Skip to main content
Sociocrush
LoginGet Started

Data Processing Addendum

Last updated: 4 October, 2026

1. Parties and how this Addendum applies

This Data Processing Addendum ("Addendum") is between Sociocrush Technologies and the customer that has accepted the Sociocrush Terms of Service ("Customer"). Sociocrush Technologies, registered in India under Udyam Registration No. UDYAM-MH-26-1232140, with its registered office at 409, Parvati Park Society, Panmala, Sinhagad Road, Pune 411030, Maharashtra, India ("Sociocrush").

This Addendum forms part of the Terms of Service sociocrush.com/terms, or of any other written agreement between Sociocrush and Customer for the Sociocrush service (the "Agreement"). It takes effect automatically, without a signature, when the Customer accepts the Agreement electronically. Electronic acceptance is a valid and binding execution of this Addendum, including the Standard Contractual Clauses and the UK Addendum where they apply, and Sociocrush does not countersign individual copies.

This Addendum applies only where Sociocrush processes Customer Personal Data on Customer's behalf in providing the Service. If this Addendum conflicts with the Agreement on a data-protection matter, this Addendum prevails. If the Standard Contractual Clauses apply under clause 13 and conflict with this Addendum, the Standard Contractual Clauses prevail.

2. Definitions

In this Addendum, the following terms have the meanings below. Capitalised terms not defined here have the meanings given in the Agreement.

  • "Applicable Data Protection Law" means all laws on privacy and the protection of personal data that apply to the processing of Customer Personal Data under the Agreement, including, as applicable:
    • India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force;
    • the Information Technology Act, 2000 and the rules made under it;
    • the EU General Data Protection Regulation 2016/679 ("GDPR");
    • the UK GDPR and the UK Data Protection Act 2018;
    • the Swiss Federal Act on Data Protection;
    • the California Consumer Privacy Act and other U.S. state privacy laws.
  • "Customer Personal Data" means personal data that Customer, its users or its clients submit to the Service, or that Sociocrush receives through Customer's connected social-media accounts or website analysis, and that Sociocrush processes on Customer's behalf.
  • "Controller", "Processor", "Data Fiduciary", "Data Processor", "Data Principal", "Data Subject", "personal data", "processing", "business", "service provider" and "sell" or "share" have the meanings given in Applicable Data Protection Law.
  • "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Sociocrush or its Sub-processors.
  • "Sub-processor" means any third party that Sociocrush engages to process Customer Personal Data.
  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
  • "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

3. Roles of the parties

Customer is the controller, or Data Fiduciary, of Customer Personal Data. Sociocrush is Customer's processor, or Data Processor, and processes Customer Personal Data only on Customer's behalf.

Customer may itself process Customer Personal Data as a processor for its own clients, such as an agency managing its clients' brands. In that case Customer confirms that its client has authorised Customer's instructions to Sociocrush, including the engagement of Sociocrush as a sub-processor. Sociocrush is then Customer's sub-processor, and Customer remains Sociocrush's only point of contact.

This Addendum does not apply to personal data that Sociocrush processes for its own purposes as a controller or Data Fiduciary, which the Sociocrush Privacy Policy sociocrush.com/privacy governs. That data is account, sign-in, billing and payment information about Customer's users, information needed to secure the Service, prevent fraud and meet legal obligations, website visitor analytics, communications with Customers.

4. Customer's responsibilities

Customer is responsible for the lawfulness of the Customer Personal Data it submits and of its instructions to Sociocrush. In particular, Customer confirms that it has given every notice required by Applicable Data Protection Law, and has obtained every consent it requires or has another lawful basis, it has the right to connect each social-media account it connects to the Service, and to process that account's content, comments, messages and analytics, it has the right to submit any website for analysis. Customer will not submit special categories of personal data or sensitive personal data, the personal data of children, government identification numbers, financial account numbers or similar data, unless this is necessary for its legitimate use of the Service and it has a lawful basis to do so. Customer is responsible for configuring user access, roles and permissions within its Workspaces, and for keeping its users' login credentials secure.

