This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer", the controller) and Kaifunds LLC, a New Mexico limited liability company ("Suarga", the processor). It applies when Suarga processes personal data on your behalf, under the EU GDPR, the UK GDPR and similar laws. It takes effect when you accept the Terms; no signature is needed.
1. Scope of processing
- Subject matter: scheduling and publishing social media content and reporting on its performance.
- Duration: for the term of your subscription, plus the deletion period in section 9.
- Data subjects: your users and teammates, your clients and their staff, and people who appear in or are mentioned in your content.
- Personal data: names, email addresses, social account identifiers, content and media, approval comments, post statistics.
- Special categories: none intended. Don't upload special category data unless your content requires it and you have a lawful basis.
2. Instructions
Suarga processes personal data only on your documented instructions, which are the Terms, this DPA and your use of the Service. We will tell you if we believe an instruction breaks data protection law.
3. Confidentiality
Everyone at Suarga who can access personal data is bound by confidentiality.
4. Security
We maintain appropriate technical and organisational measures, including encryption in transit and at rest, access control based on least privilege, audit logs, separate development and production data, and regular backups with tested restore.
5. Sub-processors
You give general authorisation for the sub-processors below. Each sub-processor is bound by data protection terms at least as protective as this DPA, and we remain responsible for their work. PT Karia Nata Group develops and operates the Service for Suarga and owns the Suarga app registered with Meta; it processes personal data only on Suarga's instructions.
| Sub-processor | Purpose | Location |
|---|---|---|
| PT Karia Nata Group | Develops, operates and supports the Service, including our official integrations with Instagram, Facebook and Threads | Indonesia |
| Social publishing provider | Connects your social accounts and publishes the posts you schedule | Indonesia |
| Cloudflare, Inc. | Hosting, application runtime, file storage, bot protection | Global edge network, United States |
| Neon | Managed Postgres database | United States |
| Stripe, Inc. | Payments, invoicing and sales tax | United States |
| Resend, Inc. | Transactional email (sign-in links, approvals, reports, alerts) | United States |
| Google LLC | Optional sign-in with Google | United States |
We will give at least 30 days' notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we can't resolve it, you may cancel and receive a pro rata refund of any prepaid period. Social platforms you choose to publish to are not our sub-processors; they receive content at your direction.
6. International transfers
Where personal data leaves the EEA, UK or Switzerland for a country without an adequacy decision, the Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum apply and are incorporated by reference.
7. Assistance
We help you answer data subject requests, mostly through product features such as export and deletion. We also give reasonable help with data protection impact assessments and consultations with authorities.
8. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. The notice will describe what happened, the likely impact and what we are doing about it, and we will update you as we learn more.
9. Return and deletion
You can export your data at any time. When your subscription ends, you can export for 30 days; we then delete personal data within a further 30 days, except where the law requires us to keep it. Seedata deletion.
10. Audits
We will make available the information needed to demonstrate compliance with this DPA. If that is not enough, you may audit once a year with 30 days' notice, at your cost, under confidentiality, and without disrupting the Service.
11. Contact
Data protection contact: privacy@suarga.app.