Data processing agreement

• Customer: the organization that agreed to the Terms of service. The customer is the controller of Customer Personal Data (or a processor acting for its own clients, in which case we are its subprocessor).
• Processor: Anpsthemes LLC, a Wyoming limited liability company ("Refract", "we"), postal address: Anpsthemes LLC · 30 N Gould St Ste N, 82801, Sheridan, United States.

"Customer Personal Data" means personal data in content and data the customer and its users put into Refract or connect to it, including:

• the customer's team members (names, emails, roles, activity in workspaces);
• its clients and their approvers (names, emails, decisions, messages);
• people who appear in or are mentioned in posts and media;
• the profiles and statistics of social accounts the customer connects.

Refract is a separate controller for account, security and billing data it needs to run the service and meet its own legal duties, as described in the Privacy policy. "GDPR" means the EU General Data Protection Regulation and, where relevant, the UK GDPR and the Swiss data protection act. Terms such as controller, processor, personal data and personal data breach have their GDPR meaning.

We process Customer Personal Data to provide Refract under the Terms: storing it, showing it to the customer's users and approvers, publishing it to the networks the customer chooses, reading statistics back, sending notifications, running the AI features users ask for, delivering webhooks and API responses, supporting the customer, and keeping the service secure. Details are in Annex 1.

• We process Customer Personal Data only on the customer's documented instructions. The Terms, this DPA and the customer's use and settings in Refract (including through the API, agents and integrations it connects) are those instructions.
• If the law requires us to process it otherwise, we'll tell the customer first unless the law forbids that.
• We'll tell the customer if we think an instruction breaks data protection law.
• The customer is responsible for having a legal basis for the data it puts into Refract, for giving people the notices it needs to give, and, for agencies, for having its clients' permission.

Everyone at Refract who can access Customer Personal Data is bound to keep it confidential and accesses it only as needed to run the service, help the customer or meet the law.

We take the technical and organisational measures in Annex 2, which are appropriate to the risk. We may improve them over time, but we won't make them less protective overall.

• The customer authorises the subprocessors in Annex 3.
• We'll give at least 30 days' notice by email to the customer's admins before adding or replacing a subprocessor. The customer can object on reasonable data protection grounds within that time. We'll then try to find a reasonable solution; if there isn't one, the customer can end the affected service and we'll refund fees prepaid for the period after the change.
• We bind each subprocessor to data protection terms at least as protective as this DPA, and we remain responsible for them.
• The social networks, integrations, AI providers reached through the customer's own keys, webhooks and agents the customer chooses to connect are not our subprocessors: the customer directs the data to them under their own terms.

• Refract stores Customer Personal Data in the EU (Finland and the Netherlands). Anpsthemes LLC is in the United States, and some subprocessors are outside the EU.
• Where Customer Personal Data from the EU or EEA is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) where the customer is a controller, and Module 3 (processor to processor) where the customer is a processor. For them: clause 7 (docking) applies; clause 9 option 2 (general authorisation) applies with the notice period above; clause 11's optional language doesn't apply; clauses 17 and 18 choose the law and courts of Ireland; and the annexes are the annexes of this DPA.
• For transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with the clauses above; either party may end it as its section 19 allows. For transfers from Switzerland, the clauses apply with the Swiss Federal Data Protection and Information Commissioner as the authority and Swiss law references where needed.
• We put the same safeguards (Standard Contractual Clauses, or the EU–US Data Privacy Framework where a subprocessor is certified) in place with subprocessors outside the EU.

• Rights requests. Most data can be seen, corrected, exported or deleted by the customer in Refract. For the rest, we'll help the customer answer people's requests. If someone asks us directly, we'll pass the request on to the customer and not answer it ourselves, unless the law requires it.
• Assessments. We'll give reasonable help with data protection impact assessments and consultations with authorities, as far as they concern Refract.

We'll notify the customer of a personal data breach affecting Customer Personal Data without undue delay, and within 48 hours of confirming it. We'll tell the customer what we know (what happened, the data and people affected, likely consequences, and what we're doing about it) and add details as we learn them. Notice goes to the customer's admins by email. Notifying is not an admission of fault.

When the customer's use of Refract ends, or when it asks, we delete Customer Personal Data within 30 days, unless the law requires us to keep some of it. Before that, the customer can export what it needs: posts, media and statistics are available in Refract and through the API. Deleted data stays in backups until they expire, about 30 days later, and is not restored from them except to recover from an incident.

