Data Processing Agreement (DPA)
Effective date: 13 June 2026 · Sitemaker Lab
This Data Processing Agreement ("DPA") governs the processing of personal data by Post Pilot, operated by Sitemaker Lab, on behalf of our business customers. It forms part of the Terms of Service between the business customer and Post Pilot.
1. Overview
This DPA applies to business customers using Post Pilot who process the personal data of their own customers (such as end-users sending messages or interacting through WhatsApp and Instagram automations) on our platform. This agreement ensures that we handle and process that data in compliance with standard data protection principles.
2. Definitions
- Controller: The customer who uses Post Pilot and determines the purposes and lawful means of processing personal data.
- Processor: Post Pilot, which processes personal data strictly on behalf of and according to the instructions of the Controller.
- Personal Data: Any information relating to an identified or identifiable natural person that is processed through the platform.
- Processing: Any operation performed on personal data, including collection, recording, storage, retrieval, transmission, and erasure.
3. Scope
Post Pilot acts as a Data Processor on behalf of the business customer (who acts as the Data Controller) when processing end-customer personal data (including phone numbers, contact names, conversation histories, and message content) through our automated WhatsApp, Instagram, and Google Business Profile integrations.
4. Our Obligations as Processor
As Processor, Post Pilot agrees to:
- Process on Instructions: Process personal data only on documented instructions from the Controller, including with respect to data transfers, unless required to do so by applicable law.
- Technical Security: Implement appropriate technical and organizational measures to secure processing (including AES-256-GCM encryption for platform access tokens and HTTPS protocols for all data transmission).
- Confidentiality: Ensure that our personnel authorized to process personal data have committed themselves to strict confidentiality agreements.
- Breach Notification: Notify the Controller within 72 hours of becoming aware of any accidental or unlawful personal data breach.
- Data Erasure: Delete or return all personal data upon termination of the subscription service in accordance with our standard data retention timelines.
5. Controller Obligations
As Controller, you are responsible for:
- Ensuring you have a valid lawful basis to collect, store, and process your customers' personal data.
- Obtaining all necessary consents, opt-ins, and agreements from your end-users before initiating automated messaging or scheduling interactions via Post Pilot.
- Providing accurate processing instructions to Post Pilot through your platform settings.
6. Subprocessors
The Controller consents to the engagement of the following subprocessors to deliver platform features:
- Groq / Google Gemini / Replicate: Artificial intelligence subprocessors used for text processing, translation, and automated comment/reply generations.
- Razorpay / Dodo Payments: Billing and payment infrastructure subprocessors for subscription invoicing and transaction processing.
- Redis / BullMQ: Self-hosted infrastructure components for scheduling and queuing automation workflows.
7. International Data Transfers
Post Pilot processes and stores data primarily in India. The Controller authorizes transfers of personal data to subprocessors globally, provided that such transfers comply with applicable data protection laws and are conducted under standard contractual safeguards.
8. Contact for DPA Requests
For any questions, signed execution requests, or issues regarding this Data Processing Agreement, please contact us directly at [email protected].