Data Processing Agreement

Version and validity

• Version: 30 October 2026. This version applies from that date.
• Last updated: 30 October 2026.
• From: CS Digital Wonders (CS Digital Wonders LLC, a limited liability company organized under the laws of the State of Wyoming, USA; 30 N Gould St Ste N, Sheridan, WY 82801, USA). SemPost is a product of CS Digital Wonders.
• How changes are announced: at least 30 days before a material change takes effect, we email the owners of every workspace . Minor corrections are recorded in the Changes section at the end of this page. Changes to our sub-processors follow section 8.

1. Scope

1.1 This Data Processing Agreement ("DPA") applies when you use SemPost to process personal data as a controller, that is, when you decide why and how the personal data in your content is processed. We then process that data on your behalf as your processor.

1.2 This DPA is part of our Terms of Service. It applies from the moment you accept the Terms, without a separate signature. If you need a copy signed by us, write to [email protected].

1.3 "You" means the customer: the business or person that a workspace belongs to. The workspace owner accepts this DPA on the customer's behalf. "We" and "SemPost" mean CS Digital Wonders LLC ("CS Digital Wonders"), which operates SemPost.

1.4 SemPost is sold to businesses and to consumers. If you use SemPost only for purely personal or household purposes, data protection law usually does not treat you as a controller, and this DPA does not apply to that use.

1.5 The KVKK Standard Contracts for transfers from Turkey must be signed. Accepting this DPA online does not conclude them (section 9.5).

2. Definitions

• Data protection law: the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and the UK Data Protection Act 2018; Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation; and any other data protection law that applies to the processing.
• Controller, processor, data subject, personal data, processing and personal data breach: as defined in the GDPR. Under KVKK the matching terms are veri sorumlusu, veri işleyen, ilgili kişi and kişisel veri ihlali.
• Customer Personal Data: personal data that we process on your behalf when we provide SemPost to you, as described in Annex I.
• Sub-processor: a third party that we engage and that processes Customer Personal Data for us.
• Workspace: the area in SemPost that holds a customer's stores, social accounts, posts, media, automation rules, analytics and team.
• SCCs: the standard contractual clauses in the annex to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• KVKK Standard Contracts: the standard contracts for transfers of personal data abroad announced by the Turkish Personal Data Protection Board under the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette of 10 July 2024, No. 32598).

3. Roles

3.1 For Customer Personal Data, you are the controller and we are your processor. If you yourself are a processor for another controller (for example an agency working for a brand), you confirm that this controller has authorised your instructions to us. We then act as your sub-processor.

3.2 We are a separate controller for the personal data we need to run our own business: user accounts and sign-in, security records such as login attempts and the audit log, billing records, support requests and the emails we send. Our Privacy Policy and, for Turkey, our KVKK Information Notice explain that processing. This DPA does not cover it.

3.3 On the web, Link (Stripe) sells SemPost to you as merchant of record and processes payment data as an independent controller. If you installed SemPost from the Shopify App Store, Shopify bills you and processes the data it holds under its own terms. Neither of them is our sub-processor for that processing.

3.4 The social networks you publish to receive the content you choose to publish and process it under their own terms. They are not our sub-processors.

4. Processing only on your instructions (GDPR Art. 28(3)(a))

4.1 We process Customer Personal Data only on your documented instructions, including instructions about transfers to other countries. The only exception is where a law that applies to us requires other processing. In that case we tell you about that legal requirement before we process the data, unless that law forbids us to tell you.

4.2 Your instructions are:

• the Terms of Service and this DPA;
• what you set up and do in SemPost: for example the stores and social accounts you connect, what you generate, approve, schedule and publish, your automation rules, the AI models you choose in Settings › AI models, and your export and deletion requests;
• any other written instruction that you give us and that we accept in writing.

4.3 We tell you immediately if, in our opinion, an instruction infringes data protection law. We may then hold that instruction until you confirm or change it.

4.4 We do not use Customer Personal Data for our own purposes and we do not sell it. We do not train AI models on it. Under the terms of Anthropic and of Google's paid Gemini API, these providers may not use it to train their models; fal.ai processes it under its terms for business customers, and Stability AI receives none of it (see Sub-processors).