5. Processing on instructions

Sociocrush will process Customer Personal Data only on Customer's documented instructions, unless processing is required by law. Where the law requires processing, Sociocrush will tell Customer before processing, unless the law prohibits that. Customer's complete instructions are the Agreement and this Addendum, Customer's use and configuration of the Service, including the content it creates, schedules and publishes, the accounts it connects, and the AI features it uses, any further written instructions that Customer gives and Sociocrush accepts. Sociocrush will promptly tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend that processing until the instruction is confirmed or changed. Annex 1 describes the subject matter, nature, purpose and duration of the processing, and the categories of personal data and data subjects.

6. Sociocrush's permitted own uses

Customer authorises Sociocrush to use Customer Personal Data, to the minimum extent necessary, for purposes that are part of providing the Service securing and maintaining the Service, detecting and preventing fraud, abuse and security incidents,metering AI credit and plan usage, complying with law, producing aggregated or de-identified statistics about how the Service performs, from which no individual or Customer can be identified, in order to improve the Service. Sociocrush will not use Customer Personal Data or Customer content to train general-purpose artificial-intelligence or machine-learning models, whether its own or a third party's, and will not authorise its AI Sub-processors to do so.

7. Confidentiality and personnel

Sociocrush will ensure that every person it authorises to process Customer Personal Data has signed a written agreement before receiving access. This includes its proprietor, staff and individual contractors working under its direct instructions. That agreement binds them to confidentiality and to data-protection obligations consistent with this Addendum. Such persons access Customer Personal Data only as needed to provide, support, maintain or secure the Service, use individual credentials, which are never shared, are informed of the confidential nature of the data. Sociocrush grants production access on a least-privilege, need-to-know basis. It reviews that access periodically, and removes it promptly when a person no longer needs it or their engagement ends. Sociocrush is responsible for the acts and omissions of these persons as if they were its own.

8. Security

Sociocrush will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breaches. These measures take into account the state of the art, the cost of implementation, and the nature, scope, context, purposes and risks of the processing. They meet at least the requirements of Article 32 of the GDPR and the reasonable security safeguards required by the Digital Personal Data Protection Rules, 2025.The measures in place on the date of this Addendum are described in Annex 2. Sociocrush may update them, provided that the overall level of protection is not reduced. Sociocrush does not currently hold an independent security certification, such as ISO/IEC 27001 or a SOC 2 report, and makes no representation that it does.

9. Sub-processors

Customer gives Sociocrush general authorisation to engage Sub-processors, and approves the Sub-processors listed in Annex 3. Sociocrush will impose on each Sub-processor, by written contract, data-protection obligations that give at least the same level of protection as this Addendum, and remains fully responsible to Customer for each Sub-processor's performance.

Sociocrush will keep its current list of Sub-processors in Annex 3 of this Addendum. Customers who subscribe by emailing support@sociocrush.com will be notified by email at least 30 days before a new Sub-processor begins processing Customer Personal Data.

Within that notice period, Customer may object to a new Sub-processor, on reasonable grounds relating to data protection, by writing to support@sociocrush.com. The parties will then discuss the objection in good faith. If Sociocrush cannot reasonably avoid using the new Sub-processor for Customer, Customer may terminate the affected part of the Service before the change takes effect, and will receive a pro-rata refund of fees prepaid for the period after termination. This termination right is Customer's only remedy for an objection under this clause.

Social-media platforms are not Sub-processors. When Customer publishes content to, or connects or interacts with an account on, a platform such as Instagram, Facebook, Threads, LinkedIn, Reddit, YouTube, Google Business Profile, TikTok, Pinterest, Telegram or Discord, that platform receives the data at Customer's direction and processes it as an independent controller under its own terms.

10. Personal Data Breaches

Notice- Sociocrush will notify Customer without undue delay, and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice goes to the account owner's registered email address. It will describe, as far as is then known the nature of the breach, including the categories and approximate number of data subjects and records concerned, its likely consequences,the measures taken or proposed to address it and to reduce its possible adverse effects, a contact point for further information. Where information is not available at first, Sociocrush will provide it in stages, without undue delay.

