This Data Processing Agreement ("DPA") is part of the Terms of Service between you ("Controller") and ViralDM ("Processor").
1. Definitions
- Personal Data: Any information relating to an identified/identifiable person
- Controller: You (the user who decides why and how data is processed)
- Processor: ViralDM (we process data on your behalf)
- Data Subject: Your subscribers/customers whose data we process
2. Scope of Processing
We process Personal Data only as needed to:
- Provide the Service to you
- Execute automations you configure
- Store messages and subscriber data
- Generate AI replies (through our own AI gateway in Mumbai to Claude models run by AWS through Kiro, with Google Gemini and AWS Bedrock as fallbacks)
- Comply with legal obligations
3. Categories of Data Subjects
- Your subscribers (Instagram/Facebook/YouTube users who interact with your accounts)
- Your team members (if you add multiple users)
4. Categories of Personal Data
- Platform user IDs and usernames
- Message content (text, attachments)
- Custom fields you collect (email, phone, name)
- Behavioral data (mood, lead score, engagement)
5. Sub-processors
We use the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| AWS | AI models through Kiro (first choice for AI text and payment-screenshot reading) and Bedrock (fallback) | USA |
| Hostinger | Server that runs our own AI gateway | India (Mumbai) |
| Google Cloud Platform | Application & PostgreSQL hosting | India (Mumbai) |
| Razorpay | Payment processing | India |
| Cloudflare | CDN, DDoS protection | Global |
| Meta | Instagram/Facebook APIs | USA / Ireland |
| YouTube APIs, OAuth, Gemini AI (fallback; first for the in-app assistant) | USA |
We'll notify 30 days before adding new sub-processors.
6. Security Measures
- Encryption in transit: HTTPS/TLS for every connection from your browser or app to ViralDM and from ViralDM to third-party services. The app and its database talk over a private network inside the same server, which is not exposed to the internet.
- Encryption at rest: AES-256 for database
- Access controls: Role-based, MFA for admins
- Backups: Daily and encrypted; kept 14 days on the server and 90 days off-site (Cloudflare R2), then deleted automatically
- Monitoring: automated uptime and error monitoring with alerting
- Compliance: our cloud provider maintains SOC 2 / ISO 27001 certification for the underlying infrastructure. ViralDM itself has not completed a SOC 2 or ISO 27001 audit.
7. Data Subject Rights
We assist you in fulfilling subject rights requests within 30 days:
- Right to access
- Right to rectification
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object/restrict processing
8. Data Breach Notification
If we discover a personal data breach, we'll notify you within 72 hours with:
- Nature of breach
- Categories and approximate number of affected subjects
- Likely consequences
- Measures taken/proposed to address breach
9. Data Deletion
When an account is deleted, its data is erased 30 days after the deletion request by an automated daily job, except records we must keep by law (payment and tax records, security and audit logs, and the record of consent and of the erasure itself). Encrypted database backups made before the erasure are not edited; they are used only for disaster recovery and are kept for at most 90 days off-site (Cloudflare R2) and 14 days on the server, after which they are deleted automatically.
10. International Transfers
Data may be transferred internationally. Transfers are protected by:
- EU Standard Contractual Clauses
- Adequacy decisions where applicable
- Encryption + access controls
11. Audits
Enterprise customers may request annual audits with 30 days' notice. Audit reports available under NDA.
12. Contact
Data Protection Officer: [email protected]