Data Processing Agreement

1. Scope and roles

This Data Processing Agreement ("DPA") forms part of the SanCai Terms of Service. When you use SanCai to process personal data of your customers, followers, or audience members, you act as the data controller and SanCai Intelligence Inc. acts as the data processor. This DPA applies to the extent GDPR, UK GDPR, CCPA/CPRA, or similar laws apply to that processing.

2. What we process

• Account and contact details of your team members (name, email, role).
• Social account identifiers and publishing metadata for the profiles you connect.
• Aggregated engagement metrics returned by platform APIs (likes, views, spend, ROAS inputs).
• Content you approve for publication, including captions and media.

We process this data only to provide the service, per your documented instructions (including approvals you give in the product), and for no independent purpose.

3. Your rights and our obligations

• Export and deletion: you can export all data held for your tenant, or request full deletion, from Settings → Privacy in the dashboard, or by emailing privacy@sancai.ai. Deletion completes within 30 days, including from backups at the next rotation.
• Data subject requests: we will reasonably assist you in answering access, rectification, erasure, and portability requests relating to data we process for you.
• Breach notice: we will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting your data.
• Confidentiality and security: personnel with access are bound by confidentiality obligations. Measures include encryption in transit, encryption of platform tokens at rest, row-level tenant isolation, and audit logging of administrative actions.

4. Subprocessors

You authorize the subprocessors listed at sancai.ai/subprocessors. We give at least 14 days' notice of new subprocessors; you may object on reasonable data-protection grounds and we will work with you on a resolution, which may include termination with a pro-rata refund if the objection cannot be resolved.

5. International transfers

Where data is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (2021/914) or the recipient's adequacy status. Some AI inference subprocessors are located in China; prompts and brand context sent to them are limited to what is needed to generate the content you request, and never include your customers' account credentials.

6. Audits and liability

We make available the information reasonably necessary to demonstrate compliance with this DPA and respond to written audit requests once per year, subject to confidentiality. Liability under this DPA is subject to the limitation of liability in the Terms of Service.

7. Contact

Data-protection inquiries and DPA countersignature requests: privacy@sancai.ai.