5. Your responsibilities

5.1 You make sure that you have a legal basis for the Customer Personal Data you bring into SemPost and for everything you ask us to do with it, including publishing it on social networks.

5.2 You inform the people concerned as the law requires: for example people shown in your photos and videos, people named in your posts and voiceover texts, and people who receive a message through comment-to-DM.

5.3 SemPost is not designed for special categories of personal data (such as data about health) or for data about children. Do not put such data into SemPost unless you need to and the law allows it. SemPost does not recognise people by their face or voice and does not offer avatars or voice clones of real people.

5.4 Comment-to-DM is off by default and only available in some regions. When you turn it on, you are the sender of these messages and you are responsible for any consent that the rules on commercial electronic messages require. See the Acceptable Use Policy.

5.5 You follow the terms of the social networks whose accounts you connect. See Platform Terms.

5.6 Your instructions to us comply with data protection law.

6. Confidentiality (GDPR Art. 28(3)(b))

6.1 Only people who need access in order to provide, support or secure SemPost can access Customer Personal Data, and only as far as their task requires.

6.2 We make sure that each of these people has committed to confidentiality or is under an appropriate legal duty of confidentiality.

6.3 Our staff work with customer data only through our admin console (Global Admin). It runs on a separate address behind Cloudflare Access, requires two-factor authentication for every sign-in, asks for a fresh code before sensitive actions, separates read-only support access from changes, and records actions in an audit log.

7. Security (GDPR Art. 28(3)(c) and Art. 32)

7.1 We take the technical and organisational measures described in Annex II. They take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for people.

7.2 We may change these measures as technology and risks develop, but we will not lower the overall level of protection.

7.3 Under KVKK Article 12(2), when we process Customer Personal Data on your behalf, you and we are jointly responsible for taking the measures to keep it secure.

7.4 Your part of security: protect the sign-ins of your team (use two-factor authentication; you can require it for the whole workspace), give each member the lowest role that is enough (viewer, editor, admin or owner), remove members who leave, and keep your own copies of files you cannot afford to lose (media files are not included in our database backups; see Annex II).

8. Sub-processors (GDPR Art. 28(2), 28(3)(d) and 28(4))

8.1 General authorisation. You give us general written authorisation to engage sub-processors. The current list shows, for each sub-processor, what it does, which data it receives, where it processes data and which transfer safeguard applies. It is published at Sub-processors and forms Annex III of this DPA.

8.2 Same obligations. We engage a sub-processor only under a written contract that imposes on it data protection obligations that are the same as, or equivalent to, those in this DPA, in particular sufficient guarantees of appropriate security measures. We remain fully liable to you for the performance of our sub-processors' obligations.

8.3 Notice of changes. We tell you at least 14 days before a new sub-processor starts processing Customer Personal Data, or before an existing one processes it for a new purpose or in a new country. We tell you:

• by email to the owners and admins of every workspace; and
• on the Sub-processors page, which lists each change with its date.

8.4 Objection. You may object in writing within 14 days after the notice, on reasonable grounds related to data protection, by email to [email protected]. We will then try to find a solution with you. Some providers are only used for features or AI models that you choose, for example in Settings › AI models, so a solution may be to stop using that feature. If we cannot find a solution within 30 days after your objection, you may end the affected part of the service, or the whole agreement if SemPost cannot be used without the new sub-processor. We then refund, pro rata, the fees you paid in advance for the period you can no longer use, through the channel you paid with (Link or Shopify).

8.5 Urgent replacement. If we have to replace a sub-processor urgently, for example because it stops its service or has a security problem, we may do so with shorter notice. We then tell you as soon as possible, and your right to object under 8.4 applies.

8.6 The chain. On request we tell you which sub-processors our sub-processors use, as far as they disclose this to us. Where they publish their own lists, we link to them on the Sub-processors page. We also send the current list to anyone who asks for it.

9. Transfers to other countries

9.1 Where data is processed. Our servers are in the USA (Contabo). Cloudflare runs in front of them and stores media files and encrypted backups (Cloudflare R2). No storage region is set for our R2 buckets, so Cloudflare chooses where these files are stored, which can be outside the EU and Turkey. Our sub-processors process data in the places listed on the Sub-processors page. Unless you are in the USA, this means that Customer Personal Data is transferred to another country.

