Data Processing Agreement

1. Roles

For the Customer Data defined in section 4, the Customer is the data controller and StarPresence is the data processor. StarPresence processes Customer Data only on the Customer's documented instructions and never for its own purposes.

For the data of the Customer's own account (registration and contact details, billing and payment records, usage data and support correspondence), StarPresence LLC is the data controller, as described in the Privacy Policy. That data is not subject to this DPA.

2. Subject matter, nature and purpose of the processing

The subject matter of the processing is the import of reviews, comments and mentions from the accounts the Customer connects and, where the Customer switches them on, of the private messages sent to those accounts; the retrieval of public reviews, search results and website content for the features the Customer uses; the drafting of replies and posts with the AI processors described in section 9; the proposal of business facts from the documents the Customer imports; the storage of the Customer's media and the generation of the images it requests; the publication of that content on the Customer's instruction; and the statistics StarPresence shows the Customer about that content. The purpose is to provide the Platform to the Customer as described in the Terms of Service.

The following are excepted from the processing on instruction: aggregated or anonymised statistics with no personal reference. Security, abuse-prevention and logging operations that involve Customer Data remain subject to this DPA; the data that StarPresence processes as controller for its own purposes is described in its Privacy Policy.

3. Duration

Processing takes place for as long as the Customer holds an account. Disconnecting an account stops new imports from it; for X it also deletes the account's stored conversations and their messages once StarPresence finds the connection ended. Cancelling a subscription ends its paid features. Other Customer Data stays, protected by this DPA, until it is deleted under section 12 and the Privacy Policy.

4. Categories of data subjects and of data

The data subjects are the authors of reviews, comments and mentions on the accounts the Customer connects (the Customer's own customers and other members of the public), persons who send private messages to the accounts the Customer connects and, for the Customer's own replies, posts and profile facts, the Customer and the persons acting for it; and the persons shown in the Customer's photos and videos or named in its documents.

The data processed (“Customer Data”) is: the author's public display name or handle and profile picture, the text of the review, comment or mention, the rating, the date, the photos attached to a review and the platform identifiers of that content; the content of those messages, with the sender's name and platform identifier (for WhatsApp, the phone number or an identifier Meta assigns), of which a daily cleanup removes the text and attachments once the message has been stored for more than 30 days (Privacy Policy, section 4); the Customer's own replies, posts and profile facts; the photos, videos and images in the Customer's media library with the prompts of generated images; and the documents the Customer uploads or picks from its Google cloud storage.

Special categories of personal data (Article 9 GDPR), such as information about health, and personal data relating to criminal convictions and offences (Article 10 GDPR) are not the subject of this DPA, except where people include them in the messages, reviews or comments they send to the Customer's connected accounts or write about the Customer, which StarPresence cannot prevent, or where they occur in the documents, media and prompts the Customer submits. Such data remains subject to this DPA. StarPresence processes such data only on the Customer's instructions, under the same measures and with the same sub-processors as other Customer Data, and never for its own purposes. The Customer is responsible for its legal basis for processing them and for any professional secrecy that binds it.

5. The Customer's instructions

The Customer's documented instructions are the Terms of Service, this DPA, the consent the Customer gives when connecting an account, the settings the Customer makes in the Platform (in particular the automatic-publishing settings and the per-rating approval rules), and the Customer's item-by-item approvals. StarPresence processes Customer Data only on these instructions, including with regard to transfers to third countries, unless a legal obligation requires otherwise; in that case StarPresence informs the Customer before processing, unless the law prohibits it.

If an instruction appears to StarPresence to infringe the GDPR, the FADP or other data-protection law, StarPresence informs the Customer without undue delay.

6. Obligations of the Customer

The Customer ensures that a valid legal basis exists for the processing it instructs, that its instructions are lawful, that it is authorised to connect the accounts it connects, and that data subjects are informed to the extent required. The Customer remains responsible for the lawfulness of the processing it instructs and for the content it approves or publishes automatically.

7. Confidentiality

StarPresence binds every person authorised to process Customer Data to confidentiality, to the extent they are not already under an appropriate statutory duty of confidentiality. Where the Customer is bound by a professional duty of secrecy, such as a doctor's or a veterinarian's, StarPresence keeps the Customer Data secret to the same extent and binds the persons it engages to do the same.

