Data Processing Agreement

Effective date: 22 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between Social Muse, Nepal ("Social Muse", the "Processor", "we") and the customer that has agreed to the Agreement (the "Customer", the "Controller"). It applies automatically when the Customer uses the Service and we process Customer Personal Data on its behalf. A Customer that needs a countersigned copy can request one at support@socialmuse.online.

1. Definitions

"Applicable Data Protection Law" means all data protection laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), India's Digital Personal Data Protection Act 2023 ("DPDP Act") and Nepal's Individual Privacy Act 2018.
"Customer Personal Data" means personal data that the Customer, its users or its connected social media accounts provide to the Service, and that we process on the Customer's behalf.
"Service" means the Social Muse services described in the Agreement.
"Subprocessor" means a third party we engage to process Customer Personal Data.
"Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.
"Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. Under the CCPA, the Customer is the "business" and we are the "service provider"; under the DPDP Act, the Customer is the "Data Fiduciary" and we are the "Data Processor".

2. Roles and scope

The Customer is the controller and we are the processor of Customer Personal Data.
We are an independent controller of the personal data we collect for our own purposes (account, billing, security, support and website data), as described in our Privacy Policy. This DPA does not apply to that data.
The details of the processing are set out in Annex 1.

3. Customer's obligations

The Customer:

Is responsible for the lawfulness of the processing, including having a lawful basis for it and giving any notices and obtaining any consents the law requires.
Will only connect social media accounts and import data that it has the right to use.
Will not use the Service to process special categories of personal data or data about children, unless the law allows it and the Customer has put appropriate safeguards in place.
Is responsible for the people it invites to its workspaces and the permissions it gives them.

4. Our obligations

We will:

Process only on instructions. Process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's use and configuration of the Service, unless the law requires otherwise; in that case we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction breaks Applicable Data Protection Law.
Confidentiality. Ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
Security. Implement and maintain the technical and organisational measures in Annex 2. We may update these measures, provided the overall level of protection is not reduced.
Data Subject requests. Taking into account the nature of the processing, help the Customer respond to requests from Data Subjects to exercise their rights. If we receive a request directly, we will refer the Data Subject to the Customer and will not respond ourselves unless the Customer authorises us to or the law requires it.
Assistance. Provide reasonable help with the Customer's security obligations, data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to us.
CCPA. Not sell or share Customer Personal Data, not retain, use or disclose it for any purpose other than providing the Service, and not combine it with personal data we receive from others, except as the CCPA permits.

5. Subprocessors

The Customer gives general authorisation for us to engage Subprocessors. Our current Subprocessors are listed in Annex 3.
We will notify the Customer by email at least 30 days before adding or replacing a Subprocessor. The Customer may object on reasonable data protection grounds within that period. We will then work with the Customer in good faith to find a solution; if none is found, the Customer may terminate the affected part of the Service and receive a pro rata refund of any prepaid fees for the period after termination.
We will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible to the Customer for their performance.

Social media platforms that the Customer connects, and to which the Customer instructs us to publish, are not our Subprocessors. They process data under their own terms and their own relationship with the Customer.

6. International transfers

We operate from Nepal, and our Subprocessors process data in the locations listed in Annex 3. Where Customer Personal Data is transferred from the European Economic Area, Switzerland or the United Kingdom to a country that does not have an adequacy decision:

The parties agree that the SCCs, Module Two (controller to processor), are incorporated into this DPA by reference, with the Customer as "data exporter" and Social Muse as "data importer". Clause 7 (docking clause) applies; in Clause 9, Option 2 (general written authorisation) applies with the notice period in section 5.2; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.
For transfers from the United Kingdom, the UK Addendum is incorporated, completed with the information in this DPA.
For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

If the SCCs conflict with this DPA, the SCCs prevail.

7. Personal Data Breach

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notice will describe, as far as known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information is not yet available, we will provide it in phases as it becomes available.
We will take reasonable steps to contain and remedy the breach and will cooperate with the Customer's own notifications to authorities and Data Subjects. Our notification is not an admission of fault.

8. Return and deletion

The Customer can delete content and data in the Service at any time, and can ask us to export or delete Customer Personal Data by emailing support@socialmuse.online; we complete such requests within 30 days.
The following retention rules apply while the Customer uses the Service:

Data	Rule
Lead comments, messages and mentions	Kept 90 days, then automatically anonymised (text and personal details removed; score and classification kept). Leads the Customer marks as converted are kept at the Customer's choice
Raw third-party text read by research tools	Kept 30 days, then deleted
Workspace data after the plan ends	Locked for 90 days, then deleted from the Service unless the Customer buys a plan again
Backups	Deleted data leaves our providers' backups as those backups expire

After the Agreement ends, we will delete Customer Personal Data in line with this section, unless the law requires us to keep it, in which case we will keep it confidential and only process it for that purpose.