9.2 From the EU and the EEA. Where Customer Personal Data is transferred from the EEA to a country that has no adequacy decision, the SCCs apply and are incorporated into this DPA by reference:

• Module 2 (controller to processor) applies between you and us when you are a controller.
• Module 3 (processor to processor) applies when you are yourself a processor for another controller.
• Our onward transfers to sub-processors take place under written contracts that meet Clauses 8.8 and 9 of the SCCs.
• Clause 9(a): Option 2 (general written authorisation), with the 14-day notice in section 8.3.
• Clause 13: the supervisory authority in Annex I, part C.
• Clause 17: the law of the EU Member State in which the data exporter is established; where that law does not allow for third-party beneficiary rights, the law of Ireland. Clause 18: the courts of that same Member State.
• The Annexes of the SCCs are completed by Annexes I, II and III of this DPA.

Where the GDPR applies to our processing directly (Article 3(2) GDPR), the SCCs were not designed for the transfer, and no separate clauses have yet been adopted for this case; we apply the SCCs as the most suitable safeguard available. SemPost itself is not certified under the EU-U.S. Data Privacy Framework.

9.3 From the UK. For transfers from the UK, the UK Addendum applies together with the SCCs. Table 1 (parties) is completed by Annex I, part A; Table 2 by the modules and options in section 9.2; Table 3 by Annexes I, II and III.

9.4 From Switzerland. For transfers from Switzerland, the SCCs apply with the adjustments required by Swiss data protection law.

9.5 From Turkey (KVKK). Transfers abroad from Turkey need one of the safeguards in KVKK Article 9, as amended by Law No. 7499. We propose:

• KVKK Standard Contract 2 (controller to processor) between you, as the party transferring the data from Turkey, and us;
• KVKK Standard Contract 3 (processor to processor) between us and our sub-processors.

The standard contracts cannot be changed except for their optional parts. They are signed in Turkish by persons authorised to sign for each party. Accepting this DPA online is not enough. To sign Standard Contract 2 with us, write to [email protected]. The party that transfers the data notifies the Personal Data Protection Authority within 5 business days after signing.

9.6 Requests from public authorities. If a public authority asks us for Customer Personal Data, we tell you promptly, unless the law forbids it. We check whether the request is lawful, challenge it where there are reasonable grounds, and disclose no more than the request requires.

9.7 Transfer impact assessments. We give you the information we have that you need to assess a transfer, such as the locations and safeguards on the Sub-processors page and the measures in Annex II. We have no ready-made transfer impact assessment document; on request, we answer your questions about it in general terms.

10. Help with data subject requests (GDPR Art. 28(3)(e))

10.1 SemPost gives you tools to answer most requests yourself:

• export a workspace's data as a ZIP file of JSON files, with download links for the media files (owners and admins) ;
• delete posts that have not been sent, media files, store connections, social account connections and team members;
• delete the whole workspace (owner) .

10.2 If a data subject contacts us directly about Customer Personal Data, we forward the request to you without undue delay. We do not answer it ourselves, except to say that we have passed it on, unless you ask us to.

10.3 If you cannot handle a request with these tools, we help you. Our staff can delete a workspace or an account for you; each such deletion is recorded with its reason .

10.4 Comment-to-DM: the record of who received a message is kept by our gateway Zernio, not by SemPost. How long Zernio keeps it is set by Zernio (see its privacy policy). If you need that record for a request, we ask Zernio for it, and we pass requests to delete a person's record on to Zernio.

10.5 We do not charge for this help, unless requests are clearly unfounded or excessive.

11. Breaches, impact assessments and prior consultation (GDPR Art. 28(3)(f) and Arts 32–36)

11.1 Breach notice. We notify you without undue delay and in any case within 48 hours after we become aware of a personal data breach that affects Customer Personal Data. We send the notice by email to the owners of the affected workspaces; there is no separate emergency channel.

11.2 The notice describes, as far as we know at that time:

• what happened, and when;
• the categories and approximate number of people and records concerned;
• the likely consequences;
• what we have done and propose to do to address the breach and reduce its effects;
• a contact person for more information.

If we do not have all this information at once, we send it in stages without further undue delay. A notice is not an admission of fault.