StarPresence personnel work in the Customer's account only while the Customer's Owner has switched StarPresence Admin access on, only as far as the support task requires, and under the confidentiality obligation of this section. Every such access, and every action taken in it, is recorded. Actions that would reach the Customer's own customers or platforms are carried out only after the Customer approves them. Outside Admin access, only the persons StarPresence has authorised as administrators can read Customer Data, through StarPresence's internal administration tools and only for a stated purpose, such as answering a support request, correcting billing, moderating content or fixing a technical problem; each such read is recorded with the person, the time and the purpose before the data is shown, and a read that cannot be recorded is refused. An authorised administrator can also access the database directly to maintain it or to fix a technical problem; that direct access is not recorded individually. For Google user data, direct access remains subject to the restrictions on human reading in our Google API Services Disclosure.

8. Security of processing and separation of customers

StarPresence implements appropriate technical and organisational measures under Article 32 GDPR and the FADP, in particular: encryption in transit and at rest; access control on a need-to-know basis; availability, resilience, regular backup and restore capability; logging and monitoring; environment segregation; secure development; and periodic review of the effectiveness of these measures.

StarPresence keeps each customer's Customer Data logically separated from every other customer's data. StarPresence does not pool, merge, share or cross-reference the Customer's Customer Data with the data of any other customer, and does not use it to provide the Platform to another customer.

9. Sub-processors and infrastructure delegation

9.1 Appointment of sub-processors. The Customer grants StarPresence general written authorisation to engage downstream sub-processors to perform hosting, technical development, maintenance and automated data-processing operations on the Customer's behalf.

9.2 Platform operator. The Customer acknowledges and authorises that an affiliated company of StarPresence, as its sub-processor, operates and maintains the Platform on StarPresence's behalf:

• Entity: an affiliated company of StarPresence, named in the list of sub-processors (9.3)
• Jurisdiction: United Arab Emirates
• Operational function: operation and maintenance of the Platform

Through that infrastructure the Platform relies on the following further sub-processors: hosting providers that operate the Platform, whose database and file storage hold Customer Data in data centres in Ireland; an email-delivery service that sends notifications to the Customer; an AI processor in the United States that drafts replies, posts and analyses from Customer Data; an AI processor in the United States that generates images from the Customer's prompts; services that retrieve public reviews, search results and website content for the features the Customer uses; and interface providers that connect the Platform to a platform the Customer uses.

These AI processors do not use our API inputs or outputs to train their models. They keep those inputs and outputs for a limited time to provide the service and to monitor for abuse and misuse, as a rule for up to 30 days. They keep them longer only where the law requires it, where it is needed to protect their services or others from harm, or to enforce their usage policies (up to 2 years for flagged inputs and outputs, and up to 7 years for safety classification scores).

The third-party platforms whose accounts the Customer connects (for example Google) act under their own terms as independent controllers and are not sub-processors of StarPresence. Payment processing does not concern Customer Data; the payment processor acts as an independent controller in that respect.

9.3 Contractual compliance. StarPresence has entered into a written intra-group data processing agreement with that affiliated company that imposes data-protection obligations no less stringent than those imposed on StarPresence under this DPA, and binds every other sub-processor to equivalent obligations, except the interface providers of decentralised networks described in 9.5. StarPresence remains fully responsible to the Customer for the performance of its sub-processors. StarPresence informs the Customer of an intended addition or replacement of a sub-processor at least 7 days before it begins processing Customer Data, with the information needed to assess it, so that the Customer may object; on a legitimate objection that cannot be resolved, either party may terminate the affected service. StarPresence shows the current list of sub-processors to every signed-in user of the Platform on a page that the acceptance of the Terms and every connection of an account link to, so that the Customer has it before processing begins. The list states for each sub-processor its name, address and contact, its function, the data it processes, its processing locations, the duration of the processing and the transfer basis, and StarPresence updates it when they change.

9.4 Operational execution and liability. The Customer acknowledges that operational execution, service levels and data management are performed through the downstream infrastructure described in 9.2. Commercial disputes, liability claims and indemnities arising out of a data incident are governed by the Terms of Service and, as between the parties, lie exclusively against and end at StarPresence LLC. Section 15 applies.

