Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between FeedSense ("Processor" or "we") and the customer ("Controller" or "you") and governs the processing of personal data in connection with FeedSense's services.

This DPA is effective as of the date you accept our Terms of Service and remains in effect until the termination of your FeedSense account. Read it together with the Privacy Policy, which describes the underlying data flows.

2. Definitions

3. Data Processing Details

3.1 Categories of Data Subjects

• End-users of the Controller's product who submit feedback through the FeedSense widget
• End-users whose interactions in connected sources (Intercom conversations, Zendesk tickets, monitored Slack channels) are ingested by FeedSense at the Controller's direction
• The Controller's administrators and team members who access the FeedSense dashboard

3.2 Categories of Personal Data

• Identity data (optional): name, email, user ID, custom properties; only when supplied via the SDK identify() call
• Feedback content: comment text, rating, metadata, source URL, integration-sourced messages
• AI-generated derivatives: sentiment / emotion labels, embeddings, theme clusters, daily insights, AI Chat history
• Account data for the Controller's administrators (email, hashed password, role, membership)
• Usage data: dashboard interaction events, server logs (typically including IP address)

3.3 Special Categories

FeedSense does not knowingly process special categories of Personal Data (GDPR Article 9). The Controller must not send special category data through the platform.

3.4 Purpose and Nature of Processing

Personal Data is processed solely to provide the FeedSense service: ingestion, storage, automated analysis, surfacing in the dashboard, delivery via configured destinations, account and billing management, and security and abuse prevention.

3.5 Duration

For the duration of the Controller's subscription, plus the retention windows specified in Section 6 of the Privacy Policy.

4. Controller Responsibilities

The Controller agrees to:

• Ensure a lawful basis exists for sending Personal Data to FeedSense
• Provide accurate and complete instructions about processing
• Provide privacy notices to data subjects and obtain any necessary consents (especially for end-user feedback submitted via the widget)
• Not send special category data, payment card data outside Paddle's checkout flow, or content prohibited by the Acceptable Use Policy in our Terms of Service
• Respond to data subject requests for which the Controller is the responsible party (typically end-user requests)

5. Sub-Processors

5.1 Authorization and Notification

The Controller grants FeedSense general written authorization to engage the sub-processors listed below. When we add or remove a sub-processor, we publish the change on the live sub-processor list and notify all paying customers by email at least 30 days before the new sub-processor begins processing Personal Data, unless an emergency security or legal requirement prevents the notice period (in which case we notify as promptly as practicable).

The Controller may object to a new sub-processor on reasonable grounds within 30 days of notification by writing to [email protected]. If we cannot accommodate the objection, the Controller may terminate the affected services with pro-rata refund of any prepaid fees for the unused term.

5.2 Current Sub-Processors

The complete current list with each vendor's published policy lives at /legal/subprocessors. Snapshot at version 2026-04-25:

5.3 Customer-Connected Services

The following third-party tools become accessible to FeedSense only when the Controller authorizes them via OAuth. They are not sub-processors in the strict GDPR Article 28 sense (the Controller retains the primary relationship with the third-party provider) but they are listed here so the data flow is fully transparent:

5.4 Transfer Safeguards

For sub-processors located outside the European Economic Area (EEA) or the United Kingdom, FeedSense relies on the European Commission Standard Contractual Clauses (SCCs) Module 2 (Controller-to-Processor, Decision 2021/914) and, for UK transfers, the UK Addendum (IDTA). FeedSense does not currently rely on the EU-US Data Privacy Framework.

6. Security Measures

FeedSense implements and maintains the technical and organizational measures described in Section 8 of the Privacy Policy, including at minimum:

• Encryption in transit (TLS 1.2+) and platform-managed encryption at rest for the database; application-level AES-256-GCM encryption for OAuth credentials and webhook secrets
• Bcrypt password hashing (12 rounds) and HMAC-SHA-256 API key hashing
• Role-based access controls and least-privilege project membership
• Cloudflare DDoS mitigation, Helmet security headers, and route-aware CORS
• Centralized monitoring (Sentry, Grafana Cloud, BetterStack)
• Incident response procedures and 72-hour breach notification commitment (Section 8 below)
• Regular backups managed by the database provider

Annex II below restates these measures in the structured format required by Article 28 / SCC Module 2.