11.3 You decide whether to notify supervisory authorities and the people concerned. Under the GDPR the deadline for the authority is 72 hours. Under KVKK, the Personal Data Protection Board expects notice within 72 hours. We help you with the information we have.

11.4 Security, impact assessments and consultation. We help you meet your obligations under GDPR Articles 32 to 36, taking into account the nature of the processing and the information available to us. In particular we provide information for your data protection impact assessments and for any prior consultation with a supervisory authority.

12. Return and deletion (GDPR Art. 28(3)(g))

12.1 Getting your data. At any time while you use SemPost, owners and admins can export the workspace: a ZIP file with JSON files (the workspace and its members, invitations, store connections without secrets, social accounts, posts and their history, automation rules with their runs and events, analytics, credits, the audit log and brand settings) and a list of media files with download links valid for 24 hours. We prepare the export in the background and email you when it is ready; you then download it in SemPost, signed in as an owner or admin, within 24 hours. A workspace can be exported once a day . Media files can also be downloaded from the Media page.

12.2 When processing ends. Processing of Customer Personal Data ends in one of these ways:

• You delete the workspace (Settings › Workspace, owner only). An open Stripe subscription is cancelled first; the refund rules are in the Refund and Cancellation Policy. The workspace closes at once: publishing, automation and generation stop. You can undo the deletion for 7 days. During these days the social accounts stay connected to our gateway, so they do not need to be connected again if you undo the deletion. On day 7 we delete the workspace permanently, and its social accounts are disconnected.
• You uninstall the Shopify app. About 48 hours later Shopify sends us a deletion request for the store (shop/redact). We then delete the workspace, if the installation created it and it has never bought anything on the web through Link (Stripe). Otherwise we only delete that store's connection and installation records, and the rest of the workspace stays until you delete it.
• The agreement ends in another way. We delete Customer Personal Data within 30 days after the end. During those 30 days you can ask us for an export.
• A workspace without an open plan stays unused. After a trial or a paid plan ends without a new payment, the workspace and its data stay available. If a workspace has no open plan, for whatever reason (for example, the trial ended, the subscription was cancelled or a payment failed), and no member signs in or does anything in it for 150 days, we email its owners; if that is still the case on day 180, we delete the workspace .

12.3 What permanent deletion removes. The workspace's profile at our social gateway; all files stored for the workspace (generated media, thumbnails, temporary files, brand files and library uploads); the workspace and every record linked to it; and users who are not members of any other workspace, with their sessions and login records .

12.4 Backups. Database backups are encrypted and cannot be edited record by record. Deleted data can remain in them until they expire, within about 4 weeks, as the backup cycle replaces old backups. Until then it is not used for anything else.

12.5 What we keep after deletion, and why.

• Records that name the workspace only by an internal identifier: the audit log, the credit ledger, publishing events and billing alerts. We keep them for security, accountability, billing and legal claims. In the audit log, the IP address and browser details of a deleted person are blanked . The audit log is kept for 2 years, and its IP addresses and browser details are blanked after 1 year .
• If the workspace came from Shopify: a record of Shopify's privacy requests (the store's domain) and a digest of the store's Shopify ID, which we use to give the free trial only once per store.
• The records that Link (Stripe) and Shopify keep under their own terms.
• Content that you published on social networks stays there. Delete it on the network if you no longer want it.

12.6 On request, we confirm the deletion to you in writing.

13. Information and audits (GDPR Art. 28(3)(h))

13.1 We make available the information you need to check that we meet our obligations under GDPR Article 28: this DPA with its annexes, the Security page, the Sub-processors page, and written answers to reasonable security questionnaires, one a year free of charge.

13.2 We do not hold third-party security certifications or audit reports at present.

13.3 If this information is not enough to show compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data yourself or through an independent auditor who is bound by confidentiality. Audits are carried out:

• after at least 30 days' written notice;
• at most once every 12 months, unless there has been a personal data breach or a supervisory authority asks for it;
• remotely where possible, during business hours, without disrupting the service and without access to other customers' data;
• at your cost.

13.4 Where our sub-processors provide certifications or audit reports, we pass on what we are allowed to share.

14. Platform terms

14.1 The developer terms of the social networks bind whoever owns the app that connects to the network. Today the permission screen of each network shows the app of our social gateway, Zernio.

