Data processing addendum

This DPA forms part of the Terms of Service between you and Creator Atlas. It applies when we process personal data on your behalf.

Subject matter

We process publicly accessible Instagram creator metadata (and any email addresses creators have placed in their public bio or business contact card) at your direction. You are the data controller; we are a data processor acting on your documented instructions.

Subprocessors

• Stripe — payment processing
• Coinbase (x402 facilitator) — USDC settlement for agent pay-per-call
• Neon — application database
• Amazon Web Services (S3, us-east-1) — encrypted storage of search outputs
• Vercel — application hosting
• Resend — transactional email (contact form)

Data security

Data at rest is encrypted with AES-256 (SSE-S3 for S3 objects; Neon's encrypted volumes for Postgres). Data in transit uses TLS 1.2+. Access to production data is limited to operations engineers under role-based controls and logged in our audit trail.

Contact

For DPA requests, open a DPA ticket.