Data Processing Agreement (DPA)

This is a draft for legal review, not a finished legal document. It reflects the product's actual data handling as designed, but it has not been reviewed by a lawyer and must not be published or signed until it has been.

Last updated: 2026-09-20 (draft; the effective date is set when counsel approves it)

---

1. Parties and purpose

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer who subscribes to Universe Help (the "Customer", the "Owner") and Universe Help, Kalaiya-16, Bara, Nepal [registered entity name to be confirmed] ("we", "us", "Processor").

It applies where we process personal data on the Customer's behalf while providing the Platform. Under the GDPR, CCPA/CPRA and India's DPDP Act, the Customer is the controller (or "business" / "data fiduciary") and we are the processor (or "service provider" / "data processor") for that data. For account, billing and security data that we collect for our own purposes, we are an independent controller, as described in the Privacy Policy.

2. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings in the GDPR. "Applicable Data Protection Law" means the GDPR (EU and UK), the CCPA/CPRA, India's Digital Personal Data Protection Act, and any other data protection law that applies to the Processing. Because the Platform is sold worldwide, we apply the strictest of these standards to all Customers.

3. Details of processing

Item	Description
Subject matter	Providing the Platform: content management, social publishing, lead management and scoring, SEO/competitor/backlink analysis, team collaboration
Duration	The life of the Customer's subscription, plus the retention periods in section 9
Nature and purpose	Storing, organizing, analyzing (including with AI) and transmitting data so the Customer can manage marketing activity
Types of personal data	Customer and Collaborator account data; content the Customer uploads; connected-platform data; comments and messages from third parties (leads) with their AI classification; device and session data; activity logs
Data subjects	The Customer's staff and Collaborators; the Customer's leads, followers and commenters; visitors who interact with the Customer's connected accounts
Special categories	Not intended. The Customer must not upload special-category data unless the Platform is explicitly configured for it

4. Processor obligations

We will:

1. Process Personal Data only on the Customer's documented instructions (the Terms, this DPA, and the Customer's use of the Platform), unless the law requires otherwise. We will tell the Customer if we believe an instruction breaks the law.
2. Make sure everyone we authorize to process Personal Data is bound by confidentiality.
3. Apply the technical and organizational measures in Annex 1.
4. Help the Customer answer Data Subject requests (access, correction, deletion, export, objection). Requests reach us at satendrapatel2468@gmail.com and are handled manually within 30 days.
5. Help the Customer with security, breach notification, data protection impact assessments and prior consultations, taking into account the nature of the Processing.
6. Delete or return Personal Data at the end of the service (section 9).
7. Give the Customer the information needed to show compliance, and allow reasonable audits (section 10).

5. Customer obligations

The Customer confirms that it has a legal basis to process the Personal Data, that it has given any required notices to Data Subjects, that its instructions are lawful, and that it will not connect accounts or import data it has no right to use. The Customer is responsible for the actions of the Collaborators it invites.

6. Subprocessors

The Customer gives general authorization for the subprocessors in Annex 2. We will give at least 30 days' notice by email before adding or replacing a subprocessor, and the Customer may object on reasonable data-protection grounds. Each subprocessor is bound by written terms that give the same level of protection as this DPA. We remain responsible for our subprocessors.

7. International transfers

We operate from Nepal, and the Platform's primary data is hosted in the United States. Where Personal Data from the EU, UK or another region with transfer rules is transferred to a country without an adequacy decision (this includes access from Nepal), the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated by reference. [Counsel to attach or link the SCC modules and complete their annexes.]

8. Personal Data Breach

We will notify the Customer without undue delay, and within 72 hours of becoming aware, of a Personal Data Breach affecting the Customer's data. The notice will describe the nature of the breach, the data affected, likely consequences, and the measures taken or proposed. We will cooperate with the Customer's own notifications to regulators and Data Subjects.