14.2 Where a network's terms require it, we process data received from that network only to provide SemPost to you, keep it no longer than those terms allow, delete it when you disconnect the account or the network asks us to, and do not use it to train AI models.

14.3 In particular:

• LinkedIn: data received from LinkedIn is deleted at once when the account is disconnected or you ask us to delete it.
• YouTube: data received through YouTube API Services is deleted within 7 days after you disconnect the channel in SemPost or ask us to delete it . The analytics we store from it are never older than 30 days: if you revoke access in your Google account, they can no longer be refreshed and are deleted within 30 days .
• Google Business Profile: the analytics we store are likewise never older than 30 days .
• Other networks: the name, picture and analytics of an account you disconnect are deleted within 7 days .

15. US state privacy laws

15.1 Where a US state privacy law applies to Customer Personal Data, we act as your service provider or processor under that law. We do not sell or share Customer Personal Data, and we do not keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing SemPost to you, except as that law allows. We tell you if we can no longer meet these obligations.

16. Liability, duration, order of precedence and law

16.1 Liability. Each party's liability under this DPA is subject to the limits in the Terms of Service. These limits do not restrict liability towards data subjects under GDPR Article 82, or liability that the SCCs or the KVKK Standard Contracts do not allow to be limited.

16.2 Duration. This DPA applies as long as we process Customer Personal Data for you. Sections 12 and 13 continue to apply until the data has been deleted.

16.3 Order of precedence. If documents conflict, this order applies: the SCCs, the UK Addendum and the KVKK Standard Contracts; then this DPA; then the Terms of Service.

16.4 Law and courts. Unless the SCCs or the KVKK Standard Contracts require otherwise, this DPA is governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-law rules, and disputes about it are decided by the courts named in the Terms of Service: for business customers, the state and federal courts located in the State of Wyoming.

16.5 Languages. This DPA is published in English and Turkish. The Terms of Service state which version prevails.

17. Contact

• Data protection questions and objections: [email protected]
• Signed copies, SCCs and KVKK Standard Contracts: [email protected]
• Security reports: [email protected]; see also Security.
• Data protection officer: we have not appointed one. Please write to [email protected].
• Representatives in the EU and the UK: we have not appointed representatives under Article 27 of the GDPR or of the UK GDPR. Please write to [email protected] or by post to CS Digital Wonders LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.

Annex I: Details of the processing

A. Parties

Data exporter (controller, or processor for another controller):

• Name, address and contact person: the customer and the owners of its workspace, as recorded in SemPost.
• Activities: uses SemPost to create, schedule and publish social media content about its products and to analyse its social media accounts.
• Signature and date: acceptance of the Terms of Service in SemPost; the version and the time of acceptance are recorded .

Data importer (processor):

• Name: CS Digital Wonders LLC, a limited liability company organized under the laws of the State of Wyoming, USA.
• Address: 30 N Gould St Ste N, Sheridan, WY 82801, USA.
• Contact for data protection: [email protected].
• Activities: provides SemPost.
• Signature and date: by providing SemPost under the Terms of Service and this DPA, from the date the customer accepts them; a copy signed by us is available on request (section 1.2).

B. Description of the processing

Categories of data subjects

• People shown, named or described in the content you bring into SemPost or create with it: in product data from your stores, in product pages you import by address, in photos and videos you upload, in post texts, comment-to-DM messages and voiceover texts.
• Holders of the social media accounts you connect, which may be individuals such as creators.
• People whose posts and interactions appear in the analytics of your connected accounts, including posts made outside SemPost (SemPost stores no data about individual followers or commenters).
• People who comment on your posts and receive a message through comment-to-DM, when you turn it on (SemPost stores no data about them; our gateway Zernio keeps the record of who received a message).
• Your team members, where their names appear in your content and its approval history.

Categories of personal data

• Names, user names, display names and profile pictures of social media accounts, and the network's account identifiers.
• Pictures and videos of people, including generated images based on your photos.
• Text that contains personal data: post texts, notes to the AI writer, approval notes, messages, voiceover texts and brand settings.
• Addresses (URLs) of the product pages you import.
• Analytics: metrics per post and per account, short excerpts (up to 280 characters) of posts on your connected accounts, thumbnails and links to posts.
• For a sole trader, the business data in the workspace (such as the brand name) may itself be personal data.

