Data Processing Agreement

This agreement is between the customer named in the signed copy (“Customer”) and Pontelon LLC, 306 W Redwood St Ste 201, Baltimore, MD 21201 (“Clepora”). For personal data that Customer and its users put into Clepora (“Customer Personal Data”), Customer is the controller and Clepora is the processor. Clepora is the controller only for the account and billing data it needs to run and charge for the service, as described in the Privacy Policy.

Clepora processes Customer Personal Data only to provide the service and only on Customer's documented instructions. Those instructions are the Terms of Service, this agreement, and what Customer chooses in the service — for example which accounts it connects and what it publishes, where and when. Clepora will tell Customer if it believes an instruction breaks data protection law, unless the law forbids telling it.

Everyone at Clepora who can access Customer Personal Data is bound by confidentiality and has access only as far as their role requires.

Clepora maintains the technical and organisational measures in Annex 2 and may improve them, but will not reduce the overall level of protection they provide.

Clepora will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach affecting Customer Personal Data. The notice will describe what is known — the nature of the breach, the data and people affected, likely consequences and the measures taken — and Clepora will update it as more is learned and help Customer meet its own notification duties.

Customer authorises Clepora to use the subprocessors listed at clepora.com/subprocessors. Clepora binds each one by written terms that protect the data at least as well as this agreement, and remains responsible for them. Clepora will notify Customer at least 30 days before adding or replacing a subprocessor. If Customer objects on reasonable data protection grounds and the parties cannot resolve it, Customer may end the affected part of the service and receive a pro-rata refund of any prepaid fees for it.

Platforms Customer publishes to (such as YouTube, Instagram or TikTok) receive content because Customer directs it, under Customer's own terms with them. They are not Clepora's subprocessors.

Clepora and its subprocessors process Customer Personal Data in the United States. Where data protection law requires a transfer mechanism, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum apply to the transfer and are incorporated by reference, with this agreement supplying the details they require.

Taking into account the nature of the processing, Clepora will help Customer respond to requests from individuals exercising their rights — most can be handled directly in the service, through export, editing, disconnecting accounts and deletion — and with data protection impact assessments and consultations with regulators where these relate to Clepora's processing.

Customer can export its data from the service at any time. When the service ends, Clepora will delete Customer Personal Data within 30 days, unless the law requires it to keep some. Deleted data leaves backups and storage version history within 7 days after that.

Clepora will make available the information reasonably needed to show it meets this agreement, including answering one reasonable security questionnaire a year. Where a regulator requires it, or after a breach affecting Customer Personal Data, Clepora will allow an audit by Customer or an independent auditor bound by confidentiality, on reasonable notice, during business hours, at Customer's cost and without access to other customers' data.

Each party's liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms of Service conflict on the protection of personal data, this agreement prevails.

This agreement is governed by the same law, and disputes go to the same courts, as the Terms of Service (the State of Maryland, USA). Where the Standard Contractual Clauses or the UK Addendum apply, they are governed by the law and courts they themselves specify.

• Subject matter and purpose: providing Clepora — storing, editing and transcribing media; generating captions; publishing to and reading statistics from accounts Customer connects; scheduling, approvals and analytics.
• Duration: for as long as Customer uses the service, then as in clause 9.
• People concerned: Customer's users and team members; Customer's clients; people who appear or are mentioned in content Customer uploads; Customer's audience, to the extent platform statistics describe them.
• Kinds of data: names, email addresses and account details; uploaded videos, images, audio, documents and text, and transcripts made from them; identifiers and access credentials of connected accounts; post history and statistics.
• Special categories: none are intended. Customer should not upload such data unless it has a lawful basis to do so.
• Retention: as set out in the Privacy Policy (section 8), and clause 9.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 for stored files and the database disk); connected-account credentials are additionally encrypted.
• File storage blocks public access; files are served only through short-lived signed links.
• Passwords hashed with bcrypt; two-step verification available to every user and required for all staff access; new devices verified by email.
• Role-based staff access with an audit log of staff actions.
• Nightly database backups kept for at most 7 days, with a weekly restore test; deleted files removed from storage within 7 days.
• Automatic recovery of failed servers, error alerting, and a published route for reporting vulnerabilities.

Currently: AWS (Amazon), Resend, Google Workspace, Twilio, ACRCloud, Stripe, Cloudflare. The current list, with purposes and locations, is at clepora.com/subprocessors.