Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by Reviewal (the "Processor") on behalf of you or your organization (the "Controller") in connection with your use of Sentinel by Reviewal (the "Service"). This DPA is entered into pursuant to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR.

This DPA forms part of, and is subject to, the Terms of Service between the parties. In the event of any conflict between this DPA and the Terms of Service with respect to the processing of personal data, this DPA prevails.

1. Definitions

Terms used but not defined in this DPA have the meanings given to them in the GDPR. For clarity:

• "Controller" means the customer using Sentinel and determining the purposes and means of processing personal data.
• "Processor" means Reviewal, processing personal data on behalf of the Controller.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Personal data", "processing", "data subject", and "personal data breach" have the meanings given in the GDPR.

2. Scope and purpose of processing

2.1 Subject matter

The subject matter of the processing is the provision of the Sentinel service: a social media compliance monitoring platform.

2.2 Duration

The processing will continue for the duration of the Controller's subscription to Sentinel, plus any post-termination period required to return or delete the data in accordance with Section 9.

2.3 Nature and purpose

The Processor processes personal data to provide the Service: authenticating users, ingesting public social media content from connected accounts, performing AI-assisted compliance analysis, storing scan results and metrics, generating dashboards and reports, and delivering notifications.

2.4 Categories of data subjects

• Controller users (employees, contractors, and other individuals authorized by the Controller to use Sentinel).
• Owners of the social media accounts connected to the Service by the Controller (in most cases, the Controller themselves).

2.5 Categories of personal data

• Identity data: email address, name, hashed password, Google account profile if used for sign-in.
• Social media data: public profile information, public posts and captions, engagement metrics, media URLs, follower counts, bio text.
• Scan inputs and outputs: text and media submitted for compliance analysis, resulting scores and findings.
• Preferences and settings.
• Activity logs including IP address.
• Billing metadata (subscription status, opaque payment processor IDs).

2.6 Special categories

Sentinel is not designed for the processing of special categories of personal data (sensitive data under Article 9 GDPR). The Controller agrees not to knowingly submit such data to Sentinel except in the ordinary course of scanning publicly available social media content that may incidentally contain such data.

3. Processor obligations

The Processor undertakes to:

• Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In that case, the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
• Ensure that persons authorized to process the personal data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures, as described in Section 6.
• Engage sub-processors only in accordance with Section 5.
• Assist the Controller in fulfilling its obligations to respond to data subject requests (Articles 12 to 22 GDPR).
• Assist the Controller in ensuring compliance with the security, breach notification, data protection impact assessment, and prior consultation obligations in Articles 32 to 36 GDPR.
• At the Controller's choice, delete or return all personal data at the end of the provision of services, in accordance with Section 9.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

The Processor will immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the GDPR, the UK GDPR, or other applicable data protection law. The Processor may suspend the affected processing until the instruction is withdrawn, amended or confirmed.

4. Controller obligations

The Controller warrants that:

• It has a valid legal basis under Article 6 GDPR (and, where relevant, Article 9) for the processing.
• It has provided all required notices and, where applicable, obtained all required consents from data subjects.
• It has authorization to connect any social media account submitted to Sentinel for monitoring.
• Its instructions comply with applicable law.
• It will notify the Processor without undue delay of any changes affecting the lawfulness of the processing.

5. Sub-processors

The Controller grants the Processor general written authorization to engage sub-processors in connection with the provision of the Service. The current list of sub-processors is set out in Annex A to this DPA.

The Processor will:

• Enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA.
• Remain fully liable to the Controller for the acts and omissions of its sub-processors.
• Notify the Controller in advance of any intended addition or replacement of sub-processors, giving the Controller an opportunity to object on reasonable data protection grounds within thirty (30) days. If an objection cannot be resolved, the Controller may terminate the Service in accordance with the Terms of Service.

6. Security measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit (HTTPS/TLS) and at rest (via infrastructure providers).
• JWT-based authentication with asymmetric verification against the authentication provider's public keys.
• Multi-tenant isolation, with ownership verification on every account-scoped request.
• Password hashing managed by the authentication sub-processor (Supabase).
• Restricted internal access, on a need-to-know basis, with logging.
• Regular security review of infrastructure and dependencies.
• Documented incident-response procedures.

Further detail is available on request. The Processor may update its security measures from time to time, provided the level of protection is not materially reduced.

