Data Processing Agreement (DPA)

Scope of Application

This DPA applies to all personal data processing performed by outwrite.ai when providing AI content generation, WordPress integration, subscription management, and related services where outwrite.ai acts as a data processor on behalf of users (data controllers).

Key Definitions

• • Personal Data: Any information relating to an identified or identifiable natural person, including names, emails, IP addresses, and usage analytics
• • Data Controller: The customer/user who determines the purposes and means of personal data processing
• • Data Processor: outwrite.ai, which processes personal data on behalf of the data controller
• • Data Subject: The individual whose personal data is being processed
• • Sub-processor: Third-party service providers engaged by outwrite.ai to assist in data processing

Categories of Personal Data Processed

• • Account Information: Email addresses, full names, Google OAuth tokens, subscription status
• • Content Data: Project titles, generated content, meta descriptions, optimization data
• • WordPress Integration: Site URLs, usernames, encrypted credentials (using pgsodium)
• • Usage Analytics: Content generation events, subscription usage, feature access logs
• • Payment Information: Stripe customer IDs, subscription metadata (card data processed by Stripe)
• • Technical Data: IP addresses, session tokens, API usage logs, rate limiting data

Processing Purposes and Legal Basis

• • Service Delivery (Contract Performance): AI content generation, WordPress publishing, photo integration
• • Account Management (Contract Performance): User authentication, subscription management, usage tracking
• • Security & Fraud Prevention (Legitimate Interest): Rate limiting, abuse detection, security monitoring
• • Customer Support (Contract Performance): Technical assistance, billing support, issue resolution
• • Service Improvement (Legitimate Interest): Anonymous usage analytics, performance optimization

Data Subjects

Registered users of the outwrite.ai platform, including content creators, marketers, and business users who utilize our AI content optimization services.

Authorized Sub-processors

International Data Transfers

Data may be transferred outside the European Economic Area (EEA) to the following regions:

• • United States: Protected by adequacy decisions and Standard Contractual Clauses (SCCs)
• • OpenAI/Google AI processing: US-based with contractual safeguards
• • AWS Infrastructure: EU and US regions with appropriate technical measures

Data Security Infrastructure

• • Encryption in Transit: TLS 1.3 for all data transmission and API communications
• • Encryption at Rest: AES-256 database encryption via Supabase/AWS infrastructure
• • Credential Protection: WordPress passwords encrypted using pgsodium with project-specific keys
• • Access Controls: Row Level Security (RLS) policies ensuring user data isolation
• • Authentication: Google OAuth 2.0 with JWT tokens for session management

Operational Security

• • Rate Limiting: 5 attempts per 15-minute window for critical operations
• • Audit Logging: Comprehensive usage event tracking with retention policies
• • Automated Backups: Daily database backups with point-in-time recovery
• • Monitoring: Real-time security monitoring and anomaly detection
• • Incident Response: 48-hour breach notification procedures

Retention Periods

• • Active Account Data: Retained throughout subscription period and for 30 days post-termination
• • Generated Content: 30 days after account deletion for recovery purposes
• • Usage Logs: 12 months for billing verification and fraud prevention
• • WordPress Credentials: Deleted immediately upon user disconnection or account termination
• • Payment Data: Retained per Stripe's data retention requirements and applicable law
• • Security Logs: 90 days for incident investigation and compliance

Deletion Procedures

Upon account deletion request, all personal data is permanently removed within 30 days, except where retention is required by law. Users receive confirmation of deletion completion via email.

Rights Implementation

• • Access (Art. 15 GDPR): Users can export all their data via dashboard or API
• • Rectification (Art. 16 GDPR): Profile and content data can be updated through user interface
• • Erasure (Art. 17 GDPR): Account deletion feature with 30-day confirmation period
• • Portability (Art. 20 GDPR): JSON export of all user content and metadata
• • Objection (Art. 21 GDPR): Opt-out mechanisms for legitimate interest processing
• • Restriction (Art. 18 GDPR): Temporary processing limitations upon request

Response Timeline

Data subject requests are processed within 30 days of receipt. For complex requests, we may extend this period by 60 days with appropriate notification to the data subject.

Processing Restrictions

• • Process personal data only on documented instructions from the data controller
• • Ensure confidentiality of all personnel with access to personal data
• • Implement appropriate technical and organizational security measures
• • Obtain prior consent before engaging additional sub-processors
• • Assist with data protection impact assessments when required

Breach Notification

Personal data breaches are reported to data controllers within 48 hours of discovery, including available details about the nature, scope, and remediation measures taken.