Data Processing Agreement
It applies automatically to every customer, from the moment you accept our Terms of Service. If your company needs a countersigned copy for its records, email [email protected] and we will send one.
1. What this document is
When you use Influencer Detective to contact creators, you decide who is contacted and what is said, and we carry out those instructions. Data protection law calls you the controller and us the processor for that part, and it requires a written agreement between us. This is that agreement. It forms part of the Terms of Service and uses the same defined terms.
It is made between you, the customer named on the account ("you"), and SIMPLISIO INNOVATION SRL, registration number J40/14613/2021, CUI 44791098, Bucuresti, Sectorul 3, Strada Nerva Traian, Nr. 27-33, Birou 6, Bl. B, Etaj 1, Ap. 6, Romania ("we", "us").
2. Which processing this covers, and which it does not
It covers what we do on your instructions: the outreach you draft and send, the replies you receive, the notes and settings in your workspace, and the mailbox you connect.
It does not cover the creator research database. We decide to build and keep that, we offer it to every customer, and we are the controller for it. How we handle it, and how a creator can be removed from it, is set out in our Privacy Policy. We are also the controller for your own account and billing details, which is a normal supplier relationship rather than processing on your behalf.
This split is deliberate and we would rather state it plainly than claim to be only a processor.
3. Our duties
- We follow your instructions. We process the data covered by section 2 only to provide the service, and on your documented instructions, which include your use of the app's features. If we believe an instruction breaks data protection law, we will tell you and may decline it.
- Confidentiality. Everyone with access is bound by confidentiality obligations, and access is limited to the people who need it to run and support the service.
- Security. We keep the measures described in Annex 2 and will not weaken them during your subscription.
- We do not sell your data and we do not use it to train AI models.
4. Sub-processors
You give us general authorisation to use the sub-processors listed in section 7 of our Privacy Policy, which is kept current and is the authoritative list. Each one is bound by written terms no less protective than this agreement, and we stay responsible to you for what they do.
If we add or replace one, we will update that list and give you at least 30 days' notice by email before the change takes effect. If you object on reasonable data protection grounds within those 30 days, tell us and we will try to resolve it. If we cannot, you may cancel and we will refund your unused credits, worked out the same way as in the Refund Policy, without the usual time limit.
5. Helping you with people's requests
If someone asks you to see, correct, delete or object to their data, and the answer lies in the part we process for you, we will help you respond, taking into account what the app can actually do. If such a request reaches us directly and it concerns your workspace, we will pass it on to you rather than answer it ourselves, unless the law requires otherwise.
We also help you meet your obligations on security, breach notification and data protection impact assessments, in proportion to the information available to us.
6. Security incidents
If we become aware of a breach affecting personal data we process for you, we will tell you without undue delay and in any case within 48 hours, describe what we know, and keep you updated as we learn more. You remain responsible for notifying your supervisory authority and the people affected, where the law requires it.
7. Transfers outside the EU
Our servers are in Germany. Some sub-processors are outside the EU, as marked in the Privacy Policy list. Those transfers rely on the European Commission's standard contractual clauses or, where the provider is certified, the EU to US Data Privacy Framework. Where the standard contractual clauses apply, they are incorporated into this agreement, with you as data exporter and us or the relevant sub-processor as data importer, and Annexes 1 and 2 below serve as their annexes.
8. Deletion and return
You can export your work at any time while your account is open. When your account closes we keep your data for 30 days so you can still ask for a copy, then delete it. Deleted data leaves our backups within about five weeks, since backups are kept on a rolling schedule of 7 daily and 4 weekly copies. We keep only what the law requires us to keep, such as invoices, and the do not contact records described in the Privacy Policy, which exist to stop someone being contacted again.
9. Audits
You may ask us for the information needed to show we are meeting this agreement, and we will provide it. If that is not enough for your regulator, you may audit us, or have an independent auditor do so, once in any 12 month period, on 30 days' written notice, during business hours, without disrupting the service, and subject to confidentiality. You cover the cost unless the audit finds a material breach by us.
10. How this fits with the Terms
If this agreement and the Terms of Service disagree about the processing described in section 2, this agreement wins. Everything else, including the limits on liability, is governed by the Terms. Romanian law applies.
Annex 1: what is processed
| Subject matter | Providing the Influencer Detective research and outreach service |
|---|---|
| Duration | For as long as your account is open, plus the 30 day window in section 8 |
| Nature and purpose | Storing your workspace, drafting and sending your outreach, receiving and summarising replies, and producing AI evaluations to support your research |
| Types of personal data | Business contact details of the creators you choose to contact (name or handle, public email, public profile information), the content of the messages sent and received, and your team members' account details |
| Categories of people | Social media creators you select for outreach, people who reply to your messages, and the members of your workspace |
| Special category data | Not requested by us. Public content a creator has published may touch on personal subjects, as explained in section 4 of the Privacy Policy |
| Frequency | Continuous, for as long as you use the service |
Annex 2: how we protect it
- All traffic encrypted in transit.
- Passwords stored only as one way hashes.
- Mailbox access tokens encrypted before storage, with the key held outside the database.
- Every workspace's data kept separate, reachable only by its members.
- Login attempts throttled, and administrative access limited to the operator.
- Backups taken nightly, kept on a 7 daily and 4 weekly rotation, and tested by restoring them.
- Servers hosted in Germany with a provider that maintains its own physical and network security.
- Changes to the service are reviewed before release, and access to production is limited.
Annex 3: sub-processors
The current list, with what each one receives and where it is located, is section 7 of the Privacy Policy. It lives there rather than being copied here, so that there is one list to keep accurate instead of two that can disagree.
Contact
[email protected]
SIMPLISIO INNOVATION SRL, Bucuresti, Sectorul 3, Strada Nerva Traian, Nr. 27-33, Birou 6, Bl. B, Etaj 1, Ap. 6, Romania