This Data Processing Addendum (“DPA”) applies when you use SocialPatra for a business, or for your own clients (for example as an agency), and the content, accounts and audience data you manage include personal data. It is part of our Terms of Service between you and Kodetra Technologies Pvt. Ltd. (“Kodetra”, “we”, “us”), and it applies automatically for as long as you use the Service. If this DPA conflicts with the Terms on how personal data is processed, this DPA prevails.
1. Roles
For the content and audience data in your workspaces, you are the controller (or, where you manage data for a client, the client is the controller and you are its processor) and Kodetra is your processor (or your sub-processor). When a client owns the workspace and links an agency, the client remains the controller of that workspace's data and the agency acts on the client's instructions.
For your own account, sign-in, billing and support data, Kodetra is a controller. That processing is described in our Privacy Policy, not here.
The social networks you connect are independent of us. When you publish to them or we read data back through their APIs, they act under their own terms and policies.
2. What we process, and why
Purpose: providing the Service to you: storing and scheduling your content, publishing it to the accounts you connect, showing analytics, running the social inbox, and generating AI content you request.
Duration: for as long as your account is active, plus the deletion steps in section 9.
Categories of personal data: names, handles and profile images of the social accounts and pages you connect; the content you create and media you upload; engagement data about your posts; comments and messages that people send to your accounts and the replies you send; and anything else you choose to put into the Service.
Data subjects: you and your team members, your clients and their staff, and the audience, commenters and message senders of the accounts you connect.
We do not ask you to upload special categories of personal data (such as health or political opinions) and the Service is not designed for them. You are responsible for having a lawful basis for the content you process and for any notices and consents your clients and audience are owed.
3. Our commitments
We process this data only to provide the Service and on your documented instructions, which are these Terms and DPA and your use of the Service's features. If we think an instruction breaks data protection law we will tell you.
We do not sell it, use it for advertising, or use it to build profiles of your audience. Data from a connected social platform is used only to serve you and is never shared with other customers.
We limit access to customer data to what is needed to run and support the Service, and people who have such access are bound by confidentiality.
We help you answer requests from data subjects and regulators, as far as the Service's tools and our information allow (section 8).
4. Security measures
These measures are in place today:
Encryption in transit (TLS) for the web, the API and our provider connections.
Passwords stored only as bcrypt hashes. Sign-in sessions use short-lived access cookies (about 15 minutes) that scripts cannot read, with refresh tokens stored only as hashes.
Access tokens of connected social accounts and AI provider keys encrypted at rest with AES-256-GCM.
Every customer workspace's data is separated from every other workspace's, and access is checked against current roles and permissions on the server on each request.
Rate limiting and standard security headers on the API.
Secrets are kept in a dedicated secret manager, not in source code, and production systems are reached only through restricted access.
We do not currently hold a SOC 2 or ISO 27001 certification and we do not offer an uptime guarantee. No system is perfectly secure.
5. Subprocessors
You authorise us to use the subprocessors below. Each is bound by terms that protect personal data. Our application servers and file storage run on Amazon Web Services in the United States. Providers marked “only if you use the feature” receive data only when you use that feature.
Amazon Web Services (S3)
Purpose
Hosting of uploaded and generated media files
Data
Images and videos you upload or generate
Used
Always
Amazon Web Services (SES)
Purpose
Sending service emails such as verification, invoices and notices
Data
Recipient email address, first name, email content
Used
Always
MongoDB Atlas
Purpose
Application database
Data
All account and workspace data: profiles, posts, schedules, connected-account records (tokens encrypted), analytics, inbox conversations, billing records
Used
Always
Razorpay
Purpose
Card payments, recurring card mandates and refunds
Data
Payer name, email and contact, payment and refund details. Card numbers are entered on Razorpay, not on our servers
Used
Only if you use the feature
PayPal
Purpose
PayPal subscriptions and one-time purchases
Data
Payer identity and payment details held by PayPal, subscription and payment identifiers
Used
Only if you use the feature
Google Firebase Cloud Messaging
Purpose
Push notifications to the mobile app
Data
Device push token, notification text
Used
Only if you use the feature
AI providers selected for your workspace: OpenAI, Anthropic, Google (Gemini, Imagen, Veo), Groq, OpenRouter, Stability AI, Luma, Runway, Novita
Purpose
AI writing, image and video generation
Data
Your prompts, the context added to them and any reference image you choose
Used
Only if you use the feature
TypeSafe AI (Jev)
Purpose
Screening outside text (RSS items, fetched web pages) for prompt-injection attacks before AI use
Data
That outside text only, no account details
Used
Only if you use the feature
Google Analytics 4 (Google LLC, USA)
Purpose
Website analytics on socialpatra.com: which public pages are visited
Data
Visitor IP address, browser details and page-view events. Only with your consent where it is required (analytics cookies are off until you accept outside India and the United States); never for advertising
Used
Only if you use the feature
We notify workspace owners by email and update this list at least 30 days before a new subprocessor starts processing customer personal data. You can object within that period. If we cannot resolve your objection, you may terminate the affected service and we will refund the prepaid fees for it pro rata. We stay responsible for our subprocessors' handling of your data.
6. International transfers
Kodetra is based in India and the Service is hosted in the United States, so personal data is transferred across borders. Where customer personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated into this addendum by reference and apply automatically, with no further signature needed:
Module Two (controller to processor) applies where you are the controller and Kodetra is your processor.
Module Three (processor to processor) applies where you are a processor for your client and Kodetra is your sub-processor, and to our onward transfers to the subprocessors listed above.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum issued by the Information Commissioner applies; for transfers subject to the Swiss Federal Act on Data Protection, the clauses apply with the amendments required by the Federal Data Protection and Information Commissioner (FDPIC).
You are the data exporter and Kodetra is the data importer. The details the clauses ask for (the parties, the data and purposes in section 2, the security measures in section 4 and the subprocessors in section 5) are those in this addendum. If the clauses and this addendum conflict, the clauses prevail. You can ask for a copy of the clauses at support@socialpatra.com.
7. Personal data breaches
If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to your customer data, we will notify the workspace owner by email without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting customer personal data, with what we know about the nature of the breach, the data affected, the likely consequences and the steps we are taking, and we will keep you updated as we learn more.
8. Data subject requests and your tools
Within the Service you can edit and delete posts and media, archive or delete inbox conversations, disconnect any social account (which deletes its stored access tokens and, where the platform supports it, asks the platform to revoke them), and delete a workspace or your whole account.
If a data subject contacts us about data we hold for you, we will refer them to you and will not respond on the substance unless the law requires us to.
There is no self-service full-data download yet. Email us and we will provide your workspace data in a commonly used format.
9. Return and deletion
Deleting a workspace, or the account that owns it, removes its data from our database in one operation and removes its stored media files from file storage on a best-effort basis straight afterwards. Statistics held in time-series collections are removed in a second, best-effort step.
Request-log and usage records expire on their own schedules (see the retention list in the Privacy Policy). Copies held in our database provider's backups may remain until they expire on that provider's schedule.
We keep tax invoices, credit notes and the billing records behind them for the period tax law requires. These relate to your account, not to your clients' data.
If you want your data back before deleting, ask us first: once deleted it cannot be recovered.
10. Information and audits
On a reasonable written request we will give you the information needed to show that we meet this DPA, such as a description of our measures and subprocessors. We do not currently offer third-party audit reports or on-site audits.