DM CopilotData Processing Agreement
Last updated: 5 November 2026 · Article 28 GDPR
This agreement ("DPA") is part of the Terms of Service between you, the account holder ("Controller"), and Stevan Savic, Tenerife, Spain ("Processor"). It applies when the Processor processes personal data for the Controller through DM Copilot. By using the Service you accept this DPA. If you need a signed copy, email us and we send one.
1. Subject, nature and purpose
| Subject | Reading, storing and analysing the Controller's Messenger conversations and leads, to score leads, set stages and suggest replies. |
|---|---|
| Nature | Collection by the Controller's own browser extension, storage, AI analysis, display in the dashboard, deletion. |
| Purpose | Only to provide the Service to the Controller. |
| Duration | For the life of the Controller's account, plus up to 90 days for deletion after the account closes. |
| Data subjects | The Controller's contacts and leads on Facebook and Messenger. |
| Categories of data | Names, profile photos, profile and thread links, message content and dates, and any other data that appears in the conversations the Controller chooses to process. |
| Special categories | Not intended. If a conversation contains them, the Controller is responsible for its lawful basis. |
2. Processor obligations
- Process personal data only on the Controller's documented instructions. Using the Service as designed is the Controller's instruction. If an instruction breaks data protection law, the Processor tells the Controller.
- Make sure every person with access is bound by confidentiality.
- Apply the security measures in section 5.
- Help the Controller answer data subject requests (access, correction, deletion) and with impact assessments, as far as the Processor reasonably can.
- Tell the Controller about a personal data breach without undue delay, and within 48 hours after the Processor becomes aware of it, with the information available at that time.
- At the end of the Service, delete the Controller's personal data within 90 days, unless law requires storage.
- Give the Controller the information needed to show compliance with this DPA, and allow reasonable audits with 30 days' notice, no more than once a year, at the Controller's cost.
3. Controller obligations
- Have a lawful basis for processing the data of its contacts and leads, and give them any notice the law requires.
- Use the Service in line with the law and with Meta's terms.
- Process in the Service only the conversations needed for its business.
4. Sub-processors
The Controller gives general authorisation for these sub-processors. The Processor tells the Controller at least 14 days before adding or replacing one. The Controller can object on reasonable data protection grounds. The Processor puts the same data protection duties on each sub-processor.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, login, server functions | EU (Ireland) |
| Anthropic | Writes suggested replies (paid API, no training on API data) | United States |
| Google (Gemini API, paid tier) | Reads and tags conversations; answers pipeline questions | United States / global |
| Netlify | Hosts the dashboard | United States / global |
5. Security measures
- All traffic uses HTTPS.
- Row-level security separates each account's data at the database level.
- Provider keys that the Controller adds are encrypted before storage.
- Server keys stay on the server. They never reach the browser or the extension.
- Access to production systems is limited to the Processor and protected by two-step verification.
- Spend limits and usage logs detect abnormal use.
6. Transfers outside the EEA
Some sub-processors process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the sub-processor is certified, or on the European Commission's Standard Contractual Clauses.
7. Liability and order of documents
The limit of liability in the Terms of Service applies to this DPA, except where the law does not allow it. If this DPA and the Terms conflict on data protection, this DPA applies.
8. Contact
Data protection questions and breach contact: support@buyercreator.com