01
Roles
For the personal data in what you publish and in the accounts you connect (including your clients’ accounts and content), you are the controller and Anjum Labs is your processor. For your own account, billing and our security logs, Anjum Labs is a controller, as the Privacy Policy explains.
What is processed: captions, videos, photos and documents you send; the names, handles, pictures and access tokens of connected social accounts; post results and statistics; and the email addresses of your team and of clients who use approval or connect links. It can include anyone who appears in your content.
Why and for how long: to publish, schedule, report and support your use of Reelspan, for as long as your account exists, and then as set out under Deletion below.
02
Our commitments
- We process the data only on your documented instructions: the Terms, your settings and your use of the dashboard and API. If we believe an instruction breaks data protection law, we tell you.
- Everyone with access is bound to confidentiality, and access is limited to what their work needs.
- We help you answer requests from people exercising their rights (access, correction, deletion, export), mainly through the dashboard’s delete and export tools, and with data protection impact assessments where you need our information.
- We give you the information needed to show compliance with this addendum and answer reasonable questions by email. Audits beyond that are by agreement, at your cost, with reasonable notice.
03
Security
- Connected-account tokens are encrypted at rest with AES-256-GCM; API keys are stored only as SHA-256 hashes.
- All traffic uses TLS; the server accepts web traffic only through Cloudflare.
- Sign-in without passwords (Google or one-time email codes), new-device alerts, session control and an audit log of account actions.
- Scoped, expiring API keys; signed webhooks; rate limits and abuse blocking.
- Uploaded media is deleted a set time after it is published unless you keep it in the media library; error reporting and uptime monitoring watch the service.
04
Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We bind each one to data protection terms at least as protective as these, and stay responsible for them. We update that page at least 14 days before adding or replacing one; if you object on reasonable data protection grounds and we can’t resolve it, you may end the affected service and we refund any prepaid fees for the time left.
05
Personal data breaches
If a breach affects your data, we tell you without undue delay, and within 72 hours of becoming aware of it, with what we know: what happened, the data and people concerned, likely consequences and what we are doing about it. We add details as we learn them.
06
International transfers
Data is stored on our server in the EU. Anjum Labs operates from Pakistan, and some subprocessors are in the United States. Where data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (and the UK Addendum) apply between you and us, and between us and those subprocessors, or the EU–US Data Privacy Framework where a subprocessor is certified.
07
Deletion
You can delete posts, media, connected accounts or the whole account at any time from the dashboard. When your account is deleted, its data and media are deleted from our database and storage at once, and from backups as they expire, except what the law makes us keep (such as invoices, which Lemon Squeezy holds as merchant of record). You can export your data before deleting.
08
Order and contact
If this addendum and the Terms disagree about personal data, this addendum wins. It is governed by the same law as the Terms (the laws of Pakistan), except that the Standard Contractual Clauses, where they apply, are governed by the law of Ireland, as they require. Questions, or a countersigned copy for your records: [email protected].