PostNest - Data Processing Agreement

Last updated: October 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Elledyne Labs, Inc., a Delaware corporation ("Elledyne Labs," "Processor"), and the customer that has accepted them ("Customer," "Controller"). It applies whenever Elledyne Labs processes Customer Personal Data in providing PostNest (the "Service"). If this DPA conflicts with the Terms, this DPA controls for the processing of Customer Personal Data.

1. Definitions

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Terms, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
"Customer Personal Data" means personal data that Elledyne Labs processes on Customer's behalf in providing the Service, as described in Annex I.
"Sub-processor" means a third party Elledyne Labs engages to process Customer Personal Data.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
"SCCs" means the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914, and "UK Addendum" means the UK International Data Transfer Addendum to them.
Other terms (such as "controller," "processor," "data subject," and "processing") have the meanings given in the GDPR, and "service provider," "sell," and "share" have the meanings given in the CCPA.

2. Roles and scope

Customer is the controller (or, where Customer acts for another controller, a processor) of Customer Personal Data, and Elledyne Labs is its processor (or sub-processor). Under the CCPA, Elledyne Labs is Customer's service provider.
Customer Personal Data includes the data the Service handles on Customer's behalf: posts and media Customer approves for publishing, publishing records, data obtained from Customer's connected platform accounts (including comments on Customer's posts and commenters' usernames), and voice profiles derived from Customer's own past posts. It also includes personal data contained in the brands, drafts, campaigns, uploaded media, approvals, and publishing history Customer stores in PostNest Cloud (for example, people named or shown in Customer's posts and media), in material Customer supplies to build a brand, and in the public web pages PostnestBot reads at Customer's request.
This DPA does not cover personal data Elledyne Labs processes as a controller for its own purposes - such as Customer's account, billing, and security data - which our Privacy Policy describes.
Customer is responsible for having a lawful basis for the processing it instructs, including for comments on its posts, and for the notices it gives the people concerned.

3. Elledyne Labs' obligations (GDPR Art. 28(3))

Elledyne Labs will:

Instructions. Process Customer Personal Data only on Customer's documented instructions - which are the Terms, this DPA, and Customer's use and configuration of the Service - unless required otherwise by law, in which case it will tell Customer first unless the law forbids it. It will tell Customer if it believes an instruction infringes Data Protection Laws.
Confidentiality. Ensure that everyone authorized to process Customer Personal Data is bound by confidentiality.
Security. Implement the technical and organizational measures in Annex II, as required by GDPR Art. 32.
Sub-processors. Engage Sub-processors only as Section 4 allows.
Data subject requests. Taking into account the nature of the processing, help Customer respond to requests from data subjects to exercise their rights, and promptly forward any such request it receives directly.
Assistance. Help Customer meet its obligations under GDPR Arts. 32 to 36 (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to Elledyne Labs.
Deletion and return. On termination, delete Customer Personal Data as Section 7 describes.
Information and audits. Make available the information needed to demonstrate compliance with this DPA, and allow for and contribute to audits as Section 8 describes.
Requests from public authorities. If a public authority requests Customer Personal Data, review the request for legality; challenge it where, after careful assessment, it concludes there are reasonable grounds to consider it unlawful, and not disclose the data while a challenge is pending unless the law requires otherwise; disclose only the minimum data legally required; notify Customer promptly before any disclosure unless the law forbids it (and, if it does, seek to have that prohibition lifted); document each request, its response, and the legal reasoning; and, on request, give Customer aggregate information about requests received. Elledyne Labs will not give any authority direct or bulk access to Customer Personal Data.

4. Sub-processors

General authorization. Customer authorizes Elledyne Labs to engage the Sub-processors listed on our Sub-processors page, which currently include Google (Firebase and Google Cloud hosting, compute, storage, backups, logging, and key management), RunPod (GPU infrastructure for the AI model Elledyne Labs operates), and Resend (transactional email).
Flow-down. Elledyne Labs will bind each Sub-processor by a written agreement with data-protection obligations no less protective than this DPA, including a prohibition on using Customer Personal Data for its own purposes or to train AI models, and remains liable for each Sub-processor's performance.
Changes. Elledyne Labs will give at least 30 days' notice before a new Sub-processor processes Customer Personal Data. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

5. Platform data and AI

No training. Elledyne Labs will not use Customer Personal Data, or any other data obtained from Customer's connected platforms, to train, fine-tune, or evaluate AI models, and will not combine it across customers.
Inference only. Customer Personal Data is sent to the AI model only to produce the drafts Customer requests, and prompts and outputs are not retained after a draft is returned.
Platform rules. Elledyne Labs will process data obtained from platforms only as each platform's developer terms allow, including their limits on storage periods, profiling, and AI use (for example, Elledyne Labs does not use AI to draft replies to LinkedIn comments).
No profiling. Elledyne Labs will not build profiles of individual commenters, or link a commenter's comments across posts, brands, or customers.

6. International transfers

Elledyne Labs processes Customer Personal Data in the United States, and its AI Sub-processor in data centres in the United States.
Where a transfer of Customer Personal Data out of the EEA, the UK, or Switzerland requires a transfer mechanism, the parties agree that the SCCs (Module 2, controller to processor; or Module 3, processor to processor, where Customer is a processor) are incorporated into this DPA, with Customer as data exporter and Elledyne Labs as data importer, the optional docking clause applied, the Clause 9(a) general-authorization option with the notice period in Section 4, the Clause 11 redress option omitted, and Ireland's law and courts chosen under Clauses 17 and 18. Annexes I and II of this DPA complete the SCC annexes.
For UK transfers, the UK Addendum applies; for Swiss transfers, the SCCs apply with the references adapted to the Swiss FADP.
Elledyne Labs will ensure that its Sub-processors' onward transfers are covered by an equivalent mechanism.