Containment and assistance- Sociocrush will take reasonable steps to contain, investigate and remedy the breach. It will give Customer the information and assistance Customer reasonably needs to meet its own notification obligations to the Data Protection Board of India and affected Data Principals, under the Digital Personal Data Protection Rules, 2025 and to supervisory authorities and data subjects, under Articles 33 and 34 of the GDPR and the UK GDPR.

Sociocrush's own reporting- Sociocrush will make any report the law requires of it, including to the Indian Computer Emergency Response Team within six hours under the CERT-In Directions of 28 April 2022. Except where the law requires it, Sociocrush will not notify affected data subjects or regulators about a breach of Customer Personal Data on Customer's behalf without first consulting Customer. Notification of a breach is not an admission of fault or liability.

11. Assistance with data subject requests and compliance

Taking into account the nature of the processing, Sociocrush will help Customer respond to requests from data subjects and Data Principals to exercise their rights, through the Service's features and appropriate technical and organisational measures. These include rights of access, correction, completion, updating, erasure, restriction, portability, objection, nomination and grievance redressal. Customer can carry out most such requests itself in the Service: by editing or deleting content, media, brand information and analyses, by disconnecting social-media accounts, and by removing Workspace members. If Sociocrush receives such a request directly about Customer Personal Data, it will forward the request to Customer within 5 business days. It will not respond to the request itself, except to tell the person to contact Customer, unless the law requires otherwise or Customer has authorised Sociocrush to respond. Sociocrush will also give Customer reasonable assistance with data protection impact assessments and prior consultations with regulators relating to the Service, using information available to Sociocrush. Where the law allows, it may charge reasonable costs for assistance beyond the Service's standard features and documentation.

12. Deletion and return of data

During the term- Customer can delete Customer Personal Data at any time using the Service's features media that Customer deletes is permanently removed from storage 30 days later, when Customer disconnects a social-media account, its access tokens are deleted immediately, and other data obtained through that connection within 30 days, when Customer deletes its account or a Workspace, the Customer Personal Data in it is deleted or irreversibly anonymised within 30 days.

At the end of the Agreement- Before the Agreement ends, Customer may export its content. Within 30 days after the Agreement ends, Sociocrush will delete Customer Personal Data from its active systems. If the law requires Sociocrush to keep any of it, that data remains protected by this Addendum for as long as it is kept.

Backups and special cases- Deleted data may remain in encrypted backups for up to 7 days until those backups are overwritten. It is not restored, except to recover from an incident. YouTube data is deleted within 7 days of a deletion request, as YouTube's developer policies require. Sociocrush does not delete data held by social-media platforms; Customer must request deletion from each platform concerned. On written request, Sociocrush will confirm in writing that deletion has been completed.

13. International transfers

Sociocrush is established in India. Customer Personal Data is stored in Singapore, and processed in India, the United States and the other locations of the Sub-processors listed in Annex 3. Customer authorises these transfers.

India- Transfers outside India are made in accordance with section 16 of the Digital Personal Data Protection Act, 2023, and any restriction notified under it.

European Economic Area- For any transfer of Customer Personal Data subject to the GDPR to Sociocrush in a country without an adequacy decision, the SCCs are incorporated into this Addendum by reference and apply, with Customer as data exporter and Sociocrush as data importer. They are completed as follows - Module 2 applies where Customer is a controller, and Module 3 where Customer is a processor, the optional docking clause in Clause 7 does not apply, Option 2 of Clause 9(a) applies, with the 30-day notice period in clause 9 of this Addendum, the optional wording in Clause 11 does not apply, in Clause 13, the competent supervisory authority is that of the EU Member State where Customer is established. If Customer has no establishment in the EU, it is the authority of the Member State where Customer's representative is established, or otherwise the Data Protection Commission of Ireland, under Clauses 17 and 18, the SCCs are governed by Irish law, and disputes are resolved by the courts of Ireland, Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this Addendum.

United Kingdom- For transfers subject to the UK GDPR, the UK Addendum is incorporated and completed with the information in this Addendum. In Table 4, the parties select that neither party may end the UK Addendum when it is revised.