7. Personal data breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data. The notification will include, to the extent known at the time:

• The nature of the breach, categories, and approximate number of data subjects and records concerned.
• The likely consequences.
• The measures taken or proposed to address the breach and mitigate its effects.
• A point of contact for further information.

The Processor will cooperate with the Controller in the fulfillment of the Controller's obligations under Articles 33 and 34 GDPR.

8. International data transfers

The Controller acknowledges that certain sub-processors are located in third countries outside the European Economic Area (see Annex A). For such transfers, the Processor relies on appropriate safeguards under Chapter V of the GDPR, including the European Commission's Standard Contractual Clauses (SCCs) as adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

8.1 Standard Contractual Clauses between the parties

Where the Controller is established in the European Economic Area, or the processing is otherwise subject to the GDPR, and personal data is transferred to the Processor in a third country, the parties incorporate Module Two (controller to processor) of the Standard Contractual Clauses into this DPA by reference. The Controller is the data exporter and the Processor is the data importer. The optional docking clause applies. In Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in Section 5 of this DPA. In Clause 11, the optional independent dispute resolution body is not used. In Clause 17, the governing law is the law of Ireland. In Clause 18(b), the courts of Ireland are chosen.

The Annexes to the Standard Contractual Clauses are populated as follows: Annex I.A (parties) by the identities of the Controller and the Processor in this DPA; Annex I.B (description of the transfer) by Section 2 of this DPA; Annex I.C (competent supervisory authority) by the authority of the Controller's place of establishment, or, where the Controller is not established in the European Economic Area, the authority of the Member State in which the Controller's representative is established or in which the data subjects are located; Annex II (technical and organisational measures) by Section 6 of this DPA; and Annex III (sub-processors) by Annex A to this DPA.

Where the UK GDPR applies, the parties incorporate the UK International Data Transfer Addendum to the SCCs, as issued by the UK Information Commissioner, with Tables 1 to 3 populated by the corresponding parts of this DPA and Table 4 selecting neither party as the party that may end the Addendum. Where Swiss data protection law applies, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Federal Data Protection and Information Commissioner.

A copy of the Standard Contractual Clauses as incorporated is available on request at sentinel@reviewal.team.

9. Return or deletion of data

Upon termination of the Service, the Processor will, at the Controller's choice, return or delete all personal data processed on the Controller's behalf, unless retention is required by applicable law. Deletion from production systems will be completed within thirty (30) days of termination; deletion from backups will be completed on the next backup rotation cycle (typically within 7 to 14 days thereafter).

10. Audits and inspections

The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Controller or by another auditor mandated by the Controller. The Controller will give at least thirty (30) days written notice, audits will take place no more than once in any twelve month period unless a personal data breach affecting the Controller's data has occurred or a supervisory authority requires otherwise, and each audit will be conducted during business hours, without unreasonable disruption to the Processor's operations, and subject to confidentiality obligations. The Processor may satisfy an audit request by providing an up to date third party certification or audit report where one covers the scope of the request. The Controller bears its own costs and the Processor's reasonable costs of supporting an audit it requests.

11. Liability

The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA excludes or limits liability that cannot be excluded or limited under applicable law.

12. Governing law

This DPA is governed by the law specified in the Terms of Service, subject to mandatory data protection law and to the governing law chosen in Section 8.1 for the Standard Contractual Clauses. Nothing in this DPA overrides mandatory data subject rights under the GDPR or equivalent laws.

13. Contact

For questions or notices under this DPA, please contact sentinel@reviewal.team.

Annex A: Sub-processor list

The following sub-processors are engaged by the Processor in connection with the provision of Sentinel. This list is current as of the "Last updated" date at the top of this DPA and may be updated in accordance with Section 5.

This list was last updated on 11 October 2026. Changes so far:

• 11 October 2026: disclosed Google (Sign in with Google). It receives your name, email address and profile image only if you choose that sign-in method. This sign-in option was already available and was missing from the list, so this is a correction to the list rather than a new sub-processor.
• 27 July 2026: initial list (Supabase, Railway, Anthropic, Groq, Apify, Resend, Stripe).

"SCCs" refers to the Standard Contractual Clauses issued by the European Commission (Commission Implementing Decision (EU) 2021/914).

Reviewal is the trading name of Chafai Solutions LLC, a limited liability company organized under the laws of the State of Delaware, United States, with registered office at 16192 Coastal Highway, Lewes, Delaware 19958, United States. All references to "Reviewal" (as Processor) in this DPA are to Chafai Solutions LLC.