Sensitive data

SemPost is not intended for special categories of personal data or data about children (section 5.3). No specific restrictions or additional safeguards for sensitive data are offered beyond those in Annex II.

Frequency of the transfer

Continuous, for as long as you use SemPost.

Nature of the processing

Collection through the store and social network connections and through your uploads; storage and organisation; adaptation (resizing, cropping, re-encoding, editing and generation with AI models); transmission to AI providers and, through our gateway, to the social networks you choose; analysis; export and erasure.

Purposes

• Reading products from your stores and from the product pages you enter, to prepare posts.
• Creating texts, images, videos, voiceovers and ambient sound for your posts with AI providers, and adding music from our own library or from a network's music library.
• Keeping your media library.
• Approval, calendar, scheduling and publishing through our social gateway; comment-to-DM if you turn it on.
• Analytics for your connected accounts.
• Automation rules that create posts within the safeguards you set.
• Collaboration in your team.
• Support that you ask for.
• Security, backup and recovery of the service.
• Export and deletion on your request.

Duration and retention

For as long as you use SemPost, and after that until the data is deleted as described in section 12. Within that time:

Transfers to sub-processors

As listed in Annex III: each sub-processor processes Customer Personal Data only for the part of SemPost described there, and only as long as needed for it.

C. Competent supervisory authority

The supervisory authority of the EU or EEA country where you are established; if you are not established in the EEA but the GDPR applies to you, the authority of the country where your EU representative is established. For the UK, the Information Commissioner. For Turkey, the Personal Data Protection Board.

Annex II: Technical and organisational measures

1. Encryption and pseudonymisation

• Encryption in transit: TLS between users and Cloudflare, and between Cloudflare and our servers (TLS 1.2 and 1.3, Cloudflare origin certificate).
• Encryption of individual fields in the database (Fernet, with key rotation): two-factor secrets and every stored secret and token, such as store credentials, Shopify tokens, the keys for our social gateway, the API keys of our providers and webhook secrets.
• Passwords are stored as Argon2id hashes. Session, email-link and invitation tokens are stored only as SHA-256 hashes. Recovery codes are stored as HMAC values.
• Backups are encrypted on our server before they are uploaded (AES-256-CBC).
• Cloudflare R2 encrypts the files it stores.
• Records kept after a deletion name the workspace only by an internal identifier. The breached-password check sends only the first 5 characters of the SHA-1 hash of a password, never the password.

2. Access control and separation of customers

• PostgreSQL row-level security, enabled and forced, on every table that holds workspace data. The database role of the application cannot read identity or platform tables.
• An automated test checks that every route of the application requires the right authorisation.
• Roles inside a workspace: viewer, editor, admin and owner.
• The admin console runs on a separate address behind Cloudflare Access, which our servers verify again. It requires two-factor authentication at every sign-in and a fresh code (at most 15 minutes old) for sensitive actions. Sessions end after 30 minutes of inactivity and after 12 hours at most. Support staff can read but not change sensitive settings.
• We do not hold the access tokens of your social networks: our gateway Zernio holds them. We keep only a key limited to your workspace's profile, encrypted.
• Card numbers never reach us: Link (Stripe) collects payment details on its own pages.
• Media files are kept in a private storage bucket and are only reachable through short-lived signed links: 5 minutes in the app, 1 hour for AI providers, 24 hours for the backup publishing path.
• The Shopify app authenticates every request with Shopify's ID token and sets no cookies. The Shopify app secret is only sent to the store's own myshopify.com address.

3. Sign-in security

• Password policy and a check against known breached passwords; email verification before the first sign-in.
• Lock after 10 failed sign-ins (15 minutes, doubling each time); Cloudflare Turnstile after 3 failures and on the sign-up, password reset and invitation forms.
• Optional two-factor authentication (TOTP) with 10 recovery codes and replay protection; a workspace can require it for all members.
• Server-side sessions: 7 days of inactivity, 30 days at most. Users can see their sessions and end them. Changing or resetting the password ends the other sessions.
• Session cookies are HttpOnly, Secure and SameSite=Lax, with the __Host- prefix.

