Data Processing Agreement
Version 3 · effective 19 October 2026
1. Parties and roles
This Agreement is between:
- The Brand: the business that uses Salty and accepts this Agreement (the "Controller"), and
- Amaracus Limited, a private limited company registered in England and Wales under company number 16415324, with its registered office at Flat 5, 72 Balcombe Street, London NW1 6NE, United Kingdom, operator of Salty ("Salty", the "Processor").
It forms part of the agreement under which the Brand uses Salty, Salty's Terms of Service, or a written pilot agreement where one is signed (the "Main Agreement").
The Brand decides why and how its customers' personal data is processed. Salty processes that data only to run the service for the Brand. Terms such as personal data, processing, data subject and personal data breach have the meaning given in Regulation (EU) 2016/679 (the "GDPR").
2. Subject matter, purpose and duration
Salty replies to Instagram comments and direct messages on the Brand's behalf, only after the person has written to the Brand first. It recommends products from the Brand's catalogue, can issue single-use discount codes within limits the Brand sets, and matches orders to the conversations and posts that led to them. If the Brand connects a Shopify store, Salty also shows the store's customers in the Brand's dashboard.
Processing lasts for the term of the Main Agreement, plus the deletion period in clause 3.8. Annex I describes the data subjects, data, purposes and retention.
3. Salty's obligations
- Instructions. Salty processes personal data only on the Brand's documented instructions: this Agreement, the Main Agreement, and the settings the Brand chooses in the Salty dashboard. Salty tells the Brand at once if it believes an instruction breaks data protection law.
- Confidentiality. Everyone at Salty with access to the data is bound by a duty of confidentiality.
- Security. Salty applies the technical and organisational measures in Annex II.
- No other use. Salty does not sell the data, use it for advertising, use it to train AI models, or use one brand's data for another. Salty never messages anyone who has not written to the Brand first, and never researches people's profiles.
- Data subject requests. Salty passes on any request it receives directly, and helps the Brand answer requests for access, correction or deletion within 10 business days of the Brand asking.
- Assistance. Salty gives the Brand the information it reasonably needs for security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32–36).
- Records and audits. Salty keeps a record of processing and provides the information needed to show it complies with this Agreement. The Brand may audit once a year on 30 days' notice, at its own cost, starting with written questions.
- End of service. Within 30 days after the Main Agreement ends, or sooner on the Brand's written request, Salty deletes the personal data it processes for the Brand, unless EU or member state law requires it to be kept. On request before deletion, Salty gives the Brand an export of that data in JSON, a common machine-readable format. Deletion does not rewrite backups: the data leaves them as they expire, as Annex II describes.
4. Sub-processors and transfers
The Brand gives general authorisation for the sub-processors in Annex III. Salty gives 30 days' written notice before adding or replacing one. The Brand may object on reasonable data protection grounds; if no solution is found, it may end the affected part of the service. Salty binds each sub-processor to obligations at least as protective as this Agreement and remains liable for them.
The Brand's data is stored in the EU (Frankfurt, Germany). Where a sub-processor processes it outside the EEA, the transfer relies on the EU Standard Contractual Clauses (Commission Decision 2021/914), and on the EU–US Data Privacy Framework where the sub-processor is certified under it. Salty's own access from the United Kingdom relies on the European Commission's adequacy decision for the United Kingdom.
Platforms the Brand uses directly are not Salty's sub-processors: Meta (Instagram), Shopify, Klaviyo and the Brand's own Slack. The Brand has its own agreements with them.
5. Personal data breaches
Salty notifies the Brand without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Brand's data. The notice states what happened; the categories and approximate number of people and records; the likely consequences; the measures taken or proposed; and a contact person. Salty adds information as it becomes known.
Salty does not notify supervisory authorities or data subjects on the Brand's behalf unless the Brand asks it to. Salty can stop all replies for the Brand at once (Dashboard → Mode → Paused) while a breach is contained.
