Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR, between the customer (controller) and the provider (processor). This DPA forms part of the usage agreement for Ikrames (terms and conditions) and applies to all processing of personal data that the provider carries out on behalf of the customer.

§ 1 Subject Matter and Duration

The provider processes personal data on behalf of the customer in order to provide the Ikrames services (creation, planning, publication and analysis of social media content). The duration corresponds to the term of the usage agreement.

§ 2 Nature and Purpose of the Processing

Types of data: account and profile data of the customer's team members (name, email, profile picture) and their assignment to posts, content and media that the customer contributes or has generated, connected social media accounts (access tokens, account identifiers), performance and interaction data of published content (including third-party comments together with their public profile information), billing and usage data.

Categories of data subjects: employees and agents of the customer, persons who interact with the customer's published content (e.g. commenters), and where applicable persons depicted in content.

Purpose: exclusively the provision of the contractually agreed services. The processing of aggregated, de-identified data for the provider's own purposes is not part of this mandate (§ 6).

§ 3 Right to Issue Instructions

The provider processes the data only on documented instructions from the customer; the customer's use of the Ikrames features constitutes such an instruction. If the provider considers an instruction to be unlawful, it shall inform the customer without undue delay and may suspend execution until the matter is clarified.

§ 4 Obligations of the Provider

The provider (a) obliges all persons involved in the processing to maintain confidentiality, (b) takes technical and organisational measures pursuant to Art. 32 GDPR (Annex 1), (c) supports the customer in responding to data subject requests and with the obligations under Art. 32–36 GDPR, (d) deletes or returns personal data after the end of the contract (§ 9), and (e) makes available to the customer the information required to demonstrate compliance (§ 10).

§ 5 Sub-processors

The customer grants general authorisation for the use of the sub-processors listed in Annex 2. The provider shall inform the customer in text form in advance of any intended changes (addition or replacement); the customer may object for good cause relating to data protection. Contracts meeting the requirements of Art. 28 GDPR are in place with every sub-processor.

§ 6 Aggregated Data for the Provider's Own Purposes

Insofar as the provider processes personal data on behalf of the customer, the provisions of this DPA apply. Separately from this, the provider is entitled to process usage and performance data in aggregated, de-identified form in order to improve and further develop its services; in this respect the provider acts as an independent controller within the meaning of Art. 4(7) GDPR. By technical measures (aggregation minimum thresholds, no records relating to individual customers in the analysis layer) the provider ensures that no conclusions about the customer, its brands or individual persons can be drawn from the aggregates.

§ 7 Data Subject Rights

If a data subject contacts the provider directly, the provider shall forward the request to the customer without undue delay. The provider supports the customer with suitable means (the platform's access, export and deletion functions) in fulfilling data subject rights.

§ 8 Notification Obligations

The provider shall notify the customer of personal data breaches affecting the mandate without undue delay after becoming aware of them, providing the information required under Art. 33(3) GDPR insofar as it is available.

§ 9 Deletion and Return

After the end of the contract, the provider deletes the personal data processed on behalf of the customer, unless a statutory retention obligation applies. Beforehand, the customer may secure its content via the platform's export functions. Aggregates already formed within the meaning of § 6 remain unaffected, as they no longer relate to identifiable persons.

§ 10 Evidence and Audits

The provider demonstrates compliance with this DPA by means of suitable documentation (including the description of measures under Annex 1, certificates and the data processing agreements of its sub-processors). Further audits take place by appointment and at the customer's expense.

§ 11 Final Provisions

In all other respects the terms and conditions apply. In the event of contradictions concerning data protection provisions, this DPA prevails. The law of the Federal Republic of Germany applies.

Annex 1 — Technical and Organisational Measures (TOMs)

• Encrypted transmission (TLS) for all connections.
• Access control: role-based permissions per workspace, row-level isolation in the database (Row Level Security), separate service credentials for system processes.
• Authentication via a specialised identity provider; access tokens of connected social accounts are not delivered to end devices in plain text.
• Logging of security-relevant events; backups by the infrastructure providers used.
• Server locations: the database and file storage are located in the European Union (Ireland); the application and the rendering service are likewise operated in the European Union (Amsterdam, Netherlands), for which the hosting service provider (Railway) uses Google Cloud Platform infrastructure. Processing of the customer's data therefore takes place in the EU, with the exception of the services based in the USA listed in Annex 2. In addition, the hosting service provider processes account and usage data of the provider's own account (account, billing and usage information of the provider, not the customer's content) as an independent controller in the United States as well; that transfer takes place on the basis of the EU standard contractual clauses. Details in the „Hosting“ section of the privacy policy.

