Data Processing Addendum
Engineering draft — counsel review required. This document was drafted by engineering and has not been reviewed by legal counsel. Draft, not yet in effect.
This Data Processing Addendum ("DPA") forms part of the agreement between the customer identified in the applicable order or account registration ("Customer") and JobMax.ai, operated by Alex Rabinovich and Max Glubochansky ("Processor"), for the JobMax.ai service (the "Service"). It applies to the extent Processor processes Personal Data on Customer's behalf that is subject to Data Protection Laws such as the EU/UK General Data Protection Regulation ("GDPR") or U.S. state privacy laws.
1. Definitions
- "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings given in applicable Data Protection Laws.
- "Subprocessor" means a third party engaged by Processor to process Personal Data on Customer's behalf.
2. Roles and Scope
- Customer is the Controller (or a processor acting on behalf of another controller) of Personal Data submitted to the Service; JobMax.ai is the Processor.
- Processor will process Personal Data only on Customer's documented instructions — including as set out in the agreement, this DPA, and Customer's configuration and use of the Service — unless required to do otherwise by law, in which case Processor will inform Customer unless legally prohibited.
3. Details of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the JobMax.ai content-generation and social-publishing service |
| Duration | Term of the agreement, plus the deletion period in Section 9 |
| Nature and purpose | Hosting and storage of uploaded job media; AI-assisted generation of captions, hashtags, and schedules; scheduling and publishing of approved content to Customer-connected social accounts; subscription billing; support |
| Categories of Data Subjects | Customer's staff and account users; individuals who appear in uploaded job photos or content; Customer's clients to the extent identifiable in job data |
| Categories of Personal Data | Account identifiers (email), business and location details, uploaded photos and videos and their metadata, generated and approved content, social account identifiers and OAuth tokens (stored encrypted), billing state (via Stripe), usage logs |
| Special categories | Not intended to be processed; Customer agrees not to submit special-category data to the Service |
4. Processor Obligations
Processor will:
- process Personal Data only per Section 2;
- ensure persons authorized to process Personal Data are bound by confidentiality obligations;
- implement the technical and organizational measures in Section 7;
- assist Customer, taking into account the nature of processing, in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection);
- assist Customer with data protection impact assessments and consultations with Supervisory Authorities where required;
- make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits as set out in Section 10;
- notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, per Section 8.
5. Subprocessors
Customer provides general authorization for Processor to engage the Subprocessors listed below. Processor will impose data protection obligations on Subprocessors no less protective than this DPA and remains liable for their performance.
| Subprocessor | Purpose | Location of processing |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure: compute, Aurora PostgreSQL database, S3/CloudFront media storage and delivery, SQS queues, KMS key management, SES transactional email | United States |
| Stripe, Inc. | Subscription payment processing | United States |
| Anthropic, PBC | AI text generation (captions, hashtags, scheduling suggestions) via Processor's internal AI gateway | United States |
| OpenAI, L.L.C. | AI image/multimodal processing via Processor's internal AI gateway | United States |
| Meta Platforms, Inc. | Publishing Customer-approved content and applying Customer-directed ad budget settings to Customer's connected Meta assets | United States / global |
| TikTok (ByteDance Ltd. affiliates) | Publishing Customer-approved content and applying Customer-directed ad budget settings to Customer's connected TikTok assets | United States / global |
| SuperTokens | Authentication software (self-hosted by Processor within its AWS environment; authentication data does not leave Processor's infrastructure) | United States (Processor-hosted) |
Notes:
- Meta and TikTok act on Customer's direct instruction when Customer connects an account and approves content; once content is delivered to those platforms, they process it as independent controllers under their own terms.
- Processor will provide notice of new or replaced Subprocessors (for example, by updating a published subprocessor list and providing a notification mechanism). Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, Customer may terminate the affected portion of the Service.
6. International Transfers
Where Processing involves transfers of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will rely on appropriate safeguards under Data Protection Laws, including the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK Addendum, which are incorporated by reference where required.
7. Security Measures
Processor implements and maintains appropriate technical and organizational measures, including:
- encryption of data in transit (TLS) for all connections;
- application-layer encryption of social account OAuth tokens using AES-256-GCM envelope encryption with per-record data keys managed in AWS KMS;
- private media storage with access only via short-lived signed URLs; no publicly readable buckets;
- platform secrets stored in AWS Secrets Manager, not environment variables or code;
- least-privilege, per-service database credentials and network segmentation between services;
- log scrubbing that removes tokens, secrets, and payment identifiers from log output;
- correlation-ID-based audit trails for requests, jobs, and provider calls;
- human approval gates so no content is published without an explicit Customer action.
8. Personal Data Breach
Processor will notify Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, and will provide information reasonably available to help Customer meet its own notification obligations, including the nature of the breach, categories and approximate volume of affected data, likely consequences, and measures taken or proposed.
9. Deletion and Return
Upon termination or expiry of the agreement, or upon Customer's verified deletion request, Processor will delete or de-identify Customer Personal Data within a reasonable period, except for data that must be retained under applicable law and residual copies in routine backups, which remain protected under this DPA until deleted on the backup cycle.
10. Audits
Upon reasonable prior written notice and no more than once per year (absent a Supervisory Authority requirement or a Personal Data Breach), Processor will make available information necessary to demonstrate compliance with this DPA, and will allow audits by Customer or an independent auditor bound by confidentiality, at Customer's expense, conducted so as not to disrupt the Service or compromise other customers' data.
11. Order of Precedence and Contact
In the event of a conflict between this DPA and the agreement, this DPA controls with respect to the Processing of Personal Data. Questions regarding this DPA: privacy@jobmax.ai.