Data Processing Agreement

This agreement is part of the Terms of Service between SisleLabs OOD ("Puncho", "we", the processor) and the customer ("you"). It applies whenever a workspace holds personal data that you, or the client you work for, are responsible for. It is written to meet Article 28 of the GDPR.

Roles

For personal data in the content of a workspace, you are the controller, or you are a processor acting for your client, who is the controller. We are your processor, or your sub-processor in the second case. If you act for a client, you confirm that the client allows you to use us.

For the accounts of the people who use Puncho and for billing, we are a controller ourselves. The Privacy Policy covers that data and this agreement does not.

What is processed, and why

Subject matter and purpose. Running Puncho for you: storing each brand's material, drafting ad concepts and designs with AI models, creating ads in your Meta ad account when you launch them, publishing posts you schedule, and reading results back.

Duration. For as long as you have a workspace, and afterwards until the data is deleted or returned as set out under When the agreement ends.

Nature of the processing. Storing, organising, reading, sending to the sub-processors listed, changing on your instruction, and deleting.

Types of personal data. Puncho does not ask for personal data in a workspace. It is a tool for a brand's advertising material. Personal data gets in when you or your client put it there. It can be in:

• writing samples, such as emails or messages the brand wrote to real readers;
• briefs, notes and the reasons given for rejecting a concept;
• pictures and videos: product photos, reference ads, the brand's own posts, finished ads. A picture can show a person;
• the brand's organic posts and their captions;
• text and pictures read from a website you point Puncho at.

Ad results hold no personal data. What Puncho reads from Meta is totals per ad per day: spend, impressions, clicks, landing page views, purchases and revenue. It receives nothing about the individual people who saw or clicked an ad. Puncho sets an audience by place, age and similar settings, and uploads no customer lists to Meta.

Special categories. Puncho is not built for special categories of personal data or for data about criminal convictions. Do not put them in a workspace.

Data subjects. Whoever appears in the material: the brand's customers, employees and contacts, people in photos and videos, and people named in the brand's writing.

Your instructions

We process the personal data only on your documented instructions. Your instructions are these terms and what you, your team and the agents you connect do in the app: saving material, starting generation, launching an ad, scheduling a post, deleting.

If the law requires us to process the data in another way, we will tell you first unless that law forbids it. If we think an instruction breaks data protection law, we will tell you.

We do not use the content of a workspace for our own purposes. We do not use it to train AI models, and we do not sell it.

Agents and apps you connect

You can connect your own AI app or agent to a workspace. It can then read and change that workspace under the account of the person who connected it.

That app is your choice of processor. It is not our sub-processor, and what it does with what it reads is between you and its maker. Sending data to it when it asks is one of your instructions to us. You can disconnect an app or revoke a token in Settings at any time, and access stops at once.

Your Meta account

When you launch an ad or schedule a post, Puncho sends the picture or video, the ad's words, its link, and the campaign's settings to Meta, into the ad account and under the Page that you gave Puncho access to. That is your instruction, and your agreement with Meta covers what Meta does with it. Meta is not our sub-processor for that content.

Confidentiality

Everyone at Puncho who can reach customer data is bound to keep it confidential.

Workspace content is not shown to our staff in the ordinary running of the service. The admin screens we use show a workspace's name, plan, seats and ad accounts, and no project content. A member of our staff with platform admin rights can add themselves to a workspace, and anyone with access to the servers can read the database. We do either only to support you at your request, to fix a fault or to keep the service secure.

Security measures

These are in place in the product today:

