Data Processing Addendum

1. Roles

For the content you upload, and for the audience data your connected networks return — comments, mentions, reviews and direct messages — you are the controller and we are your processor.

For your own account and billing data, and for the operational records we keep to run and secure the service, we are a controller. Our Privacy Policy governs that.

2. Scope and instructions

We process personal data only on your documented instructions. Your configuration of the product, and your use of it, constitute those instructions: connecting an account, scheduling a post, syncing an inbox, running a generation, calling the API.

We will tell you if an instruction appears to us to breach applicable data protection law, and we may decline to act on it.

The subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects, are set out in Annex I.

3. Confidentiality

Personnel authorised to process personal data are bound by confidentiality obligations, and access is granted on a least-privilege basis and withdrawn when it is no longer needed.

Support staff open a customer workspace only through a time-boxed session that requires a written reason and is recorded in the audit log. Operational dashboards show staff limited metadata about failed jobs and flagged public comments across workspaces; they never show the text of private messages.

4. Security measures

We implement appropriate technical and organisational measures under Article 32. They are described in Annex II, and we do not weaken them during the term.

5. Subprocessors

You give general authorisation for the subprocessors listed in Annex III. Each is engaged under a written contract imposing data protection obligations no less protective than these, and we remain liable for their performance.

We announce a new subprocessor in the changelog before it begins processing. If you object on reasonable data protection grounds within 30 days, we will work with you to find an alternative; if none exists, you may terminate the affected part of the service and receive a refund of the unused prepaid portion.

6. Assistance

Taking into account the nature of the processing and the information available to us, we assist you with data subject requests, data protection impact assessments, and prior consultations with a supervisory authority.

The product itself does most of this: you can read, correct, export and delete workspace content directly, which will usually let you answer a data subject request without contacting us. Where you need us, we do not charge for reasonable assistance.

7. Personal data breach

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting personal data we process for you.

The notification will describe the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed, and a contact point — everything you need for your own notification obligations.

8. International transfers

Our infrastructure is in the United States (Amazon Web Services’ us-east-1 region, Northern Virginia), so processing on your behalf takes place there. Transfers from the EEA, the UK or Switzerland — both to us and onward to the subprocessors in Annex III — rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two where we act as your processor and Module Three where a subprocessor is engaged, incorporated into this addendum by reference and completed by Annexes I to III.

For UK data, the ICO’s International Data Transfer Addendum applies to those clauses. For Swiss data, references to the GDPR and to supervisory authorities are read as references to the Swiss FADP and the Federal Data Protection and Information Commissioner.

Where those clauses conflict with the rest of this addendum, the clauses prevail.

9. Deletion and return

You can export and delete your data yourself at any time from the product. On termination, and at your choice, we delete or return personal data processed on your behalf within 30 days, except where retention is required by law.

Database snapshots allow recovery to any point in the previous 7 days, and versioned media storage keeps a deleted or replaced file for 30 days, so deleted data may persist in a backup for up to 30 days afterwards. It is not restored to the live service and is not otherwise processed.

10. Audit

We make available the information reasonably necessary to demonstrate compliance with this addendum, and allow for and contribute to audits conducted by you or an auditor you appoint.

Audits happen on 30 days’ written notice, no more than once a year unless a supervisory authority or a breach requires otherwise, during business hours, subject to confidentiality, and in a manner that does not disrupt the service or the data of other customers.

11. Liability and precedence

The limitations of liability in the Terms of Service apply to this addendum, except where applicable data protection law does not permit them.

If this addendum conflicts with the Terms of Service on a data protection matter, this addendum prevails. If it conflicts with the Standard Contractual Clauses, the clauses prevail.

Annex I — Description of the processing

Data exporter: you, the customer. Data importer: Haven Technologies Inc., 2103 Harrison Ave NW STE 1034, Olympia, WA 98502, United States, support@gongongai.com.

