Data processing agreement

For the client and brand data you put into Slynnk, you are the controller (or processor for your own customer) and Slynnk is the processor. For account and website data about you, Slynnk is the controller and the privacy policy applies.

• Subject matter: providing the Slynnk service.
• Duration: while your account is active, then until deletion as set out below.
• Nature and purpose: storing and analysing the prompts you set, the AI answers collected for them and derived metrics; producing reports and notifications.
• Data: names and business contact details of your team and client contacts, and any personal data that appears in prompts or in AI answers (we advise against including it).
• Data subjects: your team members, and individuals who may be named in prompts or answers.

• Process the data only on your documented instructions, which are the use of the service and these terms.
• Make sure people authorised to process it are bound by confidentiality.
• Apply appropriate technical and organisational measures: encryption in transit, role-based access, hashed share-link tokens, signature-verified webhooks, audit of administrative actions, and separation of customers' data by organization.
• Help you respond to requests from data subjects: data export and deletion are available in the product, and we assist with anything else.
• Tell you without undue delay, and within 72 hours where we can, after becoming aware of a personal data breach affecting your data.
• Delete or return your data when the service ends: you can export it at any time, and we delete it within 30 days of account deletion and from backups within 35 days.
• Make available the information needed to show compliance and allow reasonable audits, by questionnaire first.

You authorise the following sub-processors. We will give notice by email to account owners of additions or replacements, and you may object on reasonable data protection grounds.

• Supabase: Database hosting (all account and tracking data). Region chosen at project creation.
• Vercel: Web application hosting. Global edge, application region configurable.
• Oracle Cloud: Background worker (collection, analysis, PDF reports). Region chosen at deployment.
• Dodo Payments: Payment processing and subscription billing (merchant of record). Per Dodo's terms.
• Resend: Transactional and notification email. United States.
• cloro: Collecting AI answers for the prompts you track. Per cloro's terms.
• Bright Data: Collecting AI answers for free scans and as a backup collector. Per Bright Data's terms.
• Anthropic: Reading stored answers (sentiment, perception) and drafting fixes, when enabled. United States.
• OpenAI: Optional ChatGPT API cross-check, when enabled. United States.
• Cloudflare Turnstile: Bot protection on the free scan. Global.
• Sentry: Error reports, when enabled (no customer content is sent on purpose). Per project setting.
• PostHog: Product analytics, only if you allow analytics cookies. Per project setting.

Each is bound by terms no less protective than these.

Where processing involves a transfer out of the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on the standard contractual clauses (processor-to-processor or controller-to-processor as applicable), which are incorporated by reference.

Data protection questions and requests to sign a separate copy of this agreement: hello@slynnk.com.