Switzerland- For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with two adjustments: references to the GDPR are read as references to that Act, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

Onward transfers- Sociocrush will protect its own onward transfers to Sub-processors by the SCCs, the UK Addendum, an adequacy decision or the EU-U.S. Data Privacy Framework, as applicable. It will give Customer the information Customer reasonably needs for a transfer impact assessment.

Government requests- If a public authority requests access to Customer Personal Data, Sociocrush will, unless prohibited by law - notify Customer, review the legality of the request, and challenge it where there are reasonable grounds, disclose only the minimum data required.

14. United States privacy laws

To the extent the California Consumer Privacy Act or another U.S. state privacy law applies, Sociocrush acts as Customer's service provider or processor. It processes Customer Personal Data only for the limited and specified business purposes of providing the Service under the Agreement. Sociocrush will not - sell or share Customer Personal Data, keep, use or disclose it for any purpose other than providing the Service, including any commercial purpose other than providing the Service, or outside the direct business relationship between the parties, combine it with personal data received from other sources, except as those laws permit. Sociocrush will comply with those laws and provide the same level of privacy protection they require, and will tell Customer if it can no longer meet these obligations. Customer may take reasonable and appropriate steps to stop and remedy any unauthorised use of Customer Personal Data, and to ensure that Sociocrush's use is consistent with Customer's obligations under those laws. Sociocrush certifies that it understands and will comply with these restrictions.

15. Records and audits

Sociocrush will keep records of its processing activities as required by Applicable Data Protection Law. On Customer's written request, no more than once in any twelve months, Sociocrush will make available the information reasonably necessary to demonstrate its compliance with this Addendum. This includes written responses to a reasonable security questionnaire and its current list of Sub-processors. Customer may carry out, or have an independent auditor bound by confidentiality carry out, an on-site or remote audit only where - that information is reasonably insufficient to demonstrate compliance, a Personal Data Breach has occurred or a regulator requires it. Any audit takes place on at least 30 days' written notice, during normal business hours, at a reasonable time, without disrupting the Service or breaching the confidentiality of other customers, and at Customer's cost. Information obtained in an audit is Sociocrush's confidential information.

16. Liability

Each party's liability arising out of or relating to this Addendum is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Applicable Data Protection Law or the SCCs do not allow such limitation. Nothing in this Addendum limits any party's liability to data subjects under the SCCs, or under Applicable Data Protection Law where that liability cannot lawfully be limited.

17. Term and changes

This Addendum lasts for as long as Sociocrush processes Customer Personal Data on Customer's behalf. Its obligations survive the end of the Agreement until all Customer Personal Data has been deleted. Sociocrush may update this Addendum where reasonably necessary to comply with Applicable Data Protection Law, a regulator's guidance, or a change of Sub-processor, provided that the update does not materially reduce the protection given to Customer Personal Data. Sociocrush will give at least 30 days' notice of any material change.

18. Governing law

Except for the SCCs and the UK Addendum, which are governed by the law stated in them, this Addendum is governed by the laws of India. Disputes are resolved in accordance with the dispute-resolution clause of the Agreement, with the seat of arbitration in Pune, Maharashtra.

19. Contact

Send data-protection questions about this Addendum to support@sociocrush.com, and report security incidents to support@sociocrush.com. EU customers may also contact Sociocrush's EU representative, Siddhesh Malve (Registered Office: 409, Parvati Park Society, Panmala, Sinhagad Road, Pune 411030, Maharashtra, India; Email: support@sociocrush.com), and UK customers its UK representative, Siddhesh Malve (Registered Office: 409, Parvati Park Society, Panmala, Sinhagad Road, Pune 411030, Maharashtra, India; Email: support@sociocrush.com).

Annex 1 — Description of the processing

Parties-

  • Data exporter: Customer, as identified in its Sociocrush account, acting as controller, Data Fiduciary or processor. Contact details: the account owner's details. Activities: using the Service to manage its own or its clients' social-media presence. Signature: acceptance of the Agreement.
  • Data importer: Sociocrush Technologies, at the address in clause 1, acting as processor, Data Processor or sub-processor. Contact: Siddhesh Malve, Proprietor, at support@sociocrush.com. Activities: providing the Service. Signature: acceptance of the Agreement.

