Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Yaniv Presler ("Shager", "we") and the customer that uses Shager ("Customer", "you"). It applies automatically whenever Shager processes personal data on your behalf. If you need a signed copy, write to hello@shager.ai.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the EU General Data Protection Regulation 2016/679 ("GDPR"). Where the Israeli Privacy Protection Law, 5741-1981, and its regulations, including the Privacy Protection (Data Security) Regulations, 2017 and Amendment 13 ("Israeli Privacy Law") apply, the matching terms in that law apply as well ("database owner" corresponds to controller, "holder" to processor). "Data Protection Law" means all of these laws, as far as they apply.

"Customer Personal Data" means personal data that Shager processes on your behalf when providing the service.

2. Roles

• For Customer Personal Data, you are the controller and Shager is the processor.
• For the data of your own account holders that Shager needs to run the account (sign-in, billing, support), Shager is an independent controller under the Privacy Policy. This DPA does not cover that data.
• If you are yourself a processor for your clients, Shager is your subprocessor, and you confirm that your clients have authorised you to appoint us.

3. Details of the processing

4. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and the way you configure and use the service are your instructions. If we believe an instruction breaks Data Protection Law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids that.

You are responsible for having a lawful basis for the processing, and for giving data subjects the information the law requires.

5. Confidentiality

Everyone at Shager who can access Customer Personal Data is bound by confidentiality and accesses it only as needed to provide the service, to give support you asked for, or for security.

6. Security

We apply the technical and organisational measures in Annex 1, which are appropriate to the risk. We may improve them over time, but we will not reduce the overall level of protection.

7. Subprocessors

You give us general authorisation to use subprocessors. The current list is on our subprocessors page.

• We bind each subprocessor by a written contract with data protection obligations no less protective than this DPA.
• We will notify you at least 30 days before a new subprocessor starts processing Customer Personal Data, by email or in the app, and update the subprocessors page.
• You may object on reasonable data protection grounds within that period. We will then try in good faith to find a solution. If we cannot, you may terminate the affected service and receive a pro-rata refund of prepaid fees for it.
• We remain responsible to you for our subprocessors' performance.

The social networks you publish to (such as Meta and Google) are not our subprocessors. You choose to send content to them, and their terms apply.

8. International transfers

• Customer Personal Data is hosted in the European Union (Hetzner Online GmbH, servers in Helsinki, Finland).
• Some subprocessors are in the United States: Anthropic PBC (text a user chooses to send to the AI writing assistant), Resend, Inc. (delivery of the emails the service sends, such as sign-in links, approval requests and notifications) and Google LLC (our support inbox, if you write to us). Where these transfers include personal data from the EU, they rely on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses included in each provider's data processing terms.
• Transfers from Israel rely on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, including the transfer to EU countries, and on written undertakings from each subprocessor to protect the data and not to pass it on except as allowed.
• We will not transfer Customer Personal Data to another country without a lawful transfer mechanism.

9. Helping you

Taking into account the nature of the processing, we will help you:

• respond to data subject requests (access, correction, deletion, restriction, portability, objection). If we receive such a request directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to;
• meet your obligations on security, breach notification, data protection impact assessments and prior consultation with authorities.

Much of this you can do yourself in the app, for example by editing or removing approval contacts, deleting posts and removing connected accounts.

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and in any case within 72 hours. The notice will describe, as far as we know at the time, what happened, the data and data subjects affected, the likely consequences, and what we have done or propose to do. We will send further information as it becomes available, and take reasonable steps to contain the breach.

11. Deletion and return

• While the service is active, you can edit and remove approval contacts, delete posts and remove connected accounts in the app. A removed approval contact gets no new requests; their past decisions stay in the post's history until the post or workspace is deleted. A copy of your data, or deletion of a whole workspace or account, is done on request: write to hello@shager.ai.
• When the service ends, or when you ask, we delete Customer Personal Data within 30 days. Backups rotate within 30 days, so the data also leaves our backups within 30 days after it is deleted, unless the law requires us to keep it.
• Before deletion you can ask us for a copy of your data in a common machine-readable format.
• Access tokens are deleted immediately when you remove a connected account (and for YouTube, also revoked at Google).

12. Audits

We will make available the information needed to show compliance with this DPA, including written answers to reasonable security questionnaires, once a year or after a personal data breach. If that is not enough, or an authority requires it, you may audit us, at your cost, with at least 30 days' notice, during business hours, without disrupting the service, and through an auditor bound by confidentiality. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.

13. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, as far as the law allows.

14. Order of precedence and law

If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is governed by the law and jurisdiction set out in the Terms, except where Data Protection Law requires otherwise.

Annex 1: Security measures

Encryption

• All connections use TLS (HTTPS), including between the app and the networks' APIs.
• Social network access tokens are encrypted at rest with AES-256-GCM.
• Passwords are stored only as salted hashes.

Access control

• Access to production servers and databases is limited to the operator. Server login uses SSH keys only; password login is disabled.
• In the app, each workspace is separated from the others, and team roles control who can do what.
• Sessions use secure, HTTP-only cookies.
• Client approval links carry a random token that is stored only as a hash, expire, can be revoked, and give access to a single post only.

Data minimisation

• We request only the OAuth permissions each feature needs (least privilege).
• Short-link clicks are recorded without IP addresses, using a one-way visitor code that rotates daily.
• Only text the user chooses to send reaches the AI writing assistant.

Availability and recovery

• Servers are hosted in the EU, in a professional data centre. Media files are stored on our own servers, not with a third-party storage provider.
• Daily backups, each kept for at most 14 days. Deleted data disappears from backups within 30 days.

Operations

• Operating system security updates are installed automatically.
• A firewall allows only web (HTTP/HTTPS) and SSH traffic.
• Vulnerabilities can be reported to hello@shager.ai (see the security page).

Annex 2: Subprocessors

Let's Encrypt and GoDaddy (certificates and DNS) do not receive Customer Personal Data. The country lookup for the website's language uses a database copy on our own servers (DB-IP); no data is sent to DB-IP. The current list, with any changes, is on the subprocessors page, which is part of this DPA.