Data Processing Addendum
Effective when you accept the Terms of Service.
1. Roles
You are the data controller; Mapstack is the data processor for content you upload and the personal data of your end customers contained in it.
2. Subject matter & duration
Processing covers content generation, scheduling, and publishing for the duration of your subscription plus a 30-day deletion grace period.
3. Sub-processors
- Lovable Cloud (EU/US) — hosting, database, storage.
- Lovable AI Gateway — LLM inference for caption generation and moderation.
- Stripe — billing.
- Connected social platforms — only data you explicitly publish.
4. Security measures
TLS 1.2+, AES-256 at rest, encrypted OAuth tokens, Row-Level Security, audit logging, principle-of-least-privilege access, annual security review.
5. International transfers
Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (2021/914).
6. Data subject rights
We provide self-service export and deletion in the product. We assist you with any additional data-subject requests within 30 days.
7. Breach notification
We will notify you of a personal-data breach without undue delay and within 72 hours of becoming aware.
8. Audit
On reasonable notice (and no more than once per year) you may request our latest security audit summary.
9. Return / deletion
Upon termination, all customer data is deleted within 30 days unless retention is required by law.