Data processing
Data Processing Agreement
Standard DPA for clients who need to comply with GDPR/LGPD requirements. Electronic signature available upon request.
Last updated: May 21, 2026
1. Parties
This Data Processing Agreement (“DPA”) is entered into between:
- Controller: the Customer (you / your company), who decides the purpose and means of processing.
- Processor: Yanselmask, Inc., who processes data on behalf of the Controller under the terms of this DPA.
2. Subject of processing
FanpageSocial processes personal data that the Controller uploads to the platform to provide content distribution, AI, analytics and attribution services.
3. Nature of processing
- Storage in encrypted PostgreSQL databases (Supabase).
- Processing by AI (Groq, Anthropic, OpenAI) with training opt-out.
- Distribution to connected social networks via official OAuth.
- Daily encrypted automatic backups AES-256.
- Technical logs retained 30 days.
4. Authorized sub-processors
The following sub-processors are authorized:
- Supabase (database + auth, SOC 2)
- Vercel (hosting, SOC 2)
- Stripe (payments, PCI-DSS Level 1)
- Groq, Anthropic, OpenAI (AI processing)
- Social networks connected by the Customer (Meta, TikTok, YouTube, etc.)
We notify any change in sub-processors 30 days in advance.
5. Technical and organizational measures
- TLS 1.3 encryption in transit.
- AES-256-GCM encryption at rest for tokens and sensitive credentials.
- Row Level Security (RLS) in PostgreSQL per workspace.
- Encrypted automatic backups.
- Annual security audits.
- Least privilege policy for production access.
- Immutable audit logs.
6. Incident notification
In case of personal data breach, we notify the Controller in less than 72 hours from detection, with available information on scope, affected data, measures taken and recommendations.
7. Data subject rights
We assist the Controller to respond to data subject requests (access, rectification, deletion, portability, restriction). The tools are integrated in Settings → Account of the workspace.
8. Return / deletion of data
Upon contract termination, we return or delete all personal data per Controller instruction. By default, after 90 days from account closure, we permanently delete.
9. Audit
The Controller has the right to audit compliance through documentary questionnaires or on-site audits with reasonable prior notice (minimum 30 days). Audit costs are borne by the Controller, except for findings of non-compliance.
10. DPO contact
For matters related to this DPA, contact the Data Protection Officer: [email protected]