Data Processing Addendum

1. Roles and Scope

For Customer Personal Data (defined below), you are the data controller and ChatCoat is the data processor. ChatCoat processes Customer Personal Data only to provide and support the service, on your documented instructions — which are your use of the service, your workspace configuration (including automation and AI agent settings), and any instructions you send us in writing.

Subject matter and duration: processing for the term of your subscription, plus any retention period in Section 9. Nature and purpose: hosting, scheduling, publishing, inbox/comment management, lead capture, analytics, and AI-assisted drafting/automation across the social platforms you connect. Categories of data subjects: your team members; your customers, prospects, and social-media audience members who interact with your connected accounts. Types of personal data: names, usernames/handles, profile identifiers, comment and message content, contact details a person shares with you (e.g. in a lead capture flow), and interaction metadata.

Data about your own account holders that we use to run our business (account administration, billing via our merchant of record, security) is processed with ChatCoat as controller and is covered by the Privacy Policy, not this DPA.

2. Processor Obligations

• Process Customer Personal Data only on documented instructions, unless required by law (in which case we will inform you first, where lawful).
• Ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
• Implement the technical and organizational measures in Section 4.
• Respect the sub-processor conditions in Section 5.
• Assist you, as described in Sections 6 and 7, with data-subject requests and security incidents.
• Delete or return Customer Personal Data at the end of the service as described in Section 9.
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as described in Section 10.

3. Your Obligations

You are responsible for the lawfulness of your instructions and content, for having a valid legal basis to share Customer Personal Data with ChatCoat (including the consent or legitimate-interest basis for the audience data collected through your connected accounts), for the accuracy of the data you provide, and for responding to your data subjects. Automated features (auto-replies, autopilot agents, AI suggestions) act on your configuration; you are responsible for reviewing and for the communications sent on your behalf.

4. Security Measures

• Encryption in transit via HTTPS/TLS for all API and application traffic.
• Social account OAuth tokens and connection secrets encrypted at rest.
• Role-based access control inside each organization (owner / admin / member / viewer), with workspace-level partitioning of campaigns, leads, inbox, and analytics data on multi-workspace plans.
• Platform data-deletion callbacks (Meta, Threads) executed as erasure of the matching connection records, with a stored, verifiable deletion-request record.
• Administrative access limited to authorized staff, with an audit log of administrative actions.
• Access credentials for third-party services are never stored in client-side browser storage for the admin console; admin sessions use short-lived httpOnly cookies.

5. Sub-Processors

You authorize ChatCoat to engage the following sub-processors for the purposes described. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

• OpenAI (default) or an OpenAI-compatible provider you configure (such as DeepSeek, OpenRouter, Together, Groq, or Gemini) — AI features: the content needed to generate drafts, replies, and agent responses. Social account tokens and payment data are never sent to the LLM provider.
• Render — application hosting and database infrastructure.
• Clerk — user authentication and identity.
• Resend — transactional email delivery (invites, notifications, trial lifecycle).
• The social platforms you connect (Meta/Facebook/Instagram, Threads, X, YouTube/Google, TikTok, LinkedIn, and others you authorize) — publishing and reading the data you direct us to process; each platform is also an independent controller for data on its own service.

Paddle acts as merchant of record for payments and processes payment data as an independent controller under its own terms; ChatCoat does not store card numbers. We will give at least 15 days' notice of a new sub-processor that processes Customer Personal Data by updating this page (and by email to organization owners for material changes), during which you may object on reasonable data-protection grounds.

6. Data-Subject Rights Assistance

Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures, insofar as possible, to fulfil requests from data subjects (access, rectification, erasure, restriction, portability, objection). If a data subject contacts ChatCoat directly about Customer Personal Data, we will forward the request to you and will not respond ourselves except to direct the person to you, unless you instruct otherwise. Platform deletion callbacks are executed automatically as described in Section 4.

7. Personal Data Breach Notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to us (nature, categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed). We will cooperate with your investigation and document the breach, its effects, and the remedial action taken.

8. International Transfers

Customer Personal Data may be processed in the countries where ChatCoat and its sub-processors operate, including the United States. Where a transfer is subject to GDPR Chapter V or equivalent rules, the parties rely on the applicable transfer mechanism offered by the relevant sub-processor (such as standard contractual clauses or an adequacy framework), and this DPA incorporates the standard contractual clauses (EU Commission Implementing Decision 2021/914, Module Two) by reference where they are required, with ChatCoat as data importer and you as data exporter.

9. Retention, Return, and Deletion

During the subscription, retention follows your use of the service and the Privacy Policy. At the end of the service, at your choice, we will delete or return Customer Personal Data and delete existing copies within 30 days, unless a longer retention is required by law. Disconnecting a social account removes its tokens immediately; platform deletion callbacks erase the matching connection records at callback time.

10. Audits and Information

On reasonable request (no more than once per year, unless a breach has occurred), we will provide information reasonably necessary to demonstrate compliance with this DPA — such as summaries of our security measures and sub-processor list — subject to confidentiality. If the information provided is not sufficient, the parties will agree on a proportionate audit scope carried out during business hours without unreasonable disruption to the service.

11. Contact

For DPA questions, data-subject request assistance, or breach notifications, contact us at support@chatcoat.com. See also our Privacy Policy and Terms of Service.