• Sign-in is required everywhere. Every page, action and file needs a signed-in member. The exceptions are the sign-in page, an invitation link, a client report, the address an AI app connects to (which needs a token), and links that let Instagram fetch a scheduled post's picture. Each request is checked against the database twice: once at the door and again by the page or action itself.
• No public sign-up. An account starts with an invitation from an owner or admin.
• Each workspace is separate. Every read and write is limited to the caller's workspace, and every record named in a request is checked to belong to it. A record in another workspace is reported as not found.
• Each brand is separate. What generation reads is limited to one project, so one client's material is not used for another's.
• Passwords are stored as salted hashes (scrypt).
• Personal API tokens are shown once and stored only as a SHA-256 hash. A revoked token stops working at once.
• Connected apps act for one person in one workspace. The person's approval and membership are read again on every call, so removing either stops the app at once.
• Roles. A workspace has owners, admins and members. Only an owner or admin invites or removes people, and only an owner handles billing.
• Stored files are read through one guard that refuses any path outside the app's storage, and are served only to members of the workspace that owns them.
• Outbound requests are guarded. When Puncho fetches an address a user gave it, such as a brand's website, it refuses private and internal network addresses, on every redirect.
• A client report opens only with a long random link that you create, can replace and can turn off. It shows only the pictures and results of ads that reached Meta.
• Links for Instagram are signed, expire after an hour, and serve only the picture of a post that is scheduled to go out.
• Payment events from Stripe are accepted only with a valid signature.
• Spend controls. Every ad is created paused, a person approves each ad, and a spend ceiling is checked before any budget is sent to Meta.
• Everything travels encrypted. Puncho is reached over HTTPS only, by browsers and by the AI apps and agents that connect to it. Connections to Meta, Stripe and the AI providers use HTTPS as well.
• Backups are kept for 31 days.

Sub-processors

You give us general permission to use sub-processors. The current ones, with what each receives, are on the sub-processor list.

We bind each sub-processor by contract to data protection duties that match this agreement, and we remain responsible to you for what they do.

At least 30 days before we add or replace a sub-processor we will update that list and tell the owners of each workspace by email. You can object on reasonable data protection grounds. If we cannot resolve the objection, you may end the agreement.

Transfers outside the EEA

The app, its database and its files are kept in the European Union, with Hetzner Online GmbH.

The makers of the AI models process data in the United States: Anthropic, OpenAI, Google and Recraft. Workspace content reaches one of them only when the feature that uses it runs, as the sub-processor list sets out. Each of those transfers is covered by the EU's standard contractual clauses, which are part of the data processing agreement we have with that company.

Helping you

Requests from people. If someone asks us about their data in your workspace, we will pass the request to you and not answer it ourselves. We will help you answer it. You can find, correct and delete most material in the app yourself. Where you need a copy of data, ask us and we will produce it: an export in the app is being built.

Security, impact assessments and the regulator. We will give you the information you reasonably need for your own duties on security, data protection impact assessments and consulting the supervisory authority, as far as it concerns our processing.

Breaches. If we learn of a personal data breach that affects your data, we will tell the owners of your workspace by email without undue delay, and within 72 hours of learning of it. We will say what we know about what happened, what data and whom it concerns, and what we are doing about it.

Deleting data while you are a customer

This is what the app does today:

• A single item. Deleting a reference, a writing sample or a brand asset removes its record, and its file unless another record still uses that file. Deleting a concept removes its record, its renders and its main picture.
• A project. Deleting a project removes everything on its board: brand kit, references, writing samples, notes, briefs, concepts, designs, renders, campaign settings and calendar entries, with their files in our storage.
• A project with ads on Meta cannot be deleted in the app. Once any of its concepts has reached Meta, spend and results are recorded against it and the app refuses. The same holds for a single concept that was launched. Ask us and we will delete it.
• Some files are not yet removed with their records: the parts generated for a design, a picture uploaded for a calendar post, fonts you uploaded, and, when a single concept is deleted, its 9:16 version, video and design export. Ask us and we will remove them.
• Nothing is deleted on a schedule, and nothing is deleted when a plan ends.

Deleting in Puncho deletes nothing in your Meta account. What you sent to an AI app you connected is with that app.

When the agreement ends

When you stop being a customer, tell us whether you want your data returned or deleted. Buttons for both are being built. Until they are in the app we do both by hand:

• on request we give you a copy of the workspace's records and files;
• we then delete the workspace, its projects and its files from our database and storage, including the projects the app would not let you delete;
• copies held by sub-processors are deleted under their terms.

We finish the deletion within 31 days of your request, or of the agreement ending. Backups are kept for 31 days, so the workspace is gone from them 31 days after that.

After that we keep nothing of the workspace, apart from what the law requires us to keep, such as invoices.

Audits

We will give you the information needed to show that we meet this agreement. Where that is not enough, you or an auditor you appoint may audit our processing of your data, at your own cost, with reasonable notice and no more than once a year.

Liability and order of documents

The limits of liability in the Terms of Service apply to this agreement. Where this agreement and the terms disagree about personal data, this agreement decides.

Governing law

This agreement is governed by the law of the Republic of Bulgaria. Disputes go to the competent court in Pazardzhik, Bulgaria.

Contact

Data protection questions and notices: support@puncho.app.