1. Scope
This DPA applies where Yaro ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the Yaro service.
2. Nature of processing
Automated engagement with the Controller's own LinkedIn account: content generation, commenting, invites, DMs, and inbox triage.
3. Sub-processors
LinkupAPI, Supabase, Cloudflare, Google (Gemini). Notification of new sub-processors: 30 days.
4. Security measures
Encryption at rest (AES-256-GCM for sensitive fields), TLS in transit, row-level security, least-privilege access, audit logging.
5. Data subject rights
Processor will assist Controller in responding to access, correction, deletion, and portability requests within 30 days.
6. Breach notification
72 hours from confirmed personal data breach.
7. International transfers
Where applicable, Standard Contractual Clauses (2021 EU) apply.
8. Term & termination
DPA remains in force while Processor holds Controller data. On termination, data is deleted within 30 days unless retention is required by law.
9. Contact
dpa@podpilot.app