1. Roles
You are the data controller for the personal data you process through the service (your audience’s comments, mentions and direct messages). FounderReply acts as your processor and processes that data only on your documented instructions.
2. Subject-matter and scope
The processing covers content generation, scheduling, publishing and the handling of inbound audience interactions across the social platforms you connect. Categories of data subjects are your audience and contacts; categories of data are the content and identifiers those interactions contain.
3. Sub-processors
We engage the sub-processors listed on our GDPR page (Supabase (EU region); Cloudflare; phi-cloud (AI gateway); Google (Gemini API, PageSpeed Insights, Search Console; US); Monopea (agent runtime); Monopea (website analytics; same operator); Browser-session provider; Prompt-injection classifier (self-hosted, Switzerland); Resend (EU region); Stripe; Telnyx / Twilio (US); LiveKit; Fly.io; MarketPrior; MCPDial (AI phone agent); CogniLead (cold email); GitHub (US); IndexNow (api.indexnow.org)), plus the platforms you connect, each bound by equivalent data-protection terms. We notify customers before adding or replacing a sub-processor.
4. AI processing and international transfers
AI processing runs through our phi-cloud AI gateway, which sends each call to a model host in the region we request: text generation in the United States, images on its global pool, embeddings and AI voice calls in the EU. Google’s Gemini API (United States) is used for web research and, only when phi-cloud is not configured, for drafting. Inputs are not used to train third-party models. Where a transfer outside the EU/EEA occurs (for example US-hosted AI processing, or a non-EU platform you authorise), it relies on Standard Contractual Clauses or an equivalent safeguard.
5. Security
We apply technical and organisational measures appropriate to the risk, including encryption of OAuth tokens at rest, workspace-scoped row-level security, TLS in transit and least-privilege access. Detail is on our Security page.
6. Data-subject requests & assistance
We assist you in fulfilling your obligations to respond to data-subject requests and to notify any personal-data breach without undue delay. Self-service deletion is available via Data & Deletion.
7. Return and deletion
On termination, we delete or return the personal data we process on your behalf, subject to any retention required by law.
8. Audit
We make available the information necessary to demonstrate compliance with Article 28 and support reasonable audits as set out in the signed DPA.