While the customer uses Refract, posts and media files it deletes are permanently deleted 30 days later (a file that a post it hasn't deleted still uses is kept until that post is deleted too), and disconnecting a social account deletes its access tokens and other credentials at once.

We'll make available the information needed to show we meet this DPA, by answering the customer's reasonable written questions and sharing documentation of our measures. If that isn't enough to satisfy a supervisory authority or the law, the customer may audit us once a year, with 30 days' notice, at its own cost, during business hours, under confidentiality, and without access to other customers' data.

• Each party's liability under this DPA is subject to the limits in the Terms, as far as the law allows. Nothing limits a party's liability to data subjects under the Standard Contractual Clauses.
• This DPA is governed by the same law and courts as the Terms (Wyoming), except where the Standard Contractual Clauses require otherwise.
• If this DPA conflicts with the Terms, this DPA wins; if it conflicts with the Standard Contractual Clauses, the clauses win.
• We may update this DPA as the law or our subprocessors change, with notice as above; we won't make it less protective for the customer during its subscription.

DPA questions and notices: legal@refract.social. Privacy requests: privacy@refract.social.

Data exporter: the customer (controller, or processor for its clients). Data importer: Anpsthemes LLC (processor or subprocessor), contact legal@refract.social.

People concerned	The customer's team members; its clients and their approvers; people who appear in or are named in posts and media; the owners of social accounts the customer connects.
Personal data	Names, email addresses, roles and activity; post text, images, video and files; approval decisions and messages; social account IDs, handles, display names, profile picture links, access tokens and statistics; Studio descriptions and images; integration account names; webhook delivery content.
Special categories	None intended. The customer decides whether posts contain any, and must have a basis for them.
How often	Continuously, for as long as the customer uses Refract.
What we do with it	Store, organise, display, publish to the networks chosen, read statistics, send notifications, run AI features on request, deliver webhooks, back up, delete.
Purpose	Providing Refract to the customer under the Terms.
How long	As set by the customer's use; deleted posts and media files are permanently deleted 30 days after deletion, and deleted workspaces 30 days after theirs; a disconnected account's access tokens are deleted at once; everything is deleted within 30 days after the end, and backups expire about 30 days later. Shorter periods in the Privacy policy apply too.
Competent supervisory authority	The one that is competent for the customer under clause 13 of the Standard Contractual Clauses.

• Encryption in transit: all traffic to Refract, to subprocessors and to networks uses TLS (HTTPS).
• Encryption of secrets: social network access tokens, integration credentials, two-step sign-in secrets, backup codes and the keys customers add for AI providers are encrypted in the database with the application's key.
• Hashing: passwords, API tokens, sign-in codes and client approval link tokens are stored only as hashes.
• Sign-in: emailed one-time codes, passwords, passkeys, Google and Apple; optional two-step sign-in; a person can see their sessions and end them.
• Access control: roles (Admin, Editor, Contributor, Viewer) per organization and workspace; API tokens and agents are limited to the role or access and the workspaces they're given; client links are limited in time and scope and can be revoked.
• Staff access: only named platform admins can open the admin area; its sensitive actions need a password or passkey confirmation from the last 30 minutes; staff actions there are logged with time, IP address and browser.
• Network: the database, cache and internal services aren't reachable from the internet; only the web server is, behind a firewall.
• Storage: media and backups are in private storage in the EU; media leaves it only through short-lived signed links.
• Abuse protection: rate limits on sign-in, the API, MCP, uploads, AI features and client approval links.
• Backups and recovery: nightly backups of the database and files, plus one before each release, kept for about 30 days.
• Deletion: deleted workspaces, and posts and media files deleted inside a workspace, are permanently removed with their files 30 days after deletion by a daily job; a disconnected account's access tokens are deleted at once; expired sign-in codes, API tokens and old webhook logs are removed automatically.
• Software: code changes go through automated tests and checks before release.

Subprocessor	What for	Where
Hetzner Online	Servers and database	Helsinki, Finland
Backblaze	Media files and backups	Amsterdam, Netherlands (EU Central)
Cloudflare	DNS and forwarding email sent to Refract's addresses	Global network; Cloudflare, Inc. is in the US
Resend	Sending email (notifications, invitations, approval requests)	United States
Anthropic	Assist (AI writing), only when a user runs it	United States
fal.ai, and the model makers it passes requests to	Studio (AI images), only when a user runs it	United States and other countries

Stripe (Link) sells Refract's plans and credits as merchant of record and processes billing data as its own controller; it isn't a subprocessor of Customer Personal Data.