Data Processing Agreement

Last updated: 27 July 2026

This Data Processing Agreement ("DPA") governs the processing of personal data by Reviewal (the "Processor") on behalf of you or your organization (the "Controller") in connection with your use of Sentinel by Reviewal (the "Service"). This DPA is entered into pursuant to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR.

This DPA forms part of, and is subject to, the Terms of Service between the parties. In the event of any conflict between this DPA and the Terms of Service with respect to the processing of personal data, this DPA prevails.

1. Definitions

Terms used but not defined in this DPA have the meanings given to them in the GDPR. For clarity:

• "Controller" means the customer using Sentinel and determining the purposes and means of processing personal data.
• "Processor" means Reviewal, processing personal data on behalf of the Controller.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Personal data", "processing", "data subject", and "personal data breach" have the meanings given in the GDPR.

2. Scope and purpose of processing

2.1 Subject matter

The subject matter of the processing is the provision of the Sentinel service: a social media compliance monitoring platform.

2.2 Duration

The processing will continue for the duration of the Controller's subscription to Sentinel, plus any post-termination period required to return or delete the data in accordance with Section 9.

2.3 Nature and purpose

The Processor processes personal data to provide the Service: authenticating users, ingesting public social media content from connected accounts, performing AI-assisted compliance analysis, storing scan results and metrics, generating dashboards and reports, and delivering notifications.

2.4 Categories of data subjects

• Controller users (employees, contractors, and other individuals authorized by the Controller to use Sentinel).
• Owners of the social media accounts connected to the Service by the Controller (in most cases, the Controller themselves).

2.5 Categories of personal data

• Identity data: email address, name, hashed password, Google account profile if used for sign-in.
• Social media data: public profile information, public posts and captions, engagement metrics, media URLs, follower counts, bio text.
• Scan inputs and outputs: text and media submitted for compliance analysis, resulting scores and findings.
• Preferences and settings.
• Activity logs including IP address.
• Billing metadata (subscription status, opaque payment processor IDs).

2.6 Special categories

Sentinel is not designed for the processing of special categories of personal data (sensitive data under Article 9 GDPR). The Controller agrees not to knowingly submit such data to Sentinel except in the ordinary course of scanning publicly available social media content that may incidentally contain such data.

3. Processor obligations

The Processor undertakes to:

• Process personal data only on documented instructions from the Controller, including with regard to international transfers, unless required to process by Union or Member State law.
• Ensure that persons authorized to process the personal data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures, as described in Section 6.
• Engage sub-processors only in accordance with Section 5.
• Assist the Controller in fulfilling its obligations to respond to data subject requests (Articles 12 to 22 GDPR).
• Assist the Controller in ensuring compliance with the security, breach notification, data protection impact assessment, and prior consultation obligations in Articles 32 to 36 GDPR.
• At the Controller's choice, delete or return all personal data at the end of the provision of services, in accordance with Section 9.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

4. Controller obligations

The Controller warrants that:

• It has a valid legal basis under Article 6 GDPR (and, where relevant, Article 9) for the processing.
• It has provided all required notices and, where applicable, obtained all required consents from data subjects.
• It has authorization to connect any social media account submitted to Sentinel for monitoring.
• Its instructions comply with applicable law.
• It will notify the Processor without undue delay of any changes affecting the lawfulness of the processing.

5. Sub-processors

The Controller grants the Processor general written authorization to engage sub-processors in connection with the provision of the Service. The current list of sub-processors is set out in Annex A to this DPA.

The Processor will:

• Enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA.
• Remain fully liable to the Controller for the acts and omissions of its sub-processors.
• Notify the Controller in advance of any intended addition or replacement of sub-processors, giving the Controller an opportunity to object on reasonable data protection grounds within thirty (30) days. If an objection cannot be resolved, the Controller may terminate the Service in accordance with the Terms of Service.

6. Security measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit (HTTPS/TLS) and at rest (via infrastructure providers).
• JWT-based authentication with asymmetric verification against the authentication provider's public keys.
• Multi-tenant isolation, with ownership verification on every account-scoped request.
• Password hashing managed by the authentication sub-processor (Supabase).
• Restricted internal access, on a need-to-know basis, with logging.
• Regular security review of infrastructure and dependencies.
• Documented incident-response procedures.

Further detail is available on request. The Processor may update its security measures from time to time, provided the level of protection is not materially reduced.

7. Personal data breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data. The notification will include, to the extent known at the time:

• The nature of the breach, categories, and approximate number of data subjects and records concerned.
• The likely consequences.
• The measures taken or proposed to address the breach and mitigate its effects.
• A point of contact for further information.

The Processor will cooperate with the Controller in the fulfillment of the Controller's obligations under Articles 33 and 34 GDPR.

8. International data transfers

The Controller acknowledges that certain sub-processors are located in third countries outside the European Economic Area (see Annex A). For such transfers, the Processor relies on appropriate safeguards under Chapter V of the GDPR, including the European Commission's Standard Contractual Clauses (SCCs) as adopted by Commission Decision (EU) 2021/914 of 4 June 2021. Where applicable, the Processor also relies on sub-processor participation in the EU-U.S. Data Privacy Framework.

Where the UK GDPR applies, the parties incorporate the UK International Data Transfer Addendum to the SCCs, as issued by the UK Information Commissioner.

9. Return or deletion of data

Upon termination of the Service, the Processor will, at the Controller's choice, return or delete all personal data processed on the Controller's behalf, unless retention is required by applicable law. Deletion from production systems will be completed within thirty (30) days of termination; deletion from backups will be completed on the next backup rotation cycle (typically within 7 to 14 days thereafter).

10. Audits and inspections

The Processor will make available to the Controller, upon reasonable request, all information necessary to demonstrate compliance with this DPA. On-site audits are not required in the normal course. Where the Controller's supervisory authority requires an audit, the parties will cooperate in good faith, and the Controller will bear the reasonable costs of such an audit.

11. Liability

The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA excludes or limits liability that cannot be excluded or limited under applicable law.

12. Governing law

This DPA is governed by the law specified in the Terms of Service, subject to mandatory data protection law. Nothing in this DPA overrides mandatory data subject rights under the GDPR or equivalent laws.

13. Contact

For questions or notices under this DPA, please contact sentinel@reviewal.team.

Annex A: Sub-processor list

The following sub-processors are engaged by the Processor in connection with the provision of Sentinel. This list is current as of the "Last updated" date at the top of this DPA and may be updated in accordance with Section 5.

"SCCs" refers to the Standard Contractual Clauses issued by the European Commission (Decision (EU) 2021/914). Where a sub-processor is located in the United States, the Processor also relies, where applicable, on that sub-processor's certification under the EU-U.S. Data Privacy Framework.

Reviewal is the trading name of Chafai Solutions LLC, a limited liability company organized under the laws of the State of Delaware, United States, with registered office at 16192 Coastal Highway, Lewes, Delaware 19958, United States. All references to "Reviewal" (as Processor) in this DPA are to Chafai Solutions LLC.