Data Processing Addendum

1. Roles

This DPA applies when ARIFLOGS SERVICES LLC, trading as Every Sent (“processor”), processes personal data for a customer (“controller”) through Every Sent. If the customer is itself a processor, for example an agency working for clients, Every Sent is its subprocessor.

The customer instructs us to process personal data to provide, secure and support Every Sent. The Terms, this DPA and how the customer sets up its automations are its documented instructions.

2. Processing details

• Purpose: sending automated Instagram and Messenger messages, the shared inbox, contact records, exports, and the support and security that go with them.
• People: anyone who comments on, replies to or messages the customer’s connected Instagram accounts or Facebook Pages, and the customer’s teammates.
• Data: Instagram-scoped and Page-scoped IDs, usernames, names and profile pictures; comments, messages, story replies, button taps and media; where a Messenger chat came from, such as an ad or link; details people share, such as email and phone; tags, fields, notes and automation history.
• Duration: while the agreement runs, then until deletion under section 7.

Every Sent isn’t meant for special-category data (such as health, religion or sexual life), data about criminal offences, or data about children. The customer won’t collect it through Every Sent.

3. Our duties

We will:

• process personal data only on documented instructions, unless the law requires otherwise, and tell the customer if we think an instruction breaks the law;
• make sure authorized personnel are bound by confidentiality;
• keep appropriate technical and organizational security measures;
• help the customer answer requests from people exercising their rights, and with security, breach notification, impact assessments and regulator consultations, as far as the processing allows;
• notify the customer without undue delay after becoming aware of a personal data breach affecting its data;
• give the information reasonably needed to show compliance, and allow proportionate audits under confidentiality.

4. Security

Measures include encryption in transit, encrypted Instagram and Facebook Page access tokens, role-based access for teammates, hashed sign-in codes, limited staff access, verification of Meta’s signed requests, rate limits, retention cleanup and deletion jobs.

The customer is responsible for who it invites, the roles it gives, and what its automations ask people for.

5. Subprocessors

The customer authorizes the subprocessors on our subprocessor list. We bind each to data protection terms at least as protective as this DPA and remain responsible for them. Meta isn’t our subprocessor: it’s the platform the customer connects, under the customer’s own agreement with Meta.

We update the list before adding a subprocessor. The customer can object on reasonable data protection grounds within 15 days by emailing hello@everysent.com. We’ll look for a reasonable solution in good faith; if there isn’t one, either party can end the affected service.

6. International transfers

Data may be processed in the United States and wherever our subprocessors operate. Our staff may access customer data from outside the customer’s country, only as needed to provide and support the service. Where the law requires, the EU Standard Contractual Clauses apply: module two when the customer is a controller, module three when it is a processor, with the customer as exporter and Every Sent as importer, the optional docking clause included, and the law and courts of the customer’s EU member state. For the UK, the UK Addendum to the clauses applies. This DPA and the subprocessor list complete the annexes.

7. Deletion and return

During the agreement the customer can export contacts and chats, and delete contacts, in the app. When the agreement ends, or on request, we delete the customer’s personal data unless the law requires us to keep it. Copies in provider backups stay protected and are deleted on the provider’s normal schedule. Deletion requests sent through Instagram or Facebook are handled as described in our Privacy Policy.

8. Customer duties

The customer is responsible for having a lawful basis for its messages, telling people how it uses their data, getting consent where needed (for example for marketing emails), and answering people’s requests.

9. Priority

This DPA is part of the Terms and wins over them on personal data processing. The Terms’ liability limits apply except where the law or the Standard Contractual Clauses say otherwise.

ARIFLOGS SERVICES LLC, 32 Hubbard Hill Road, Rindge, New Hampshire 03461, United States. hello@everysent.com