TrueGrow AI Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the agreement between TrueGrow AI Inc. ("TrueGrow AI," "MediaFlow," "Processor," "we," or "us") and the customer, user, or entity accepting this DPA ("Customer," "Controller," or "you").

This DPA applies to the processing of Personal Data by TrueGrow AI on behalf of the Customer in connection with the Services.

1. Definitions

Capitalized terms not defined herein have the meanings set forth in the Terms of Service or Privacy Policy.

• "Applicable Data Protection Laws" means GDPR, UK-GDPR, CCPA/CPRA, and any other applicable privacy laws.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" has the meaning given under GDPR.
• "Subprocessor" means a third party engaged by TrueGrow AI to process Personal Data.

2. Roles of the Parties

• The Customer acts as the Controller of Personal Data.
• TrueGrow AI acts as a Processor and processes Personal Data only on documented instructions from the Customer, unless required by law.

3. Scope & Purpose of Processing

TrueGrow AI processes Personal Data solely to provide the Services, including:

• Social media management, scheduling, and publishing
• Analytics and performance reporting
• Comment and direct-message inbox management
• Influencer discovery and campaign execution
• AI-assisted content generation and analytics
• Platform support, maintenance, and security

4. Categories of Data Subjects

Depending on use of the Services, Personal Data may relate to:

• Influencers / creators
• Brand or company representatives
• Agency or agent users
• Social media account followers (aggregated analytics only)
• Authorized employees or contractors of the Customer

5. Categories of Personal Data

TrueGrow AI may process the following categories of Personal Data:

a. Account & Identifier Data

• Names
• Email addresses
• User IDs
• Page IDs
• Account IDs
• Business or channel identifiers

b. Social Content & Communications

• Comments
• Direct messages
• Message metadata
• Moderation status

c. Analytics & Performance Data

• Engagement metrics
• Reach and impression data
• Audience demographics (aggregated)
• Growth trends

d. Platform-Generated Data

• Reports
• Dashboards
• AI-generated insights
• Campaign summaries

e. Technical & Usage Data

• IP addresses
• Device and browser data
• API usage logs

6. Duration of Processing & Retention

a. Duration

Personal Data is processed for the duration of the Customer's active account and in accordance with the retention rules below.

b. Retention Rules

c. Deletion Upon Termination

Upon termination of the Services or at the Customer's written request, TrueGrow AI shall delete or anonymize Personal Data within 30 days, unless retention is required by law.

7. Customer Obligations

The Customer represents and warrants that:

• It has a lawful basis for Processing Personal Data
• It has obtained all necessary consents
• Its instructions comply with Applicable Data Protection Laws
• It will not instruct TrueGrow AI to process data unlawfully

8. TrueGrow AI Obligations

TrueGrow AI agrees to:

• Process Personal Data only on documented instructions
• Ensure confidentiality of authorized personnel
• Implement appropriate technical and organizational safeguards
• Assist the Customer with data-subject requests
• Notify the Customer of data breaches without undue delay

9. Data Subject Rights

TrueGrow AI shall reasonably assist the Customer in responding to requests to:

• Access
• Correct
• Delete
• Restrict processing
• Port data
• Object to processing

Requests are handled in accordance with the Privacy Policy.

10. Subprocessors

The Customer authorizes TrueGrow AI to engage Subprocessors.

Current Subprocessors include (non-exhaustive):

Infrastructure & Hosting

• Google Cloud Platform / Supabase (hosting & infrastructure)

AI Processing

• OpenAI (AI processing)
• Google Gemini (AI processing)
• Anthropic (AI processing)

Social Media Platforms (API Access)

• Meta Platforms, Inc. (Instagram, Facebook, Threads API access for content publishing, analytics retrieval, comment/DM management)
• TikTok (content publishing, analytics retrieval)
• Google/YouTube (content publishing, analytics retrieval)
• LinkedIn (content publishing, analytics retrieval)

Payments & Analytics

• Stripe (payments)
• Google Analytics
• Adobe Analytics

TrueGrow AI ensures Subprocessors are bound by equivalent data-protection obligations.

11. International Data Transfers

Where Personal Data is transferred outside the EEA or UK, TrueGrow AI relies on Standard Contractual Clauses or equivalent safeguards.

12. Security Measures

TrueGrow AI implements industry-standard security measures, including:

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+)
• Role-based access controls
• MFA for internal access
• Regular security audits

Further details are available in the Security Statement.

13. Data Breach Notification

TrueGrow AI shall notify the Customer without undue delay upon becoming aware of a Personal Data breach and provide relevant information as required by law.

14. Audits

Upon reasonable notice, the Customer may audit TrueGrow AI's compliance with this DPA, subject to confidentiality and security constraints.

15. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service.

16. Governing Law

This DPA is governed by the laws of the State of Delaware, without regard to conflict-of-law principles.

17. Order of Precedence

In the event of conflict, this DPA prevails over the Terms of Service solely with respect to data-protection obligations.

18. Contact

📧 privacy@truegrow.ai

📍 TrueGrow AI Inc.
1178 Broadway, 3rd Floor #581
New York, NY 10001