Data Processing Addendum

1. Roles

The customer is the controller (or business) and Veil Hunts LLC, a New Jersey limited liability company, as operator of Ember Social, is the processor (or service provider) of personal data in the customer's content and connected sources ("Customer Personal Data"). Ember processes Customer Personal Data only on the customer's documented instructions, which are the Terms, the customer's configuration of the service, and written requests we agree to.

2. Details of processing

Subject matter and duration: providing Ember for the term of the customer's subscription and the deletion period that follows.

Nature and purpose: storing, analyzing, generating, editing, publishing, and measuring social media content and advertising; ingesting connected sources; sending notifications; and providing support.

Data subjects: the customer's personnel; the customer's customers, audience, and followers; people who comment on or message the customer's accounts; members of connected community channels; and people who appear in the customer's photos and videos.

Categories of data: names, handles, and account identifiers; contact details; message and comment content; images, video, and audio that may show individuals; photo metadata including location; engagement metrics; and advertising settings. The customer should not submit special categories of data except as necessary and lawful.

3. Ember's commitments

Ember will: process Customer Personal Data only for the purposes above and not sell or share it, retain, use, or disclose it outside the direct business relationship, or combine it with other data except as permitted for a service provider; ensure personnel are bound by confidentiality; maintain the security measures described in section 5; assist the customer, taking into account the nature of the processing, with data subject requests, security, breach notifications, and impact assessments; notify the customer if an instruction appears to infringe law; and make available information reasonably necessary to demonstrate compliance, including responses to reasonable security questionnaires.

4. Sub-processors

The customer authorizes the sub-processors listed in our Privacy Policy. Ember imposes data protection terms on each sub-processor that are at least as protective as this Addendum and remains responsible for their performance. Ember will give at least 30 days' notice of a new sub-processor by updating the list and notifying account owners; the customer may object on reasonable data protection grounds, and if we cannot resolve the objection the customer may terminate the affected service and receive a refund of prepaid fees for it.

5. Security

Ember maintains appropriate technical and organizational measures, including encryption of traffic in transit and of connected-account credentials at rest, salted password hashing, per-workspace data isolation, role-based access, least-privilege administrative access with logging, rate limiting, dependency and error monitoring, backups, and incident response procedures.

6. Personal data breaches

Ember will notify the customer without undue delay, and within 72 hours where feasible, after becoming aware of a breach affecting Customer Personal Data, with the information reasonably available to help the customer meet its own obligations, and will take reasonable steps to contain and remediate it.

7. International transfers

Customer Personal Data is processed in the United States. Where transfers from the EEA, UK, or Switzerland require it, the parties agree to the applicable Standard Contractual Clauses (controller-to-processor module) or UK Addendum, which are incorporated by reference.

8. Deletion and return

On termination, the customer may export its content for 30 days. Ember will then delete Customer Personal Data within 30 days, except where retention is required by law, and backups will expire on their normal cycle.

9. Liability and precedence

Each party's liability under this Addendum is subject to the limitations in the Terms. If this Addendum conflicts with the Terms regarding Customer Personal Data, this Addendum controls.

10. Contact

DPA and security questions: legal@embersocial.io. Security incidents: security@embersocial.io.