9. Audits

On written request, no more than once a year (or more often if a supervisory authority requires it or after a Personal Data Breach), we will provide the information reasonably needed to demonstrate compliance with this DPA, such as our security documentation, a description of our measures and our Subprocessor list.
If that information is not sufficient to meet a legal requirement, the Customer (or an independent auditor bound by confidentiality, who is not our competitor) may carry out an audit, on at least 30 days' notice, during normal business hours, limited to what is necessary, and at the Customer's cost. Audits must not compromise the security or confidentiality of other customers' data.

10. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitations of liability in the Agreement, except where Applicable Data Protection Law does not allow such a limitation.

11. Term, precedence and governing law

This DPA stays in force for as long as we process Customer Personal Data on the Customer's behalf.
If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails.
This DPA is governed by the law that governs the Agreement (the laws of Nepal), except where Applicable Data Protection Law or the SCCs require otherwise.

Annex 1: Details of processing

Item	Description
Data exporter	The Customer. Contact details: those on the Customer's account
Data importer	Social Muse, Nepal. Contact: support@socialmuse.online
Subject matter	Providing the Service: content creation and management, publishing to social media, lead management and scoring, AI-assisted research, team collaboration
Duration	The term of the Agreement, plus the retention periods in section 8
Nature and purpose	Collecting, storing, organising, analysing (including with AI), transmitting and deleting data so the Customer can run its social media and marketing activity
Categories of Data Subjects	The Customer's team members and collaborators; people who interact with the Customer's connected social media accounts (followers, commenters, people who send messages); people who appear in content the Customer uploads
Categories of personal data	Names, usernames and social media profile identifiers; email addresses of invited team members; comments, messages and mentions and their AI classification; images, videos and text uploaded by the Customer; activity records of team members
Special categories	None intended. The Customer must not process special categories of data through the Service unless permitted under section 3.3
Frequency of transfer	Continuous, for as long as the Customer uses the Service
Competent supervisory authority	For the SCCs, the supervisory authority determined under Clause 13 of the SCCs

Annex 2: Technical and organisational measures

Access control: role-based permissions per workspace component, checked on our servers at every request; remote sign-out; blocked users lose access immediately; device limits by plan.
Administrator access: separate Admin application, two-step verification required at every sign-in, per-section permissions, and audit logging of every administrative action.
Workspace isolation: row-level security enabled on every database table that holds customer data, and server-side checks of workspace membership on every request; AI memory kept per workspace.
Encryption: TLS for all data in transit; social media access tokens encrypted at rest with AES-256-GCM and used only on our servers; API keys stored only as hashes.
Media: uploaded files stored in private object storage, served only through short-lived signed links; file type and content checks on upload.
Application security: server-side validation of all input; parameterised queries; allow-list sanitising of rich text; restrictions on outbound requests (SSRF protection); rate limiting; idempotency keys; signed and time-stamped payment webhooks; security headers and strict cross-origin rules.
Secrets management: secrets held only in hosting providers' secret stores, separated per environment, never in source code.
Logging and monitoring: activity and audit logs, error monitoring with personal data collection switched off and sensitive fields removed; passwords, tokens and keys never logged.
Data minimisation and retention: only the data needed for each feature is sent to AI providers; automated anonymisation and deletion as set out in section 8.
Availability: managed database with the provider's backup and recovery features; background processing in separate workers with retries.
Secure development: code review, automated tests, dependency and secret scanning and static analysis before every release; separate development and production environments.
Personnel: access to production data limited to authorised personnel bound by confidentiality.

Annex 3: Subprocessors

Subprocessor	Purpose	Location
Supabase, Inc.	Database and authentication	India (Mumbai)
Railway Corporation	Application servers and background processing	Singapore
Upstash, Inc.	Cache and job queue	Singapore
Vercel Inc.	Website and web application hosting	Global network
Cloudflare, Inc. (R2)	Media storage	Global network
Google LLC (Gemini API)	AI processing	United States
Anthropic, PBC	AI processing (when selected)	United States
OpenAI, L.L.C.	AI processing (when selected)	United States
Perplexity AI, Inc.	AI processing (when selected)	United States
Resend, Inc.	Transactional email	United States
Google LLC (Firebase)	Push notifications	Global network
Functional Software, Inc. (Sentry)	Error monitoring	European Union (Germany)
Mixpanel, Inc.	Product analytics	United States
PostHog, Inc.	Product analytics	United States

Our payment partner, Dodo Payments, acts as merchant of record and processes billing data as an independent controller; it does not process Customer Personal Data.