Data Processing Agreement (DPA)
Last Updated: September 2026 • Effective for all active Business and Pro subscribers
1. Scope and Applicability
This Data Processing Agreement ("DPA") supplements the Terms of Service between ReplyChat ("Processor" or "We") and the customer ("Controller" or "Customer") when personal data is processed by ReplyChat on behalf of the Customer in the course of providing Instagram DM automation and Live Inbox services.
This DPA ensures compliance with Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection (nFADP), and international privacy frameworks.
2. Roles of the Parties
- Customer is the Controller: The Customer determines the purposes and means of processing personal data sent through Instagram comments, Story replies, and Direct Messages by configuring automation triggers and rules.
- ReplyChat is the Processor: ReplyChat processes personal data solely on documented instructions from the Customer, as outlined in this DPA and the configured automation settings.
3. Processor Obligations (GDPR Article 28(3))
3.1 Documented Instructions: Processor shall process personal data only upon the documented instructions of Controller, including regarding transfers of personal data to a third country, unless required to do so by applicable EU or Member State law.
3.2 Personnel Confidentiality: Processor ensures that all persons authorized to process personal data (including software engineers and infrastructure operators) are committed to statutory or contractual obligations of confidentiality.
3.3 Security of Processing (Article 32): Processor implements and maintains state-of-the-art Technical and Organizational Measures (TOMs) as described in Annex 2 to ensure a level of security appropriate to the risk.
3.4 Assistance with Data Subject Requests (DSAR): Taking into account the nature of the processing, Processor assists Controller through automated dashboard features (including single-click user disconnection and account data purging) to fulfill Controller's obligations to respond to requests for exercising data subject rights.
3.5 Data Breach Notification: Processor shall notify Controller without undue delay, and in any event within 48 hours, after becoming aware of any confirmed personal data breach affecting Controller personal data.
3.6 Deletion or Return of Data: Upon termination of the service agreement, Processor shall, at Controller's choice, delete or return all personal data within 30 days, unless applicable statutory law requires further storage.
4. Sub-processors
Controller grants general authorization to Processor to engage the following third-party infrastructure providers ("Sub-processors") to deliver the services:
| Sub-processor | Service Provided | Location | Transfer Mechanism |
|---|---|---|---|
| Neon Cloud Inc. | Encrypted PostgreSQL Database | USA (EU Region option) | EU-U.S. DPF / SCCs |
| Zernio Platform | Meta API Rate Limiting & Webhook Ingestion | EU / USA | Standard Contractual Clauses |
| Stripe, Inc. | Payment Processing & Invoicing | USA / Ireland | EU-U.S. DPF / SCCs |
| Google LLC | OAuth 2.0 User Authentication | Global / USA | EU-U.S. DPF / SCCs |
| Vercel, Inc. | Frontend Edge Web Application Hosting | Global Edge | EU-U.S. DPF / SCCs |
Processor ensures that each Sub-processor is bound by data protection obligations at least as restrictive as those in this DPA.
5. International Data Transfers
Where personal data originates in the European Economic Area (EEA), the UK, or Switzerland and is transferred to countries that do not have an adequacy decision, the parties agree to abide by the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor), which are hereby incorporated by reference.
Annex 1: Details of the Processing
- Subject Matter: Provision of ReplyChat Instagram direct messaging automation and CRM lead management platform.
- Duration: The duration of the Customer's active subscription plus 30 days for backup cycle expiration.
- Categories of Data Subjects: Customer's Instagram followers, post commenters, and direct message recipients.
- Types of Personal Data: Instagram usernames, Account IDs (IGSIDs), comment text containing keywords, automated DM message logs, trackable link click counts, customer lead tags.
- Special Categories of Data: None. Controller is prohibited from submitting sensitive personal data (e.g. health data, biometrics, religious beliefs) into the automation platform.
Annex 2: Technical and Organizational Measures (TOMs)
TLS 1.3 enforced for all external traffic. Sensitive secrets encrypted at rest using AES-256.
Strict foreign key isolation and tenant workspace boundary enforcement preventing cross-tenant leakage.
HMAC-SHA256 signature verification executed on all incoming Meta webhook payloads before evaluation.
No long-lived Meta OAuth passwords or sensitive credentials stored in plain text databases.
6. Inquiries and Counter-Signing
For enterprise customers requiring a countersigned copy of this DPA or specific SCC Annexes, please email our legal compliance department at contact@replychat.app.