9.5 Decentralised networks. Decentralised networks are public networks of independent servers that no single operator controls. Content the Customer instructs StarPresence to publish there becomes public and is copied by the network's servers, from which StarPresence cannot delete it. StarPresence reaches one of these networks through an interface provider in the United States, which receives only the content to be published, the Customer's account identifiers on that network and the public content StarPresence reads there for the Customer. That provider has not concluded a data processing agreement or the Standard Contractual Clauses with StarPresence. The Customer connects an account on a decentralised network only where it accepts this.

10. Requests from data subjects and assistance to the Customer

StarPresence does not respond on the merits to requests that data subjects address directly to it concerning Customer Data: access, rectification, erasure, restriction, objection or portability. It forwards every such request to the Customer without undue delay, does not act on it unless the Customer instructs it to, and assists the Customer, through appropriate technical and organisational measures and to a reasonable extent, in responding within the statutory deadlines. The Customer answers the data subject.

StarPresence likewise assists the Customer, to a reasonable extent, in complying with the obligations under Articles 32 to 36 GDPR and the corresponding provisions of the FADP (security, breach notification, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to StarPresence.

11. Personal-data breaches

StarPresence notifies the Customer of a personal-data breach concerning Customer Data without undue delay after becoming aware of it, and provides the information available to it that the Customer needs for its own notification obligations, supplementing it as further information becomes available.

12. Deletion or return

The processing ends when the account is deleted. Before that, the Customer can delete Customer Data in the Platform at any time, and StarPresence returns Customer Data at the Customer's request: the export in the account contains its businesses, reviews, review replies and settings, and StarPresence provides the rest on request at [email protected]. When the account is deleted, StarPresence deletes the Customer Data: once deletion has started, the account can be restored for 30 days and is then erased (Privacy Policy, section 4). The backups and the limited-time copies of its sub-processors are deleted within the periods that section 4 of the Privacy Policy, section 9.2, part E of the Annex and the list of sub-processors state. Deletion or return applies to the Customer Data StarPresence holds. It does not retract, delete or alter content already published to a third-party platform on the Customer's instruction; that content remains on the platform as the Customer's published content.

13. Records and audits

StarPresence makes available to the Customer the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer and bound to confidentiality. An audit takes place no more than once per year, on 30 days' written notice, during business hours, at the Customer's expense and without unreasonable disruption to StarPresence's operations; where possible, StarPresence first satisfies the request with documentation. These arrangements do not restrict an audit that applicable data-protection law or a supervisory authority requires.

14. International transfers

StarPresence is established in the United States of America. Customer Data at rest is held in the Platform's database and file storage in data centres in Ireland. StarPresence designates a representative in the European Union under Article 27 GDPR and names it, with its address, in its Privacy Policy. Where Customer Data that is subject to the GDPR or the FADP is transferred to StarPresence or to a sub-processor in a country without an adequacy decision (including the United States and the UAE) the transfer relies, where the recipient holds a certification under the applicable Data Privacy Framework, on that certification, and otherwise on the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the “SCCs”), supplemented by a transfer impact assessment and, where necessary, by additional safeguards. These safeguards do not cover the interface provider of a decentralised network described in section 9.5, which has concluded neither a data processing agreement nor the SCCs with StarPresence.

For transfers from the Customer to StarPresence the SCCs apply in Module Two (controller to processor); for onward transfers from StarPresence to its sub-processors, in Module Three (processor to processor). The SCCs are incorporated into this DPA by reference, with the selections and the completed annexes in the Annex to this DPA, and prevail over any conflicting provision of this DPA and the Terms of Service. For transfers subject to the FADP, the adaptations in part A, item 7 of the Annex apply. Except for the provider described in section 9.5, onward transfers rely on the safeguard stated for each sub-processor in the list of sub-processors. Under Clause 13 of the SCCs, for transfers from the Customer the competent supervisory authority is the one that Clause 13(a) designates for the Customer; for onward transfers from StarPresence it is that of the Member State in which StarPresence's representative is established (Ireland; see the Privacy Policy).

15. Liability

The limitation of liability in the Terms of Service applies to this DPA. The liability of the parties towards data subjects under Article 82 GDPR and the corresponding provisions of the FADP remains unaffected.

16. Governing law, precedence and language

This DPA is governed by the law and the dispute-resolution clause of the Terms of Service. The mandatory provisions of the GDPR and the FADP, the competence of the data-protection supervisory authorities, the rights of data subjects, and the governing-law and jurisdiction clauses of the SCCs remain reserved and prevail in the event of conflict.

