# Data Processing Addendum for FoodPerfect.ai **Last Updated: September 30, 2026** This Data Processing Addendum ("DPA") forms part of the [Terms of Service](/legal/terms-of-service.md), or any other agreement for the FoodPerfect.ai service (the "Service"), between the customer that accepts them ("Customer," "you") and Georgy Bdoyan, operating as FoodPerfect [TBD: legal form and registration number], [TBD: registered address] ("FoodPerfect," "we," "us"). It applies when FoodPerfect processes Customer Personal Data on Customer's behalf. It takes effect automatically when you accept the Terms of Service. If you need a countersigned copy, email **privacy@foodperfect.ai**. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail. --- ## 1. Definitions - **"Data Protection Laws"** means all laws on privacy and personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Law of Georgia on Personal Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA"). - **"Customer Personal Data"** means personal data that FoodPerfect processes on Customer's behalf in providing the Service, as described in Annex I. - **"Subprocessor"** means a third party engaged by FoodPerfect that processes Customer Personal Data. - **"Standard Contractual Clauses" or "SCCs"** means the clauses approved by European Commission Implementing Decision (EU) 2021/914. - **"UK Addendum"** means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner. - **"Security Incident"** means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, Customer Personal Data. - "Controller," "processor," "data subject," "personal data," and "processing" have the meanings given in the GDPR. Under the CCPA, "business" and "service provider" have their CCPA meanings. --- ## 2. Roles and Scope 2.1 **Roles.** For Customer Personal Data, Customer is the controller (or a processor acting for its own controller), and FoodPerfect is the processor (or subprocessor). Under the CCPA, Customer is the business and FoodPerfect is the service provider. 2.2 **Out of scope.** This DPA does not apply to personal data that FoodPerfect processes as a controller, such as account, billing, usage, and security data about Customer's users, and public data collected for brand analysis. That data is described in our [Privacy Policy](/legal/privacy-policy.md). Social platforms (Meta, TikTok, LinkedIn) and Paddle are independent controllers, not Subprocessors. 2.3 **Customer's responsibilities.** Customer is responsible for: - having a lawful basis, and giving any notices and obtaining any consents, needed for FoodPerfect to process Customer Personal Data, including telling its own customers that it uses third-party tools to manage social media messages - the accuracy and lawfulness of Customer Personal Data and of its instructions - the settings it chooses in the Service, including automatic publishing and automatic replies --- ## 3. FoodPerfect's Obligations ### 3.1 Instructions FoodPerfect processes Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case FoodPerfect will inform Customer first unless the law prohibits it. Customer's instructions are the Terms of Service, this DPA, and Customer's use and configuration of the Service, including actions taken through API keys and AI agents that Customer authorises. FoodPerfect will tell Customer if it believes an instruction infringes Data Protection Laws. ### 3.2 Confidentiality FoodPerfect ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality obligations. ### 3.3 Security FoodPerfect implements and maintains the technical and organisational measures described in Annex II. FoodPerfect may update these measures, provided that it does not materially reduce the overall level of protection. ### 3.4 No Training, No Sale FoodPerfect does not use Customer Personal Data to train AI models, does not sell or share it (as those terms are defined in the CCPA), does not retain, use, or disclose it for any purpose other than providing the Service, and does not combine it with personal data from other sources except as permitted by Data Protection Laws. FoodPerfect certifies that it understands and will comply with these restrictions. ### 3.5 Assistance Taking into account the nature of the processing, FoodPerfect will reasonably assist Customer: - to respond to data subject requests. If FoodPerfect receives a request directly, it will redirect the data subject to Customer and will not respond itself, except to confirm the redirection - with data protection impact assessments and prior consultations with supervisory authorities, where they relate to the Service - with Customer's security obligations FoodPerfect may charge a reasonable fee for assistance that goes beyond the features of the Service. ### 3.6 Security Incidents FoodPerfect will notify Customer without undue delay, and in any event within **48 hours**, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include the information then available about the nature of the incident, the data and data subjects affected, the likely consequences, and the measures taken or proposed. FoodPerfect will take reasonable steps to contain and remedy the incident. Notification is not an admission of fault. ### 3.7 Deletion and Return Customer can export or delete Customer Personal Data using the Service while its account is active. When the Service ends, FoodPerfect will delete Customer Personal Data within 30 days, unless Data Protection Laws require FoodPerfect to keep it. Data in backups will be deleted on the normal backup cycle and protected in the meantime. Content already published to a social platform at Customer's direction is controlled by that platform and Customer. ### 3.8 Audits On Customer's written request, no more than once a year (or after a Security Incident, or when a supervisory authority requires it), FoodPerfect will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to reasonable security questionnaires. If this information is not sufficient to meet Customer's obligations under Data Protection Laws, the parties will agree in good faith on the scope, timing, cost, and confidentiality of any further audit. --- ## 4. Subprocessors 4.1 **General authorisation.** Customer gives FoodPerfect general authorisation to engage Subprocessors. The current Subprocessors are listed on our [Subprocessors](/legal/subprocessors.md) page. 4.2 **Obligations.** FoodPerfect enters into a written agreement with each Subprocessor that imposes data protection obligations substantially no less protective than those in this DPA, to the extent applicable to the service provided. FoodPerfect remains responsible for its Subprocessors' performance of those obligations. 4.3 **Changes.