6. Liability, term and law
Each party's liability under this Agreement is subject to the limits in the Main Agreement. This Agreement lasts as long as Salty processes personal data for the Brand. Where it conflicts with the Main Agreement on data protection, this Agreement prevails.
This Agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
The Brand accepts this Agreement online, together with Salty's Terms of Service, and Amaracus Limited is bound by it as soon as it is accepted.
Annex I — Description of processing
Nature of processing: receiving comments and messages through the Instagram API, storing them, generating reply text with an AI model, sending replies, copying replies and items awaiting approval for Salty's quality checks (Annex II), showing records in the Brand's dashboard, and deleting them. Unless stated otherwise, data is kept while the Brand uses Salty and deleted within 30 days after it stops or asks for erasure.
| Data subjects | Personal data | Purpose | Kept |
|---|---|---|---|
| People who comment on or message the Brand's Instagram account (posts, ads, story replies) | Instagram username and account ID; text of comments and messages, with emails, phone numbers and card numbers removed before storage; the post or ad they wrote on; conversation history | Replying on the Brand's behalf; handing conversations to the Brand's team; measuring results | Standard |
| The same people, if they order through a Salty link or code | Order ID and number, total, currency, discount code, landing page; link clicks | Matching an order to the conversation and post that led to it | Standard |
| The same people, if the Brand's team adds details | Name, email, phone and notes typed by the Brand's team on a contact card | The Brand's own follow-up | Standard; erased with the conversation |
| The same people, if the Brand turned on contact collection and they agree in the conversation | Email or phone number they chose to give, with the wording they agreed to | Adding the email to the Brand's own Klaviyo list; saving the number for the Brand's team; matching the conversation to an existing store customer | Held separately for at most 24 hours until confirmed, then standard; never sent to the AI model |
| The same people, if the Brand turned on learning from its team's replies | Their latest message before a reply written by the Brand's team, and that reply, as text, with emails, phone numbers and card numbers removed; where the reply was written (Instagram or Salty's inbox) and when. A one-way fingerprint of each message Salty sends for the Brand, with the recipient's ID and the message ID | Proposing changes to the Brand's voice profile and knowledge, which the Brand reviews and publishes itself; telling the Brand's own replies from Salty's | At most 90 days and the Brand's latest 200 replies; deleted at once when the Brand turns it off, on erasure and at end of service. Fingerprints: one day |
| The Brand's store customers, if the Brand connects Shopify | First and last name, email, phone, number of orders, amount spent, email marketing consent. Never an address | Showing the Brand its customers next to their Instagram conversations. Never sent to an AI model; never used to send messages | Kept in step with the store: a customer is deleted when the store deletes them or Shopify asks on their behalf, and the whole list when the Brand disconnects or uninstalls the store, when Shopify asks on the store's behalf, and at end of service. Erasing a person removes the link between their conversations and the store's record of them; the record itself is the store's, and goes when the store deletes it. Each view is logged; logs kept 365 days |
| The Brand's team members | Name, email, role, sign-in and change records | Access control and audit | For the term of the Main Agreement |
Special categories of data: Salty does not ask for them. People may volunteer them in their own messages (for example a question about pregnancy); they are then processed only as part of that conversation.
Annex II — Technical and organisational measures
These summarise Salty's internal policies (Data protection, Access control, Incident response).
