# Data Processing Addendum

This Data Processing Addendum ("**DPA**") is part of the [Terms of Service](/en/terms) between יניב פרסלר (Yaniv Presler) ("**Shager**", "**we**") and the customer that uses Shager ("**Customer**", "**you**"). It applies automatically whenever Shager processes personal data on your behalf. If you need a signed copy, write to yaniv.presler@gmail.com.

## 1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the EU General Data Protection Regulation 2016/679 ("**GDPR**"). Where the Israeli Privacy Protection Law, 5741-1981, and its regulations, including the Privacy Protection (Data Security) Regulations, 2017 and Amendment 13 ("**Israeli Privacy Law**") apply, the matching terms in that law apply as well ("database owner" corresponds to controller, "holder" to processor). "**Data Protection Law**" means all of these laws, as far as they apply.

"**Customer Personal Data**" means personal data that Shager processes on your behalf when providing the service.

## 2. Roles

- For Customer Personal Data, **you are the controller** and **Shager is the processor**.
- For the data of your own account holders that Shager needs to run the account (sign-in, billing, support), Shager is an independent controller under the [Privacy Policy](/en/privacy). This DPA does not cover that data.
- If you are yourself a processor for your clients, Shager is your subprocessor, and you confirm that your clients have authorised you to appoint us.

## 3. Details of the processing

| Item | Description |
|---|---|
| Subject matter | Providing Shager: scheduling, approving, publishing and measuring social media content |
| Duration | For the term of the Terms of Service, plus the deletion periods in section 11 |
| Nature | Storage, hosting, organisation, transmission to the social networks you choose, retrieval of results, deletion |
| Purpose | Only to provide the service to you, as described in the Terms and as you configure it |
| Categories of data subjects | Your staff and team members; your clients and their contact persons; people who approve content; people who click your short links; leads you capture; people who appear in your content |
| Categories of personal data | Names, email addresses, phone numbers, job roles; social account IDs, names, pictures and access tokens; content you upload (text, images, video), which may include people's likeness; approval decisions; short-link click data (time, country, coarse device type, referring site, a daily-rotating one-way visitor code, **no IP address**); lead details you choose to collect |
| Special categories | Not intended. Do not upload special categories of personal data unless you have a lawful basis and have told us |

## 4. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and the way you configure and use the service are your instructions. If we believe an instruction breaks Data Protection Law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids that.

You are responsible for having a lawful basis for the processing, and for giving data subjects the information the law requires.

## 5. Confidentiality

Everyone at Shager who can access Customer Personal Data is bound by confidentiality and accesses it only as needed to provide the service, to give support you asked for, or for security.

## 6. Security

We apply the technical and organisational measures in **Annex 1**, which are appropriate to the risk. We may improve them over time, but we will not reduce the overall level of protection.

## 7. Subprocessors

You give us general authorisation to use subprocessors. The current list is on our [subprocessors page](/en/subprocessors).

- We bind each subprocessor by a written contract with data protection obligations no less protective than this DPA.
- We will notify you at least **30 days** before a new subprocessor starts processing Customer Personal Data, by email or in the app, and update the subprocessors page.
- You may object on reasonable data protection grounds within that period. We will then try in good faith to find a solution. If we cannot, you may terminate the affected service and receive a pro-rata refund of prepaid fees for it.
- We remain responsible to you for our subprocessors' performance.

The social networks you publish to (such as Meta and Google) are not our subprocessors. You choose to send content to them, and their terms apply.

## 8. International transfers

- Customer Personal Data is hosted in the European Union (Hetzner Online GmbH, servers in Helsinki, Finland).
- Text that a user chooses to send to the AI writing assistant is processed by Anthropic PBC in the United States. Where such text includes personal data from the EU, the transfer relies on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses included in the provider's data processing terms.
- Transfers from Israel rely on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, including the transfer to EU countries.
- We will not transfer Customer Personal Data to another country without a lawful transfer mechanism.

## 9. Helping you

Taking into account the nature of the processing, we will help you:
- respond to data subject requests (access, correction, deletion, restriction, portability, objection). If we receive such a request directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to;
- meet your obligations on security, breach notification, data protection impact assessments and prior consultation with authorities.

Much of this you can do yourself in the app, for example by editing or deleting contacts, posts and accounts.

## 10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you **without undue delay, and in any case within 72 hours**. The notice will describe, as far as we know at the time, what happened, the data and data subjects affected, the likely consequences, and what we have done or propose to do. We will send further information as it becomes available, and take reasonable steps to contain the breach.

## 11. Deletion and return

- While the service is active, you can export and delete your data in the app.
- When the service ends, or when you ask, we delete Customer Personal Data within **7 days**, and from backups within **30 days**, unless the law requires us to keep it.
- Before deletion you can ask us for a copy of your data in a common machine-readable format.
- Access tokens are deleted immediately when you remove a connected account (and for YouTube, also revoked at Google).

## 12. Audits

We will make available the information needed to show compliance with this DPA, including written answers to reasonable security questionnaires, once a year or after a personal data breach. If that is not enough, or an authority requires it, you may audit us, at your cost, with at least 30 days' notice, during business hours, without disrupting the service, and through an auditor bound by confidentiality. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.

## 13. Liability

Each party's liability under this DPA is subject to the limitations of liability in the [Terms of Service](/en/terms), as far as the law allows.

## 14. Order of precedence and law

If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is governed by the law and jurisdiction set out in the Terms, except where Data Protection Law requires otherwise.

## Annex 1: Security measures

### Encryption
- All connections use TLS (HTTPS), including between the app and the networks' APIs.
- Social network access tokens are encrypted at rest with AES-256-GCM.
- Passwords are stored only as salted hashes.

### Access control
- Access to production servers and databases is limited to the operator. Server login uses SSH keys only; password login is disabled.
- In the app, each workspace is separated from the others, and team roles control who can do what.
- Sessions use secure, HTTP-only cookies.
- Client approval links carry a random token that is stored only as a hash, expire, can be revoked, and give access to a single post only.

### Data minimisation
- We request only the OAuth permissions each feature needs (least privilege).
- Short-link clicks are recorded without IP addresses, using a one-way visitor code that rotates daily.
- Only text the user chooses to send reaches the AI writing assistant.

### Availability and recovery
- Servers are hosted in the EU, in a professional data centre. Media files are stored on our own servers, not with a third-party storage provider.
- Daily server backups. Deleted data disappears from backups within 30 days.

### Operations
- Operating system security updates are installed automatically.
- A firewall allows only web (HTTP/HTTPS) and SSH traffic.
- Vulnerabilities can be reported to yaniv.presler@gmail.com (see the [security page](/en/security)).

## Annex 2: Subprocessors

See the [subprocessors page](/en/subprocessors), which is part of this DPA.

---
Source: https://shager.ai/en/dpa