7. Data Subject Rights Assistance

FeedSense assists the Controller in fulfilling obligations to respond to data subject requests. Specifically:

• Self-service data export and account deletion are available in the dashboard
• For end-user requests (the Controller's users contacting us directly), we forward the request to the Controller, who acts as the responsible controller for that data
• Where additional engineering work is required to fulfill a request, FeedSense will provide reasonable assistance, charged at cost only if extraordinary

8. Personal Data Breach Notification

In the event of a Personal Data breach, FeedSense will notify affected Controllers without undue delay and, where feasible, within 72 hours of becoming aware of the breach (consistent with GDPR Article 33 and KVKK Article 12). Notification will include:

• The nature of the breach
• The categories and approximate number of data subjects and records concerned
• The likely consequences
• Measures taken or proposed to address the breach and mitigate adverse effects
• Contact details for follow-up communication (incident coordinator)

FeedSense will assist the Controller in complying with its own notification obligations to supervisory authorities and data subjects.

9. AI Processing

FeedSense uses AI to analyze feedback and produce derivative data. The Controller authorizes the following processing:

• Local AI processing (no third-party transfer): sentiment / emotion classification, embedding generation (pgvector), theme clustering. These run on open-source models hosted inside FeedSense's AI service and do not transmit feedback content to any third party.
• External LLM processing (sub-processor): daily insight generation, keyword analysis, and AI Chat are routed through OpenRouter to underlying Large Language Model providers (e.g., OpenAI, Anthropic, Mistral). For these steps we send sample feedback text and the user's question. The current routing is listed on /legal/subprocessors.
• No model training: FeedSense does not train any model on Controller data. We rely on the no-retention posture published by the underlying LLM providers via OpenRouter.
• Article 22 position: AI output is advisory. FeedSense does not produce decisions that have legal or similarly significant effects on data subjects (GDPR Article 22).
• EU AI Act Article 50 (effective August 2026): AI-generated content surfaced in the dashboard, in AI Chat, and in outbound notifications (Slack messages, email summaries, Jira issues created by auto-rules) is labeled so human readers can identify it as AI-generated.

10. Data Protection Impact Assessment

Where the Controller's processing activities are likely to result in a high risk to the rights and freedoms of data subjects, FeedSense will provide reasonable assistance in conducting Data Protection Impact Assessments (DPIAs) and, where required, prior consultation with supervisory authorities.

11. Audit Rights

Upon written request and with at least 30 days' advance notice, FeedSense will make available the information reasonably necessary to demonstrate compliance with this DPA. This may include:

• Internal policies and procedures
• Results of independent audits, certifications, or penetration tests when available
• Security documentation and architecture overview

On-site audits are subject to mutually agreed scope, an NDA, and reimbursement of FeedSense's reasonable costs. Audit rights may be exercised at most once per calendar year except in the case of a confirmed Personal Data breach affecting the Controller.

12. Return or Deletion of Data

Upon termination of the Controller's account, FeedSense will, at the Controller's choice, delete or return all Personal Data processed on the Controller's behalf within 30 days (subject to the legal retention periods set out in the Privacy Policy). Self-service data export is available before termination and is the recommended path for data portability.

13. Governing Law

This DPA is governed by and construed in accordance with the laws of the Republic of Turkey, without prejudice to any mandatory data protection rights granted to data subjects under the laws of their country of residence.

14. Contact Information

For questions about this DPA or data processing activities:

15. Amendments

We may update this DPA to reflect changes in our service or applicable law. We will provide reasonable notice of material changes; continued use of the service after a material change constitutes acceptance of the updated DPA.

16. Standard Contractual Clauses (SCCs) Incorporation

For Personal Data transfers from the European Economic Area (EEA) or the United Kingdom to a country that has not been recognised as providing an adequate level of data protection, the parties incorporate by reference the European Commission Standard Contractual Clauses for the transfer of personal data to third countries (Decision 2021/914, "EU SCCs"), specifically Module Two (Controller-to-Processor), with FeedSense as data importer and the Controller as data exporter.

For UK transfers, the parties incorporate the UK International Data Transfer Addendum (IDTA) to the EU SCCs, issued under section 119A of the UK Data Protection Act 2018.

Where the SCCs offer multiple options, the parties agree:

• Clause 7 (Docking clause): does NOT apply unless expressly agreed.
• Clause 9(a): the Controller GENERALLY AUTHORISES sub-processors per the procedure in Section 5.
• Clause 11(a): the optional independent dispute resolution body language is NOT included.
• Clause 17: the SCCs are governed by the law of the Republic of Ireland (an EU Member State).
• Clause 18(b): the parties agree the courts of Ireland have jurisdiction over disputes arising from the SCCs.

The full text of the EU SCCs is published by the European Commission at commission.europa.eu. The full text of the UK Addendum is published by the ICO at ico.org.uk. FeedSense incorporates these texts by reference rather than restating them here so that any future amendment by the Commission or ICO automatically applies.

EU-US Data Privacy Framework: FeedSense does not currently rely on the EU-US Data Privacy Framework. SCCs Module 2 is the sole transfer mechanism FeedSense uses for transfers of Personal Data to U.S. core sub-processors.