| Area | Measure |
|---|---|
| Data minimisation | Emails, phone numbers and card numbers are removed from messages when they arrive, before storage or the AI model. Shopify is asked only for the fields a feature uses. Never an address, date of birth, payment data or government ID |
| AI model | The model receives message text needed to write a reply. Store customer names, emails and phones never reach it; it sees at most "returning customer, N orders" (checked by a test that fails if a field reaches a prompt) |
| Encryption in transit | TLS on every external connection. Session cookies are Secure, HttpOnly and SameSite=Lax |
| Encryption at rest | Shopify and Klaviyo credentials encrypted in the application (Fernet, with key rotation). Store customer name, email and phone encrypted the same way. The application and database disks are encrypted (Fly.io volumes) |
| Backups | Daily snapshots of the database volume on Fly.io, encrypted and kept 5 days. Once Salty switches them on, also daily backups of the database, encrypted before they leave Salty's systems with a key Salty holds offline, stored with Tigris Data in Frankfurt (EU) and kept 30 days. Application-encrypted fields stay unreadable in every backup. Deletion does not rewrite a backup: deleted data leaves the backups as they expire, and is deleted again before a restored backup is used |
| Separation of brands | Every query is scoped to one brand. No brand sees another brand's data, even about the same person |
| Test and production | Tests and demos run on made-up data, never on production records |
| Staff access | Only the founder can reach production systems. Accounts are personal, never shared. Two-factor sign-in on every production system. Development tools, including AI coding assistants, never read production customer records |
| Passwords and sessions | Passwords 12–128 characters, stored only as salted PBKDF2-SHA256 hashes (240,000 rounds). Sessions expire after 14 days |
| Access log | Each view of a store customer's details is logged (who, when, which record), kept 365 days and reviewed quarterly |
| Human control | The Brand can require approval of every reply and discount before it is sent, or pause all replies at once. Suggestions drawn from the Brand's edits or its team's replies are proposals only: nothing reaches the assistant until the Brand adds it to a draft and publishes it |
| Quality checks | A copy of each reply sent through Salty, whether the AI model or the Brand's team wrote it, and of each item awaiting the Brand's approval goes to Salty's internal Slack, where staff check it, and to the application log at Fly.io. It names the person by Instagram account ID or comment ID and, for an item awaiting approval, by Instagram username. Customers' text in it was redacted when it arrived; replies the Brand's team writes are copied as typed. Only Salty's staff can read it. Copies in Slack are deleted automatically after 90 days; Fly.io keeps the application log for 7 days. The Brand can ask to turn this off: no copy then reaches Slack, and the log keeps only the kind of event and the Brand's ID |
| Incidents | Written response plan: severity levels, containment steps, and notice to the Brand as in clause 5 |
| Reviews | Quarterly review of accounts, team members, the access log and keys |
Annex III — Sub-processors
The list matches "Who else processes it" in Salty's privacy policy.
| Sub-processor | What it does | Data it receives | Location |
|---|---|---|---|
| Anthropic PBC | AI model that drafts replies, drafts knowledge facts from pages or policies the Brand imports, and proposes voice and knowledge suggestions from the Brand's review edits and, if the Brand turns it on, its team's replies | Message text, already redacted; product and policy text. Not used to train its models | United States |
| Fly.io, Inc. | Hosting of the application and database, and its daily snapshots | All data in Annex I, and the application log, kept 7 days, which carries the same copies as Salty's Slack (Annex II, Quality checks) | Frankfurt, Germany (EU) |
| Tigris Data, Inc. | Storage of Salty's encrypted daily database backups, through Fly.io's object storage, once Salty switches them on | All data in Annex I, encrypted before it is sent; Tigris cannot read it | Frankfurt, Germany (EU) |
| Slack Technologies | Salty's internal workspace for checking replies and items awaiting the Brand's approval, and for alerts about faults | The text of each reply sent through Salty, including replies the Brand's team writes or edits in Salty, copied as typed; the recipient's Instagram account ID, or the ID of the comment it answered. For each item awaiting the Brand's approval: the person's Instagram username and the reply waiting to be sent, the text of a comment flagged to be hidden, or the words the person agreed to an email signup with; the last two are redacted. Fault alerts: conversation and comment IDs. The Brand's ID in Salty throughout. Deleted automatically after 90 days | United States |
| LangChain, Inc. (LangSmith) | Operational traces of each reply run, used to find errors and measure cost | Timings, tool names, errors and token counts. No message text, usernames or IDs | European Union (LangSmith EU region) |
The email provider for daily summaries is added here before that feature is turned on.