Data Processing Agreement

Roles

You determine why and how the personal data of your leads is processed (you are the controller). SetterStack processes that data only to provide the service, on your documented instructions (we are the processor). Where the law calls it a "service provider," the same intent applies.

Scope of processing

• Subject matter: providing the SetterStack service.
• Duration: for as long as your account is active, plus our defined deletion window.
• Nature & purpose: receiving, reading, generating, and sending messages; qualifying and organizing leads; running automations and booking.
• Data types: lead names, social handles/IDs, message and comment content, and details a person volunteers in conversation.
• Data subjects: the people who contact or are contacted through your connected accounts.

Our obligations

• Process personal data only on your instructions and to provide the service, not for our own purposes.
• Keep personal data confidential and ensure our personnel are bound to confidentiality.
• Apply appropriate technical and organizational security (encryption in transit, hashed credentials, tenant isolation, access controls).
• Not sell personal data and not use it to train third-party AI models.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification, and impact-assessment obligations.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data.

Subprocessors

You authorize SetterStack to engage subprocessors to deliver the service. Each is bound by data-protection terms no less protective than this DPA. Current subprocessors include:

• Supabase — database & storage.
• Vercel — hosting.
• Anthropic / OpenRouter — AI reply generation.
• Zernio — Instagram/Facebook messaging connectivity.
• Stripe — payment processing.
• Resend — transactional email.

We'll give notice of new subprocessors so you have the chance to object on reasonable data-protection grounds.

Data-subject requests

If one of your leads asks to access, correct, or delete their data, we'll help you respond — and our product provides export and deletion tools so you can act on those requests directly.

International transfers

Where personal data is transferred across borders, we rely on an appropriate transfer mechanism (such as Standard Contractual Clauses) with the relevant provider.

Return & deletion

On termination, or on your request, we delete or return the personal data we process for you within our defined window, except where retention is required by law.

Audits

On reasonable request, we'll provide the information needed to demonstrate compliance with this DPA, subject to confidentiality and reasonable frequency.

Contact

Data-protection questions or requests: info@setterstack.com.