In the event of discrepancies between this DPA and the Terms of Service, this DPA prevails for the processing of Customer Data. This DPA is provided in English.

17. Contact

For questions regarding this DPA, please contact us at:

StarPresence LLC
30 N Gould St Ste N, Sheridan, WY 82801, USA
[email protected]

Annex: Completion of the Standard Contractual Clauses

This Annex completes the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Module Two for the transfers of Customer Data from the Customer to StarPresence described in section 14. It does not change the wording of the SCCs. The SCCs prevail over this Annex, this DPA and the Terms of Service; no limitation of liability, restriction of claims, arbitration clause or audit arrangement in them limits a right or obligation under the SCCs.

A. Selections

1. Clause 7 (docking clause) applies.
2. Clause 9(a): Option 2, general written authorisation, applies to the sub-processors in the list described in part F. StarPresence informs the Customer of an intended addition or replacement at least 7 days before the new sub-processor begins processing Customer Data, as section 9.3 describes, so that the Customer can object.
3. Clause 11(a): the optional independent dispute-resolution body is not selected. Complaints about the processing can be sent to [email protected].
4. Clause 13: the supervisory authority described in part D is competent.
5. Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
6. Clause 18(b): disputes are resolved by the courts of Ireland. Data subjects keep their right under Clause 18(c) to bring proceedings in the Member State where they habitually reside.
7. Switzerland: for a transfer governed only by the FADP, references to the GDPR are read as references to the FADP, and the Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority. Where the GDPR and the FADP both apply, this adaptation applies only to the part governed by the FADP; the GDPR and the authority under part D continue to apply in parallel. Data subjects who habitually reside in Switzerland may also bring proceedings there under Clause 18(c). Between the parties, the governing law and the courts remain those of Ireland.

B. Parties (Annex I.A)

Data exporter: the Customer, as controller. It is identified in its account by the names of its businesses and, once it buys, by the invoice recipient name and invoice email it confirms at checkout; its billing address is the one it gives at checkout. Its contact persons are its Owners, at the email addresses of their user accounts. A Customer that has appointed a data protection officer or a representative under Article 27 GDPR gives their names and contact details to StarPresence at [email protected]. Its activities relevant to the transfer: managing the reviews, comments, messages, posts and other content of its business through the Platform.

Data importer: StarPresence LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, as processor. Contact: [email protected]. Its activities relevant to the transfer: the processing described in part C.

Signature: the Customer signs this Annex, with this DPA and the SCCs, by accepting the Terms of Service in the Platform, of which this DPA forms part. StarPresence records each acceptance with the accepting user, the version of the Terms accepted, a fingerprint of its content, and the date and time, and signs by offering the Terms with this DPA and recording that acceptance. The version of this DPA in force at that time remains available at its published address.

C. Description of the transfer (Annex I.B)

Data subjects: the Customer's customers and the other people who write reviews, comments, mentions and private messages to or about the Customer; the Customer and the people acting for it; people shown or named in the photos, videos, documents and other content the Customer submits; and people named in the public information retrieved for the features the Customer uses.

Personal data: the categories in section 4, together with the account and content identifiers and the publication records needed to process them.

Sensitive data: sensitive data may occur in the content described in section 4, including special categories of personal data and data on criminal convictions and offences, where people include them or the Customer submits them. It is processed only for the Customer's purposes and the features it uses, under the access controls in part E, by people bound to confidentiality (section 7), and is passed on only to the sub-processors performing the task concerned. The Platform is not intended for keeping patient records. Processing that requires additional safeguards is agreed separately before it begins.

Frequency: continuous while the Customer's connected accounts are connected, and each time the Customer or its users submit content, request processing or instruct a publication.

Nature and purpose: the processing described in section 2: receiving, retrieving and storing, organising and displaying, analysing and generating content with the AI processors where the feature uses them, publishing on the Customer's instruction, reporting, and returning or deleting. Its purpose is to provide the Platform to the Customer under the Terms of Service. Customer Data is not used for another customer or for StarPresence's own purposes.

Retention: Customer Data is kept for the periods in section 12 and in the Privacy Policy. A daily cleanup removes the text and attachments of a received private message once it has been stored for more than 30 days, and shortens the sender's name as section 4 of the Privacy Policy describes; the sender's identifier, the times of the messages and the Customer's own replies remain until the conversation is deleted, at the latest with the account. The text and author details of comments subject to the deletion periods in the Privacy Policy are cleared by a daily cleanup once their period has passed; the technical identifiers named there remain. Media and other content stay until the Customer deletes them or deletes its account.

