Legal

Data Processing
Agreement

Last updated · October 2026

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between Brody Felstead Media LLC ("BFM", "Processor") and the customer identified on the Order Form or workspace billing record ("Customer", "Controller"). It governs the processing of Personal Data by BFM on behalf of Customer in connection with the BFM Media platform (the "Service"). Where this DPA conflicts with the Terms of Service, this DPA controls for data-protection matters only.

2. Roles

Customer is the Data Controller for all Personal Data uploaded to or generated inside Customer's workspace, including data pulled from Customer's connected social platform accounts and the comment-trigger funnel. BFM is the Data Processor, processing that data only on Customer's documented instructions as set out in the Terms, this DPA, and Customer's configuration of the Service.

3. Nature and purpose of processing

BFM processes Personal Data to provide the Service, specifically:

  • Storing and displaying social media content Customer schedules, drafts, and publishes.
  • Publishing content to Customer's connected platform accounts via OAuth-authorized API calls.
  • Receiving comment and message webhooks from Meta on Customer's behalf and firing the corresponding DM / email funnel configured in a Comment Trigger.
  • Caching analytics returned from connected platforms (reach, engagement, impressions) for display in Customer's workspace.
  • Transactional communications with Customer's workspace members (invitations, approvals, notifications).

Processing is limited to the above purposes. BFM does not sell, rent, or share Personal Data with third parties for marketing purposes.

4. Categories of data and data subjects

Data subjects: Customer's workspace members, Customer's clients (where applicable), end-users of Customer's social accounts who comment or DM Customer's pages.

Categories of Personal Data processed:

  • Workspace member identifiers (name, email, image).
  • OAuth tokens and connected account identifiers (user ID, Page ID, channel ID) issued by Instagram, Facebook, TikTok, YouTube, LinkedIn, Threads, X, Pinterest.
  • Content Customer uploads (text, images, video) and content generated inside the workspace (captions, approvals, partnership notes, documents).
  • Public-facing social metadata returned by platform APIs (comment text, usernames, post statistics).
  • Email addresses captured through Comment Trigger funnels where Customer has configured an email-gate.
  • Usage telemetry (page views, action logs, API latencies).

5. Subprocessors

BFM uses the following subprocessors to deliver the Service. Current list is maintained here; material changes are announced at least 30 days before taking effect, giving Customer an opportunity to object.

  • Vercel Inc. — application hosting (United States).
  • Neon Inc. — Postgres database (United States, us-east region).
  • Resend / Postmark — transactional email delivery (United States).
  • Stripe Inc. — subscription billing (United States).
  • Meta Platforms, Inc., Google LLC, TikTok Pte. Ltd., LinkedIn Corp. — platform-specific publishing and insights APIs (invoked when Customer explicitly connects an account on that platform).

BFM has entered into written contracts with each subprocessor that impose data-protection obligations substantially equivalent to those in this DPA.

6. Security measures

  • Encryption in transit: TLS 1.2+ on every connection to the Service and between subprocessors.
  • Encryption at rest: AES-256 across both the Postgres database and object storage.
  • Row-level tenant isolation: every workspace is a separate row-level security scope at the database layer; a bug in application code cannot leak data across workspaces.
  • Access controls: workspace membership gated by role (Owner, Editor, Viewer); platform tokens scoped per workspace; secrets managed in Vercel environment variables with audit logging.
  • Backups: daily automated database snapshots with point-in-time recovery; media mirrored off-site nightly.
  • Vulnerability management: dependency upgrades reviewed weekly; CVE alerts triaged within one business day.

7. Data subject rights

BFM assists Customer in responding to data-subject requests (access, rectification, deletion, portability, restriction, objection). Workspace Owners can export every record attached to their workspace from Settings → Export and permanently delete the workspace from Settings → Danger zone, both self-serve. For requests directed at individual data subjects that cannot be fulfilled through the UI, email privacy@bfmedia.app and BFM will respond within 7 business days.

8. Incident notification

If BFM becomes aware of a Personal Data Breach affecting Customer's data, BFM will notify Customer without undue delay — in no event later than 72 hours after confirming the breach — through the primary email on the workspace billing record. The notification will describe what data was affected, when the breach occurred, what measures BFM has taken, and recommended Customer actions.

9. Return and deletion

On termination of the Service for any reason, BFM will delete Customer's Personal Data from the production database and object store within 30 days, and from encrypted backups within 90 days as those backups roll off. On written request, BFM will certify completion.

10. International transfers

Primary processing occurs in the United States (Vercel + Neon us-east). Where Customer is located in the EU, UK, or other jurisdiction with cross-border transfer requirements, the Standard Contractual Clauses (EU 2021/914, UK IDTA) are incorporated by reference and apply to the extent required by applicable law.

11. Audits

Customer may request a current security questionnaire or SOC-2 report (when available) once per 12-month period. On-site audits are available for Pro-tier customers under separate NDA.

12. Term

This DPA takes effect when Customer accepts the Terms of Service and remains in effect for the duration of the subscription plus the retention windows described in Section 9.

13. Contact

Data protection questions: privacy@bfmedia.app. Postal: Brody Felstead Media LLC, Berkeley Springs, WV, USA.