Data Processing Agreement
How ONE SOLUTION SRL ("HivePost") processes personal data on behalf of business customers.
The full agreement
The Data Processing Agreement is part of the Terms of Service for every customer who uses HivePost for a business, and applies automatically. To get the full text, or a copy signed for your company, write to privacy@hivepost.app with your company name and the email of your HivePost account.
Roles
- You (the customer) are the controller of the personal data you put into HivePost about other people: your team members, people who comment on or message your accounts (Inbox), people who answer your link-in-bio form, and people shown or named in your posts.
- HivePost is your processor for that data.
- HivePost is a separate controller for your own account, billing and security data, as described in the Privacy Policy.
What we process for you
| Subject matter | Providing HivePost: planning, publishing, analytics, Inbox, link in bio, team and approvals, AI features, API |
|---|---|
| Duration | While your account is open, then until deletion as described below |
| Categories of people | Your team members and reviewers; people who interact with your social accounts; your link-in-bio visitors who answer your form; people in your content |
| Types of data | Names, handles, profile pictures, emails and phone numbers given in forms, comments and messages, content of posts and media, IDs from the networks, usage and statistics |
| Special categories | Not intended. Don't put them in HivePost unless you need to |
What we promise
- We process the data only on your documented instructions: these terms, your settings and your actions in HivePost. We tell you if we think an instruction breaks the law.
- Everyone at HivePost who can reach the data is bound to confidentiality.
- We keep appropriate security measures (below).
- We use subprocessors only from our published list, each under a contract with the same data protection duties. We tell you at least 30 days before adding or replacing one, and you can object; if we can't solve the objection, you can end the contract and get a refund of prepaid fees for the unused period. We stay responsible for our subprocessors.
- Transfers outside the EU are covered by an adequacy decision (EU-US Data Privacy Framework) or the Standard Contractual Clauses (Decision 2021/914).
- We help you answer requests from people (access, deletion, export) with the tools in HivePost and on request.
- We help you with security, breach notifications and impact assessments, as far as our role allows.
- We tell you without undue delay after we learn of a personal data breach affecting your data, with what we know and what we are doing.
- When your account ends, we delete your data within 30 days and from backups within a further 30 days, unless the law requires us to keep it. You can export it before.
- We give you the information needed to show compliance. You can audit us once a year with 30 days' notice, at your cost, normally by reviewing our documents and our subprocessors' certifications.
Security measures (summary)
- Data stored in the EU (Supabase, Frankfurt); encrypted in transit (TLS) and at rest.
- Network access tokens encrypted again with AES-GCM and our own key; never sent to browsers.
- API keys, invite links, reviewer links, connect links and OAuth tokens stored only as keyed hashes.
- Row-level security on every database table: a workspace can reach only its own data; brand-limited members see only their brands.
- Sessions in httpOnly, Secure cookies; all permission checks on our servers.
- Two-factor sign-in on every plan, required for live API keys and in workspaces that turn it on; leaked passwords refused.
- Rate limits on sign-in, sign-up, AI and the public API.
- Error reports scrubbed of emails, IP addresses, tokens and request contents; no session replay.
- Nightly backups kept 14 days, with a tested restore.
- Monitoring and alerts for failed publishing and outages.
Contact
privacy@hivepost.app. ONE SOLUTION SRL, Str. Traian Vuia nr. 7, Deva, Hunedoara county, Romania.