** FoodPerfect will give at least **30 days'** notice of a new Subprocessor by updating the Subprocessors page and notifying Customers who have subscribed to updates by emailing **privacy@foodperfect.ai** (or by email or in-app notice to all customers). In an emergency, such as a provider outage, the notice period may be shorter, and FoodPerfect will give notice as soon as possible. 4.4 **Objection.** Customer may object to a new Subprocessor on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If FoodPerfect cannot offer a reasonable alternative, Customer may terminate the affected part of the Service and receive a refund of prepaid, unused amounts for it. --- ## 5. International Transfers 5.1 FoodPerfect and its Subprocessors may process Customer Personal Data outside the country in which it was collected, including in the United States. 5.2 To the extent Customer Personal Data subject to the GDPR is transferred to FoodPerfect in a country without an adequacy decision, the **SCCs are incorporated into this DPA** as follows: - Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor - Clause 7 (docking clause) applies - Clause 9: option 2 (general authorisation), with the notice period in Section 4.3 - Clause 11: the optional language does not apply - Clause 13: the supervisory authority is the one competent for Customer, or for Customer's EU representative - Clauses 17 and 18: the law and courts of [TBD: Ireland] - Annexes I and II of the SCCs are completed by Annexes I and II of this DPA, and Annex III by the Subprocessors page 5.3 For Customer Personal Data subject to the UK GDPR, the **UK Addendum** is incorporated. Its Tables 1 to 3 are completed with the information in this DPA and its annexes. In Table 4, either party may end the Addendum as allowed by its Section 19. 5.4 For Customer Personal Data subject to Swiss law, the SCCs apply with the necessary changes: references to the GDPR include the Swiss FADP, and the competent authority is the Swiss Federal Data Protection and Information Commissioner. 5.5 FoodPerfect ensures that onward transfers to Subprocessors are covered by appropriate safeguards, such as the SCCs or the EU-US Data Privacy Framework where the Subprocessor is certified. --- ## 6. Liability and Term 6.1 Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where Data Protection Laws or the SCCs do not allow such limits. 6.2 This DPA lasts for as long as FoodPerfect processes Customer Personal Data. --- ## Annex I: Details of Processing **Parties** - Data exporter / controller: the Customer, as identified in its FoodPerfect account. Contact: the account email. - Data importer / processor: FoodPerfect, as identified above. Contact: privacy@foodperfect.ai. **Categories of data subjects** - Customer's customers, followers, and other people who comment on or send messages to Customer's connected social accounts - People shown in, or named in, content Customer uploads or generates (for example staff and guests) - Customer's team members whose data appears in Customer's content or brand materials **Categories of personal data** - Public profile information from social platforms: usernames, display names, platform IDs, and profile pictures - Content of comments and direct messages, attachments, timestamps, replies, and moderation actions (when the inbox is enabled) - Images, video, and voice of people in uploaded or generated content - Names and contact details contained in Customer's brand materials, menus, or posts **Special categories of data** Not intended. Customers must not use the Service to process special category data. Messages from the public may nevertheless contain such data (for example a guest mentioning a health condition or allergy). Such data is processed only as part of the message content, under the measures in Annex II. **Nature and purpose of processing** Hosting, storage, AI generation and editing of content, scheduling and publishing to social platforms, retrieving, displaying, and classifying comments and messages, generating suggested or automatic replies, hiding, unhiding, or deleting comments at Customer's direction, and related support, all in order to provide the Service to Customer. **Frequency of transfer** Continuous, for as long as Customer uses the Service. **Duration and retention** For the term of the Terms of Service, then deleted as described in Section 3.7 and in the retention section of our [Privacy Policy](/legal/privacy-policy.md), including any shorter limits required by the platforms. **Subprocessors** See the [Subprocessors](/legal/subprocessors.md) page, which lists the subject matter, nature, and location of each Subprocessor's processing. --- ## Annex II: Technical and Organisational Measures - **Hosting:** Google Cloud (Firebase) infrastructure, with physical security, redundancy, and certifications managed by Google - **Encryption:** TLS for data in transit, and Google-managed encryption for data at rest - **Access control:** database and storage rules that restrict each user's data to that user. Server-side credentials and provider keys are kept in a secrets manager and never exposed to browsers. Administrative access is limited to the owner and authorised personnel on a least-privilege basis, with multi-factor authentication [TBD: confirm MFA is enabled on the Google Cloud/Firebase, Paddle, Zernio, and Runware admin accounts] - **Social platform tokens:** managed by our social publishing provider or kept in a restricted server-side store that client apps cannot read - **API security:** API keys are stored only as hashes, can be scoped, can expire, and can be revoked. Sensitive agent actions such as publishing and deleting use a two-step approval: the first request returns a single-use, time-limited token bound to the exact action, and the action runs only when that token is confirmed. Customer is responsible for configuring its agents so that an authorised person gives the confirmation. Requests are rate-limited, and retries are deduplicated with idempotency keys - **Integrity:** incoming webhooks from payment and publishing providers are signature-verified and deduplicated - **Outbound fetching:** URLs fetched by the Service are checked against a guard that blocks internal and unsafe network destinations - **Monitoring:** logging and error monitoring of the Service and its background jobs - **Data minimisation:** only the data needed for each feature is sent to each provider. Customer Personal Data is not used to train AI models - **Deletion:** deletion on request and at the end of the Service as described in this DPA - **Incident response:** a documented process to investigate, contain, and notify Security Incidents - **Subprocessor management:** providers are chosen on the basis of their security and data protection terms, and are bound by written agreements --- *This Data Processing Addendum is effective as of the Last Updated date above and is incorporated into our Terms of Service.*