9. Retention, return and deletion

Data	Rule
Lead data (comments and messages)	Kept 90 days, then anonymized (personal content removed; aggregate score and classification kept). Leads the Customer marks as "converted" are kept longer at the Customer's discretion
Workspace data after plan expiry	Locked for 90 days, then soft-deleted unless the Customer buys a plan again
Customer-requested export or deletion	Fulfilled manually within 30 days of a request to satendrapatel2468@gmail.com
Backups	Deleted data leaves backups on the normal backup rotation
Billing records	Kept as long as the law requires

10. Audits

The Customer may, on reasonable written notice and no more than once a year (unless a regulator or a breach requires more), ask for information that shows our compliance, such as our security documentation and subprocessor list. On-site audits are limited to what is reasonably necessary, are done during business hours, and are at the Customer's cost. [Counsel to review the scope of audit rights.]

11. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA lasts as long as we process Personal Data for the Customer. If this DPA conflicts with the Terms on data protection, this DPA wins.

12. Governing law

This DPA is governed by the same law as the Terms of Service (the laws of Nepal), except that the Standard Contractual Clauses are governed by the law they require.

---

Annex 1 — Technical and organizational measures

These describe the measures as designed in the product documents. Counsel and the operator must confirm each one is in place before this DPA is signed.

• Tenant isolation: every workspace's data is separated. The database enforces Row Level Security, and the backend independently checks workspace, role and platform permission on every request.
• Access control: role-based and per-platform permissions, re-checked on every action. Blocked collaborators lose access immediately. Device and session limits are enforced.
• Administrator access: the Admin site is on a separate subdomain, requires multi-factor authentication, and every Admin action is audit-logged.
• Encryption: data is encrypted in transit (HTTPS/TLS). Social-platform access tokens are encrypted at rest and never sent to browsers or apps.
• Secrets: secrets are kept only in server-side secret stores, never in client code or source control, and separate per environment.
• Application security: input validation on every endpoint, protection against SQL injection, cross-site scripting, template injection, request forgery, replay, and resource exhaustion; rate limiting at the edge and in the application.
• Logging and monitoring: activity and audit logs, error monitoring, and alerting, with sensitive data kept out of logs and error reports.
• Availability and recovery: automated daily backups with point-in-time recovery; recovery targets are not set yet (PRD.md section 0.5) and are added before publishing.
• AI processing: content sent to AI providers is limited to what is needed for the requested output, and workspace memory is isolated per workspace.
• Data minimization and retention: only required data is stored, and retention periods are enforced by scheduled jobs.
• Personnel: access to production data is limited to authorized staff under confidentiality obligations.

Annex 2 — Subprocessors (expected list)

Subprocessor	Purpose	Expected location
Amazon Web Services	Hosting the API and background workers, managed Redis	United States
Supabase	Database and authentication	United States
Cloudflare	Network security, CDN, media storage (R2)	Global network
Vercel	Web application hosting	Global network
Google (Gemini)	AI processing and web search grounding	United States / global
RevenueCat and its payment processor [gateway pending]	Subscription billing	[confirm]
Resend	Transactional email	United States
Firebase (Google)	Push notifications	Global
Sentry	Error monitoring	[confirm]
Mixpanel, PostHog	Product analytics (only with the user's consent)	[confirm]

---

Flags for legal review:

• Confirm the controller/processor split (section 1), especially for third-party lead data and for data we use for our own product analytics.
• The SCC modules, the UK Addendum, and the Swiss/other transfer terms (section 7) must be attached and completed.
• The 72-hour breach window (section 8) must be checked against the strictest applicable law and against what operations can actually deliver.
• Annex 2 is an expected list. It must match the real vendors, regions and the payment gateway once chosen, and must be kept in sync with the Privacy Policy (section 9).
• Annex 1 lists design intentions, not certifications. Do not describe the Platform as certified (for example SOC 2 or ISO 27001) unless that becomes true.