Annex 2 — Sub-processors

The same service providers are used as those named in the privacy policy under „Overview of Recipients and Processors“ — this list is generated from the same source and therefore cannot diverge from it:

• Railway — Hosting of the application and the render service (app data in transit, server logs). Operated in the EU (Amsterdam, Netherlands) since 17 August 2026, on Google Cloud Platform infrastructure. In addition, Railway processes account and usage data of our own account as an independent controller in the United States (basis: EU standard contractual clauses, Module 2, from the data processing agreement concluded on 16 August 2026). Provider: Railway Corporation, San Francisco, USA
• Supabase — Database and file storage (all user data). Project region eu-west-1 (Ireland, EU)
• Clerk — Identity and authentication (email, name, sessions)
• Stripe — Payments and invoices
• Bundle.social — Publishing to social networks: access keys of the connected channels and the content of the posts (texts, images, videos). Provider: BUNDLE sp. z o.o., ul. Hoża 86/410, 00-682 Warsaw, Poland; processing within the European Economic Area
• ElevenLabs — Voice clones (voice samples)
• Anthropic — LLM processing of content texts (Claude language models) for three paths that still call Anthropic directly for now: the in-product assistant, the onboarding chat and the Auto-Planner's web research (the contracting party is the Irish entity, see the AI services section). All other Claude requests run via OpenRouter with EU routing (see there)
• IONOS — LLM processing of content texts (Llama 3.3 language model in the AI Model Hub). Provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; processed in the Berlin data centre, i.e. within the EU — no transfer to a third country takes place
• OpenAI — Whisper transcription of standalone voice recordings, embeddings
• fal.ai — Image and video generation (prompts, in part brand images) and transcription of video audio tracks
• Cloudflare — DNS/proxy for ikrames.com
• PostHog — Product and reach analytics (page views, usage events) and session replays. EU hosting in Frankfurt (Germany). Anonymous reach measurement without access to your device on the basis of legitimate interest (Art. 6(1)(f) GDPR); identified analytics and session replays only with your consent (Art. 6(1)(a) GDPR). Provider: PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA. The data is hosted in the EU; where PostHog processes it in the USA beyond that, the EU Standard Contractual Clauses from PostHog's data processing agreement apply
• Resend — Delivery of system and transactional emails (recipient address, subject, message content). Provider: Plus Five Five, Inc. (trading as “Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA; basis: EU standard contractual clauses. Covers the acknowledgement for cancellation/withdrawal, the purchase confirmation for digital products, and the delivery of freebies together with the corresponding confirmation and welcome email
• OpenRouter — Routing of model requests: Claude requests via EU routing (processed by Amazon Web Services, Ireland, or Google Cloud, Europe) and decision requests to the model Jev (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). OpenRouter does not operate a model of its own. Provider: OpenRouter, Inc., USA; the transfer is based on Standard Contractual Clauses under Art. 46 GDPR. If a request to Jev contains text written by people, such as support requests, we first replace email addresses, phone numbers, profile links and names following a salutation with placeholders; names without a salutation and @-handles may remain. The exception is the check of a post immediately before publication: its text is sent to Jev unchanged, because it becomes public right afterwards. For requests to Jev we additionally send `provider.data_collection: "deny"` so that only providers without data collection are used
• TypeSafe AI — Decision model (Jev): assesses whether a support request is genuine, whether a signal fits the brand, whether a text matches a brand's voice, whether a post is fine to publish automatically and whether an action by the assistant needs approval (support gate, signal relevance, voice match, check before automatic publishing, assistant guard). It does not generate content. Reachable exclusively via OpenRouter, masked as described above. Provider in the USA; we have not received a basis for the transfer to the USA (Standard Contractual Clauses) from TypeSafe AI in writing
• Inngest — Job orchestration (event payloads containing user and content IDs and job parameters). Provider: Inngest Inc., United States; processing takes place in the USA. The EU standard contractual clauses are the envisaged basis for the transfer; the data processing agreement that makes them binding has been requested and is not yet in place
• Evomi — Proxy for source downloads in the render service — both for retrieval via yt-dlp and for direct file downloads. For encrypted targets (HTTPS) the proxy sees only the target host, the time and the amount of data transferred, not the content transmitted; for unencrypted targets (HTTP) it also sees the content. Provider: TeraShift GmbH, Switzerland; the transfer is based on the European Commission's adequacy decision for Switzerland (Decision 2000/518/EC, Art. 45 GDPR) — standard contractual clauses are not required for it