Data Processing Addendum

This Addendum forms part of the Terms of Use between Chockstone Labs LLC (“we”, the processor) and each customer of the Chockstone Labs social media service (the “Customer”, the controller) when the service processes personal data for the Customer. It is written for United States privacy laws, including the “service provider” terms of the California Consumer Privacy Act.

1. Roles and scope

The Customer decides why and how personal data in its space is processed. We process it only on the Customer’s behalf, to provide the service. The data involved:

The service does not need sensitive personal data, and the Customer should not upload it.

2. Our obligations

We will:

• process personal data only on the Customer’s documented instructions (these terms, the Customer’s settings and its approvals), and tell the Customer if we believe an instruction breaks the law;
• not sell or share it, use it for advertising, combine it with other data, or use it to train AI models, and not retain, use or disclose it outside the business purpose of providing the service;
• make sure everyone who can access it is bound to confidentiality;
• keep the security measures in section 4;
• help the Customer answer requests from people exercising their privacy rights, using the service’s export and delete functions or on request;
• tell the Customer without undue delay, and within 72 hours of confirming it, about a personal data breach affecting its data, with what we know and what we are doing about it;
• delete or return the data when the Customer’s use ends, as in section 6;
• make available the information needed to show compliance, and answer reasonable written audit questions once a year.

3. Subprocessors

The Customer authorizes the subprocessors listed at chockstonelabs.com/legal/subprocessors. We bind each to data-protection terms at least as protective as these and remain responsible for them. We will post a change to that list, and email the Customer’s owners, at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable grounds and, if we cannot resolve the objection, end the affected service.

Instagram, TikTok, YouTube and the other networks the Customer connects, and the AI assistants the Customer connects, are not our subprocessors: the Customer chooses to send data to them, and their own terms apply.

4. Security measures

• Hosting in the United States on Replit; data encrypted in transit with TLS.
• Platform access tokens encrypted at rest with AES-256-GCM, under a key kept outside the database.
• Each Customer’s data separated by PostgreSQL row-level security, forced on every customer table and checked before the service starts.
• API keys, sign-up links and invitation links stored only as hashes and shown once.
• Sign-in through Clerk; roles and per-workspace limits on what each person, key and AI connection can do; sensitive actions need a signed-in person.
• An activity log of what each person, key and agent did.
• Rate limits, security headers and server-side checks on every request.
• Access by our staff only when needed to run or support the service.

5. Where data is processed

Data is processed in the United States.

6. Deletion

When a connected account is disconnected, its access tokens are deleted immediately and its other data within 30 days. When the Customer’s use of the service ends, we delete its personal data within 30 days unless the law requires us to keep it; before then the Customer can export it. Backups holding it are deleted as they expire.

7. Order of precedence

If this Addendum conflicts with the Terms of Use about personal data, this Addendum wins.

Questions

Questions about this Addendum may be sent to hello@chockstonelabs.com.