Data Processing Agreement

Last updated: September 28, 2026

This DPA forms part of the Terms of Service between SignalPipe (“Processor”) and operators (“Controller”) who submit personal data to the SignalPipe backend. It applies where the GDPR or UK GDPR governs the processing.

1. Definitions

  • Controller — the operator who determines the purposes and means of processing personal data (you).
  • Processor — SignalPipe, acting on the Controller's instructions.
  • Personal Data — public posts and their authors' public handles read from the feeds the Controller chooses, text the Controller submits for scoring, and the prospect handles (usernames, email addresses) and interaction signals the Controller records in the backend.
  • Processing — storing, retrieving, scoring, and generating outreach messages against Personal Data as instructed by the Controller.

2. Scope and nature of processing

Subject matterLead scoring and prospect nurturing on behalf of the Controller
DurationFor the term of the service relationship
NatureStorage, retrieval, LLM-assisted message generation, temperature tracking
Data typesPublic post text, text submitted for scoring, social media handles, email addresses, interaction timestamps, channel identifiers
Data subjectsProspects identified by the Controller via the scouting pipeline

3. Processor obligations

SignalPipe as Processor shall:

  • Process Personal Data only on documented instructions from the Controller (i.e. API calls made using the Controller's operator key).
  • Ensure personnel authorised to process Personal Data are bound by confidentiality obligations.
  • Implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, loss, or destruction.
  • Not engage sub-processors without the Controller's general authorisation. The sub-processors listed in the Privacy Policy constitute that general authorisation.
  • Assist the Controller in fulfilling data subject rights requests (access, erasure, portability) within a reasonable timeframe.
  • Delete or return all Personal Data upon termination of the service, at the Controller's election, within 30 days.
  • Make available all information necessary to demonstrate compliance with this DPA and allow for audits upon reasonable notice.
  • Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a Personal Data breach.

4. Controller obligations

The Controller shall:

  • Ensure there is a lawful basis under GDPR Article 6 for submitting prospect Personal Data to the Processor.
  • Provide data subjects with appropriate transparency notices about how their data is used.
  • Not instruct the Processor to process data in a manner that would violate applicable law.
  • Keep operator credentials confidential and notify SignalPipe immediately if a key is compromised.

5. Sub-processors

The current list of sub-processors is maintained in our Privacy Policy. We will provide at least 14 days' notice of any new sub-processor that handles Personal Data. The Controller may object within that period; if no resolution is reached, the Controller may terminate the service without penalty.

6. International transfers

The primary database (Supabase) is hosted in the EU (Frankfurt). Some sub-processors (Railway, Vercel, OpenAI, Anthropic, Stripe) are based in the United States. For these transfers we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR Article 46. Copies of applicable SCCs are available on request.

Important: Text is sent to our model provider (OpenAI, or Anthropic where selected) for scoring, embedding and reply generation. What is sent is the text being judged (a public post's title and text, or a message submitted for scoring, with any context sent alongside it), a prospect's latest reply when drafting a follow-up, and your product description. When a post from a feed mentions one of your competitors, its author's public handle is sent too, to judge why they mentioned it. Your own account details and credentials are never included.

7. Security measures

We maintain the following technical and organisational measures:

  • Encryption in transit (TLS 1.2+) for all API communications.
  • Encryption at rest for the Supabase database (AES-256).
  • Operator keys are stored only as a one-way SHA-256 hash: shown once at creation, never retrievable, and replaced rather than recovered if lost.
  • Access to production infrastructure restricted to the data controller (sole operator).
  • Regular dependency audits to address known vulnerabilities.

8. Duration and termination

This DPA is effective for the duration of the service relationship and terminates automatically when the Terms of Service are terminated. Upon termination, the Processor will delete all Personal Data within 30 days unless retention is required by law.

9. Contact and requests

For DPA-related requests, data subject rights assistance, or breach notifications, contact: contact@signalpipe.io

Privacy PolicyTerms of ServiceHome