Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Moodsboard Technologies Private Limited ("we", the processor) and the customer ("you", the controller) whenever you use OmniPosts to process personal data on your own behalf — for example content you publish that names or shows other people, or data about your own audience.
1. Roles and scope
For content you publish through OmniPosts and data about it, you are the controller and we are the processor. For your own account data (your login, billing and usage), we are a controller and the Privacy Policy applies.
2. Processing details
- Subject matter: storing, scheduling and publishing content to the platforms you connect, and reporting results.
- Duration: for the term of your account, then deletion under section 8.
- Data categories: content, media, channel credentials, publishing records, platform engagement counts.
- Data subjects: you, your team, and people who appear in or interact with your content.
3. Our obligations
- Process personal data only on your documented instructions (your use of the service and API is that instruction).
- Ensure everyone with access is bound by confidentiality.
- Apply the measures described on our Security page (GDPR Article 32), including AES-256-GCM encryption of credentials at rest and EU hosting.
- Not sell your data, use it for advertising, or use it to train AI models.
- Help you respond to data subject requests and with impact assessments where reasonably needed.
4. Subprocessors
You authorise the subprocessors listed on the Subprocessors page. We give at least 30 days' notice of changes; you may object as described there. We remain responsible for our subprocessors.
5. International transfers
We host in the European Union. If any transfer outside the EEA becomes necessary, we will use a lawful transfer mechanism such as the EU Standard Contractual Clauses.
6. Personal data breaches
We notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting your data, with the information you need to meet your own obligations.
7. Audits
We make available the information needed to show compliance with this DPA and allow reasonable audits, on at least 30 days' written notice, no more than once a year unless a breach has occurred.
8. Return and deletion
You can export your data at any time from Settings. When your account ends, we delete personal data within 30 days, and it leaves our rolling backups within a further 30 days, unless law requires us to keep it.
9. Contact
Questions about this DPA or requests for a countersigned copy: join@omniposts.dev.