Scope clarification: Module 2 (Controller-to-Processor) governs transfers to FeedSense's own sub-processors listed in Annex III. It does not govern data flows to Customer-Connected Services (Intercom, Zendesk, Slack, Jira); those are controller-to-controller pass-through relationships authorised by the Controller via OAuth. The Controller is responsible for the appropriate transfer mechanism (typically the Controller's own DPA with that vendor) for those services.

Annex I: Description of Processing

A. List of Parties

Data Exporter (Controller): the FeedSense customer, as identified at registration.
Data Importer (Processor): Mahir Can Yuksel (sole proprietorship), Turkey. Contact: [email protected].

B. Description of Transfer

C. Competent Supervisory Authority

For data subjects in the EU/EEA: the supervisory authority of the Member State in which the data subject is resident or where the alleged infringement occurred. For data subjects in the UK: the Information Commissioner's Office (ICO). For data subjects in Turkey: Kişisel Verileri Koruma Kurumu (KVKK).

Annex II: Technical and Organisational Measures

FeedSense maintains the following measures to protect Personal Data, calibrated to the risks of processing described in Annex I. These represent the current posture; we update Annex II when measures change.

Pseudonymisation and Encryption

• TLS 1.2 or higher on all public endpoints.
• Platform-managed encryption at rest on Railway PostgreSQL (the primary data store).
• Application-level AES-256-GCM encryption for OAuth credentials and webhook secrets stored in the integrations table.
• bcrypt (12 rounds) for administrator passwords; HMAC-SHA-256 for API key storage; SHA-256 for password reset token storage.
• Embeddings (pgvector) are derived numerical representations of feedback text; they are not plain-text PII but are protected as Personal Data given they are linked to identifiable feedback.

Confidentiality, Integrity, Availability, Resilience

• Role-based access control with least-privilege project membership; strict separation of customer data per company.
• Cloudflare in front of the public surface (DDoS mitigation, network edge controls).
• Helmet-based security headers, CSRF protection on dashboard write endpoints, route-aware CORS that distinguishes SDK (API-key) from dashboard (JWT) surfaces.
• Defense-in-depth gating layers (onboarding gate, entitlement gate, legal re-acceptance gate where enabled) that fail closed on auth + open on operational errors.
• Rate limiting on auth endpoints, per-IP registration throttle, AI Chat per-user daily quota.
• Input validation and sanitization (typebox schemas; DOM purification for HTML; prompt-injection filters on AI Chat).
• The AI service runs in a private network (ai.railway.internal); reachable only via a rotating bearer token from the application backend.

Restoration After an Incident

• Managed daily backups by the database provider with point-in-time recovery; recovery procedures documented in internal runbooks.
• Immutable audit trails: consent_audit_logs is FK-less by design so it survives user deletion (GDPR Article 7 evidence).

Testing and Evaluation

• Automated test suites (unit, component, integration); type-checking; linting; formatter enforcement pre-commit.
• Centralized monitoring (Sentry, Grafana Cloud, BetterStack) and structured logs (Pino → Loki).
• Penetration testing and SOC 2 / ISO 27001 certifications are not currently in place; the platform is operated by a sole proprietor, and these are part of our published roadmap when revenue supports them. We do not claim compliance we have not achieved.

Sub-Processor Engagement

Each sub-processor is engaged under a DPA that imposes obligations no less protective than this DPA, with appropriate transfer mechanisms in place per Section 5. See Annex III for the current list and /legal/subprocessors for the live source.

Personnel

• Confidentiality obligations apply to all personnel with access to Personal Data.
• Access is limited to what is necessary for the individual's role.
• Departing personnel have credentials revoked promptly.

Incident Response

72-hour Personal Data breach notification to affected Controllers per Section 8. We will assist Controllers in their own notification obligations to supervisory authorities and data subjects.

Annex III: Sub-Processors

The current sub-processor list is published at /legal/subprocessors and is incorporated into this DPA by reference. The same page lists the "Authorized Integrations" (customer-connected services such as Intercom, Zendesk, Slack, Jira) which are not sub-processors in the strict Article 28 sense; see Section 5.3 of this DPA for the full distinction.

Sub-Processor List Version: 2026-04-25.

When the list changes, we publish the change at the link above and email all paying customers via our customer mailing list at least 30 days before the new sub-processor begins processing Personal Data, except where an emergency security or legal requirement prevents the notice period.

Annex IV: EU / UK Representative

Not appointed. FeedSense has not appointed a representative under GDPR Article 27 / UK GDPR Article 27. We acknowledge this is required where the Processor is established outside the EU/EEA and UK and processes the personal data of data subjects located there. Appointment is on our roadmap and will be added to this Annex when in place. Until then, Controllers may direct GDPR / UK GDPR enquiries to [email protected].