Data Processing Agreement

This DPA is between you (the customer) and R7AD, operator of EvoViral. Where you use EvoViral to handle the personal data of the people who comment on or message your connected accounts (your customers), you are the controller and we are the processor. Where you are an agency, this DPA also covers your end clients, and you confirm you are authorized to enter into it on their behalf.

For your own account data (for example, your sign-in email and billing details), we act as a controller as described in our Privacy Policy.

We process personal data only to provide the features you enable — connecting accounts, running comment, DM, chat and auto-reply automations, sending the replies those automations create, showing your stats and running diagnostics — for the duration of your subscription. We do not process it for our own purposes, we do not sell it, and we do not use it for advertising or profiling.

• Data subjects — the people who comment on or message your connected accounts, and the members of your workspace.
• Data categories — platform username and IDs, message and comment content, timestamps, connection identifiers, and automation configuration. We do not request special categories of data; you should not configure automations that require them.

We process personal data only on your documented instructions (which include your configuration of the features), keep the people we authorize to handle it under confidentiality, and assist you in meeting your own obligations under applicable data protection law.

You give us general authorisation to engage subprocessors, listed on our Subprocessors. Each subprocessor is bound by written terms at least as protective as this DPA, and we remain responsible for their performance.

We will give notice before adding or replacing a subprocessor that processes personal data, and give you a reasonable chance to object. If you object on reasonable data-protection grounds and we cannot accommodate it, you may end the affected part of the service.

Some of our subprocessors store or process data outside your country, including in the United States. Where a transfer needs a safeguard, we rely on an appropriate transfer mechanism (for example, the Standard Contractual Clauses or an approved adequacy framework) put in place with each provider.

We apply the technical and organisational measures described on our Security page — including encryption in transit, row-level isolation between workspaces, signed webhooks, rate limiting and access control — and we keep them under review. No method of storage or transmission is perfectly secure, and the measures are not a guarantee against all incidents.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware, with the information you need to meet your own notification duties. We will take reasonable steps to contain and remediate it.

We will help you respond to requests from data subjects (access, correction, deletion, portability and similar). Requests for your connected customers’ data should come to you first; we will assist through the tools you already have and via our support desk. We will not respond to a data subject directly unless the law requires it.

We will make available the information reasonably needed to show we comply with this DPA, and allow audits, subject to confidentiality and to reasonable notice and scope. Where an independent audit report exists, we will share it rather than repeat an on-site audit.

On termination you can export your data first (Settings → Account), and we will delete or anonymize the personal data we process for you, except what we must keep by law (for example, tax and accounting records) or to resolve disputes. Backups are rotated and overwritten on a fixed schedule.

Each party is liable to the other for its breach of this DPA as set out in the main agreement between you and us. Our total liability under this DPA is subject to the same limits as the main agreement, and nothing here limits liability that cannot be limited by law.

We may update this standard DPA to reflect changes in law or our service; the version that applies is the one in effect when your processing happens, unless a signed agreement says otherwise. Questions or a request for an executed copy: contact our support desk.