7. Deletion on termination

Within 10 days after Customer's account is closed or the Service is terminated (Customer's "offboarding"), Elledyne Labs will delete Customer Personal Data from PostNest Cloud, including access tokens, scheduled posts and staged media, publishing records, Inbox comments, and voice profiles, unless the law requires it to keep some of it, in which case it will protect that data and process it only for that purpose.
During the Service, Customer Personal Data is also deleted on the schedules in our Privacy Policy, when Customer disconnects an account, and when a platform notifies us of a deauthorization or deletion request (see Data Deletion).
Customer can also delete its brands, drafts, campaigns, and uploaded media itself at any time during the Service.
Deleted Customer Personal Data can remain in Elledyne Labs' encrypted backups for up to 14 days after deletion, protected as described in Annex II and used only to restore the Service after a failure or loss of data, after which it expires. Inbox comments, access tokens, posts awaiting publication and staged media are held in a separate database and storage that are not backed up, so the 10-day deletion above applies to them without exception.

8. Audits

Elledyne Labs will answer Customer's reasonable written questions about its compliance with this DPA, and make available summaries of its security measures and any third-party certifications or reports it holds (and, on request, those of its Sub-processors, where they allow). If that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an audit, at its own cost, no more than once a year, on at least 30 days' notice, during business hours, under confidentiality, and in a way that does not disrupt the Service or compromise other customers' data.

9. Security Incidents

Elledyne Labs will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data.
The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and Elledyne Labs will update it as more becomes known.
Elledyne Labs will take reasonable steps to contain and remedy the incident, and will cooperate with Customer's own notification obligations. Elledyne Labs also notifies the affected platforms as their developer terms require.
Notice of an incident is not an acknowledgement of fault or liability.

10. CCPA service-provider terms

Elledyne Labs will not: sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than providing the Service (or as the CCPA otherwise permits a service provider); retain, use, or disclose it outside the direct business relationship with Customer; or combine it with personal information it receives from anyone else, except as the CCPA permits. Elledyne Labs will comply with the CCPA's obligations for service providers, provide the same level of privacy protection the CCPA requires, notify Customer if it can no longer meet them, and allow Customer to take reasonable steps to stop and remediate unauthorized use. Elledyne Labs certifies that it understands and will comply with these restrictions.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow them. If the SCCs conflict with this DPA or the Terms, the SCCs control. This DPA ends when Elledyne Labs stops processing Customer Personal Data.

Annex I - Details of processing

Subject matter and duration: providing the Service under the Terms, for the term of Customer's subscription and until deletion under Section 7.
Nature and purpose: storing, transmitting, and otherwise processing Customer Personal Data to store Customer's brands, drafts, campaigns, and media, connect Customer's platform accounts, generate drafts, publish posts Customer approves, show Customer's Inbox, derive Customer's brand voice, and read the public websites Customer names to build a brand.
Categories of data subjects: Customer's personnel who use the Service; people who comment on or reply to Customer's posts; people named or shown in Customer's posts, drafts, brand material, and media; people named on public web pages PostnestBot reads at Customer's request.
Categories of personal data: platform usernames and display names; comment and reply text and timestamps; links to posts and comments; content and media of Customer's posts and drafts; content of Customer's brands, campaigns, and brand material; platform account identifiers. No special categories of data are intended to be processed.
Frequency: continuous, for the term of the Service.
Retention: as set out in the Privacy Policy and Section 7 (for example, LinkedIn comments 24 hours, X content 7 days, other platforms' comments 30 days, staged media 7 days after the post is published or cancelled; brands, drafts, campaigns, and uploaded media until Customer deletes them or its account is closed; backups 14 days).

Annex II - Technical and organizational measures

Encryption: platform access tokens encrypted with keys in Google Cloud Key Management Service, decryptable only by PostNest Cloud's server code, never sent to client devices, with every decryption logged; encryption of data in transit (TLS 1.2 or higher) and at rest.
Access control: per-account scoping of all stored data; administrative access limited to authorized personnel, protected by multi-factor authentication, and reviewed at least every 12 months.
AI infrastructure: the AI model runs only in vetted (Secure Cloud) data centres, with request logging disabled and no Customer Personal Data written to disk.
Data minimization and retention: only the fields needed from each platform are collected, and they are deleted automatically on fixed schedules.
Backups: daily encrypted backups of brand, draft, campaign, media, approval, and publishing data, kept for 14 days, with point-in-time recovery up to 7 days. Inbox comments, access tokens, posts awaiting publication and staged media are held separately and are not backed up.
Website reading (Brand Forge): PostnestBot reads only public, non-social websites from Elledyne Labs' servers, in an isolated, throwaway headless browser with no sign-in and no cookies kept. Live-view screenshots are kept one at a time, visible only to the requesting user, deleted when reading ends (and automatically within minutes if a reading is interrupted), held in a separate database with no backups, never logged, and never sent to the AI model.
Logging and monitoring: audit logs of token use, publishing, and deletions.
Testing: vulnerability testing at least once a year.
Incident response: a documented incident-response process with the notice periods in Section 9.

Annex III - Sub-processors

See our Sub-processors page.

Contact

Elledyne Labs, Inc.
17595 Harvard Avenue, Suite C #4001
Irvine, CA 92614
Email: service@postnest.io