4. Integrity and protection of requests

• Protection against cross-site request forgery (origin checks and a signed double-submit value).
• Rate limits on sign-in and account actions, invitations, billing, uploads, AI generation and other costly requests.
• Reading product pages only over HTTPS and only from public addresses (protection against server-side request forgery).
• Signatures checked on all incoming webhooks (Stripe, Shopify and others).
• The audit log, the credit ledger and publishing events can only be added to, not changed (database triggers).
• Uploaded images are re-encoded and their metadata removed; videos are converted in an isolated process; there are size and daily limits.
• Uploaded files are scanned for malware before anything opens them; a flagged file is refused and never stored .
• AI-generated images and videos carry C2PA content credentials.

5. Network and system hardening

• Our servers accept web traffic only from Cloudflare's network and check a secret header from Cloudflare; requests for unknown host names are rejected.
• The database and the cache accept connections only from the server itself; the cache requires a password.
• Every service runs in a restricted systemd sandbox.
• Security headers that limit framing, content type sniffing, referrers and browser features. HTTP Strict Transport Security. A Content Security Policy, enforced on our websites and sent with nonces in report-only mode by the app, the admin console and the Shopify app .
• Cloudflare's protection against denial-of-service attacks in front of our servers .

6. Availability and recovery

• Database backups to Cloudflare R2 with pgBackRest: a full backup every Sunday, a differential backup every day, and the write-ahead log at least every 5 minutes. Four full backups are kept, which allows point-in-time recovery for about 4 weeks.
• An hourly check of the backups and a health check, with email alerts on failure.
• Media files in R2 and the cache are not part of these backups.
• A monthly automatic test that restores the latest backup to a separate copy and compares it with the live database .
• Incidents that affect the service are announced by email to the affected workspaces .

7. Logging

• Application logs are structured. Email addresses, tokens and passwords are masked, and only listed fields are written. For slow or failed requests only the path, the method and the status are logged. Query values are hidden in database errors.
• Web server access logs do not contain query strings.
• Database logs record statements that take longer than half a second; such an entry can contain the values used in the statement .
• Server logs are rotated, and old entries are deleted automatically .
• The audit log records about 110 kinds of actions with time, IP address and browser. Workspace admins see shortened IP addresses . Entries are kept for 2 years; IP addresses and browser details are blanked after 1 year .

8. Data minimisation and retention

• The retention periods in Annex I are applied when you delete data or the workspace, and by nightly jobs: for example, generated files not saved to the library are removed 30 days after their last use, and unfinished uploads after 1 day .
• A register lists the database fields that hold personal data, and an automated test stops a new one from being added without a decision on how it is deleted .
• SemPost stores no data about individual followers or commenters, and none about comment-to-DM recipients. Link tracking in comment-to-DM messages is off.
• For product pages read by address, the site is recorded only as a hash of its host name.
• The application contains no analytics, tag manager or error-tracking software.

9. Secure development

• Automated tests, including the authorisation test above.
• Security reviews of changes to billing and to the Shopify app before release.
• Scanning for secrets in the build pipeline. The build server only runs the deployment job.
• Dependency scanning and an internal review against selected items of OWASP ASVS Level 2 .

10. Physical security

• Our servers are in data centres of Contabo in the USA, and our files are stored with Cloudflare. Physical security is provided by these providers.

11. Sub-processors

• Contracts with data protection obligations (section 8). Provider API keys are stored encrypted in our database, not in configuration files. When an AI provider fetches a file from our storage, it gets a link that expires after 1 hour; other pictures are sent inside the request.

12. Incidents

• Handling and notification of incidents as in section 11 and on the Security page.

Annex III: Sub-processors

The list of sub-processors is published at Sub-processors and forms this Annex III. That page is the authoritative version. At the date of this version, it lists: Contabo (hosting), Cloudflare (network protection, access control, bot protection and file storage), Zernio (social media gateway), Anthropic (text AI), Google (Gemini API for images and speech), fal.ai (video, sound and image AI models), Resend (email) and Have I Been Pwned (breached-password check, which receives no personal data). Stability AI is used only for our own music library and receives no customer data. Link (Stripe) and Shopify are independent controllers and are listed separately.

Changes