Subject matter and duration: provision of the Gongong AI service for the term of your subscription, plus the deletion period in section 9. Nature and purpose: hosting, generating, scheduling, publishing, retrieving and analysing social media content on your instructions. Frequency: continuous.

Special categories of data: none are required by the service, and we ask you not to submit them. If your content happens to contain them, they are processed only as part of that content and receive the measures in Annex II.

Competent supervisory authority for the Standard Contractual Clauses: that of the member state in which the data exporter is established.

Annex II — Technical and organisational measures

These are the measures actually in place, described precisely enough to be checked.

• Encryption in transit — TLS on every connection, with browsers instructed by a strict-transport-security policy to refuse an unencrypted one.
• Encryption at rest — social network access and refresh tokens, and two-factor secrets, are encrypted with AES-256-GCM authenticated encryption. Ciphertext carries a version marker so keys can be rotated without downtime.
• Credential handling — passwords are hashed with Argon2id at the current OWASP baseline; API keys, OAuth tokens and session tokens are persisted only as one-way SHA-256 hashes and cannot be recovered by us. Secrets are compared in constant time.
• Tenant isolation — every read is scoped to a workspace, and a cross-tenant isolation suite runs against a real database on every build, covering posts, versions, comments, approvals, media, inbox, analytics, reports, API keys and OAuth grants. Requests for another tenant’s record are answered as not-found rather than forbidden, so identifiers cannot be probed.
• Access control — role-based permissions across six roles; two-factor authentication enforced in code for all staff access to administrative surfaces; a configurable network allowlist for the administrative portal; step-up re-authentication before sensitive changes.
• Support access — staff open a customer workspace only via a signed session bound to the staff member and their sign-in, which expires in 30 minutes (or when they stop or sign out), requires a stated reason, and is audit-logged. Read-only sessions present the workspace with viewer permissions; write-capable sessions cannot change billing, team membership or ownership, or delete the workspace.
• Audit logging — administrative actions, denied access attempts and destructive actions on workspaces, members, posts, media, connected accounts, API keys, webhooks and billing are recorded with actor, time, IP address and bounded metadata.
• Availability and integrity — every job is written in the same database transaction as the change that caused it, so a queue outage cannot lose work or act on a rolled-back record; public API writes are idempotent, enforced by a unique database index rather than an application check.
• Backup and restore — the database is backed up automatically and continuously by our cloud provider, encrypted at rest under a key we control, with point-in-time recovery across a 7-day window; stored media is held in versioned, encrypted object storage. Both currently reside in the same cloud account as the live service.
• Network protection — a per-request nonce-based Content Security Policy, plus content-type, framing, referrer and permissions policies; outbound requests to customer-supplied addresses are resolved and checked against internal ranges on every redirect hop to prevent server-side request forgery.
• Rate limiting — per IP address, per user, per API key and per connected account, with limits applied on authentication, sign-up, publishing, inbox replies, the public API and OAuth.
• Logging hygiene — credentials are removed from log output structurally at every depth rather than by review habit; email addresses are masked and IP addresses truncated to their network before a line is written.
• Webhooks — outbound deliveries are HMAC-signed with a timestamped replay window and rotation-tolerant verification; signing keys are derived per purpose, so a key exposed on one surface is useless on another.
• Personnel — least-privilege access, confidentiality obligations, and access removal on role change or departure.

Measures we have not implemented, stated plainly rather than omitted: we do not currently hold a SOC 2 or ISO 27001 certification, we do not use a hardware security module or a managed key service for the encryption key, and we do not offer customer-managed keys or a customer-specific data residency region.

Annex III — Subprocessors

The providers below process personal data on our behalf to deliver the service. Providers listed in our Privacy Policy that are not repeated here process only our own controller data, not yours.

The social networks you connect, and any webhook endpoint or automation you configure, receive data because you direct us to send it. They are recipients under your own instruction rather than our subprocessors.