Sub-processors: the subject matter, nature and duration of their processing are stated in the list in part F; each processes only the data its function needs, for as long as this DPA applies to it.

D. Supervisory authority (Annex I.C)

For a Customer established in the European Economic Area, the supervisory authority competent for its processing, or its lead supervisory authority where it has one. For a Customer without an establishment there that is subject to the GDPR under Article 3(2), the authority of the Member State in which its representative under Article 27 GDPR is established, or, where Article 27(2) exempts it from appointing one, the authority of a Member State in which the data subjects concerned are located. For transfers governed by the FADP, the FDPIC. A Customer may name its authority to StarPresence at [email protected].

E. Technical and organisational measures (Annex II)

Access and separation. The Platform authenticates every user and applies the permissions of the organisation, business, channel and operation concerned; each Customer's data is reached only through those relationships. The Platform's server uses privileged database credentials; the database denies direct access to the tables holding Customer Data to the public and ordinary client roles and has row-level security enabled on them. Background jobs that process records of several organisations keep each record tied to its organisation and do not make one Customer's data available to another.

Support and administrator access. An Owner can switch Admin access on, and off at any time; while it is on, support can work in the account in sessions that end after at most 8 hours, and at once when access is switched off. Support cannot pay, accept terms, give consent, connect or disconnect accounts, or delete anything, and anything that would reach the Customer's customers or platforms waits for the Customer's approval. Switching access on and off, each session and each change made in it are recorded with the person and the organisation. Outside Admin access, only the persons StarPresence has authorised as administrators can read Customer Data, through internal administration tools, each for a stated purpose; each read is recorded with the person, the time and the purpose before the data is shown, and a read that cannot be recorded is refused. An authorised administrator can also access the database directly to maintain it or to fix a technical problem; that direct access is not recorded individually. For Google user data, direct access remains subject to the restrictions on human reading in our Google API Services Disclosure.

Credentials and encryption. Application secrets are supplied through the hosting environment and a secrets manager. The Platform's integrations call their providers over HTTPS. The provider of the database, sign-in and file storage encrypts the stored data, including the access tokens of connected accounts, at rest with AES-256, and its web interfaces for them accept only connections encrypted with TLS.

Records. Sign-ups, Admin access, support sessions and the changes made in them, and the publication of content are recorded with the acting user. These records are not a record of every reading of data.

Retention and erasure. Scheduled jobs apply the retention rules in part C. An account erasure that fails is retried, or kept as failed until the team completes it. The database provider takes one backup of the database each day and keeps it for 7 days, so a record deleted from the database is no longer in these backups at most 8 days later. If the database ever has to be restored from a backup, the restored data is used only after the deletions made since that backup have been applied again, as far as StarPresence's records show them. Files are not part of these backups: an account erasure deletes them from file storage directly.

Development. Changes to the Platform's code reach its main branch only through a pull request with an approving review and passing automated tests; the rule also binds administrators.

Assistance. The Customer sends requests for assistance to [email protected], naming the account, the data and the date by which it needs an answer. StarPresence checks the instruction and uses the account records, the export and deletion functions and its own procedures to find, correct, restrict, return or erase the data concerned, and asks its sub-processors for help where needed. It supplies the information it has that the Customer needs for a data subject's request, a breach notification, an impact assessment or a consultation, in time for the Customer's legal deadline, and forwards requests it receives directly from data subjects (section 10).

F. Sub-processors and onward transfers

Clause 9(a), Option 2 applies, so Annex III is not needed. StarPresence shows the Customer the list of sub-processors on a page in the Platform that the acceptance of the Terms and every connection of an account link to, so that the Customer has it before processing begins. For each sub-processor the list states its name, address and contact, its function and the data it processes, the countries where it processes them, the duration of the processing and the safeguard for the transfer. The list forms part of this Annex.

Onward transfers to sub-processors outside the European Economic Area and Switzerland rely on the SCCs in Module Three or on certification under the Data Privacy Framework, as the list states for each. The exception is the interface provider of a decentralised network described in section 9.5, which has concluded neither: Customer Data reaches it only where the Customer connects an account on that network, accepting this exception.