Categories of data subjects.

  • Customer's Workspace members and invited clients;
  • Customer's clients and their staff;
  • individuals shown in, mentioned in or quoted in content that Customer uploads or creates;
  • the audience of Customer's connected social-media accounts, including people who comment on, reply to or message those accounts;
  • individuals whose contact details are published on websites that Customer submits for analysis.

Categories of personal data.

  • names, email addresses and contact details;
  • Workspace roles and activity;
  • social-media profile information, such as usernames, display names, profile pictures and account identifiers;
  • comments, replies and messages, with their authors' public profile information;
  • images and videos, which may show people's faces;
  • captions, posts and other text content;
  • engagement and analytics data;
  • business contact details published on analysed websites;
  • AI prompts and generated content.

Sensitive data- None is intended, and Customer will not submit any except as allowed by clause 4. Any that is submitted is protected by the measures in Annex 2.

Frequency- Continuous, for as long as Customer uses the Service.

Nature and purpose- Hosting, storage, organisation, analysis and retrieval of Customer Personal Data, for the purpose of providing the Service: scheduling and publishing content to social-media platforms, team collaboration and approval workflows, media management, analytics, website analysis for Brand Brain, and AI-assisted content generation.

Duration and retention- For the term of the Agreement, followed by deletion as described in clause 12.

Transfers to Sub-processors- Their subject matter, nature and duration are as described in Annex 3.

Annex 2 — Technical and organisational security measures

Encryption-

  • All data in transit is encrypted using HTTPS with HTTP Strict Transport Security.
  • Data at rest in the database and file storage is encrypted by Sociocrush's infrastructure providers.
  • Social-media access and refresh tokens are additionally encrypted at the application level with AES-256-GCM.

Access control and isolation-

  • Each Customer's data is logically separated by database row-level security policies and application role-based permissions, so that users see only the Workspaces and brands they are authorised to access.
  • Stored media is accessed only through short-lived signed links.
  • Service-level credentials are kept server-side and are never exposed to users' browsers.

Personnel-

  • Production access is limited to the proprietor and to staff and contractors who have signed confidentiality and data-protection agreements.
  • Access uses individual credentials, is granted on a least-privilege, need-to-know basis, is reviewed periodically, and is revoked promptly when no longer needed or when an engagement ends.

Application security-

  • All user input is validated on the server, and uploaded files are checked for type and content.
  • The website-analysis crawler is protected against being directed to private, internal or cloud-metadata network addresses: every request and redirect is checked, and its network connection is locked to the address that passed the check.
  • Optimised and thumbnail copies of uploaded images are produced without embedded metadata.

Availability and resilience- Daily database backups are retained for 7 days, and the Service is hosted on managed cloud infrastructure with automatic scaling.

Logging and incident response-

  • Access to and changes in the Service are logged, and security and access logs are kept for 1 year.
  • Incidents are handled under a documented incident-response procedure, including reporting to CERT-In.

Sub-processors- Sub-processors are bound by written data-protection terms, and their security is reviewed before engagement.

Annex 3 — Sub-processors

Clerk, Inc. (United States). User authentication, account management, and sign-in and invitation emails. Processes the names, email addresses and sign-in data of Customer's users and invitees.

Supabase, Inc. (data hosted in Singapore, AWS ap-southeast-1). Database and file storage for all Customer Personal Data.

Vercel Inc. (United States, with a global edge network). Application hosting and computing. Processes all Customer Personal Data in transit, and technical logs.

OpenAI (United States). AI text, image and Brand Brain generation. Processes the prompts, brand context and content that Customer selects for an AI action. Under OpenAI's API terms, this data is not used to train OpenAI's models and may be kept for up to 30 days for abuse monitoring.

Kling (API ENDPOINT IN SINGAPORE). AI video and audio generation. Processes the prompts, reference images and media that Customer selects for video generation.