subprocessors, or advance notice of new subprocessors can ask at support@senti.now; subprocessor names are given under this DPA.