Data Processing Addendum

Status: Needed by agency customers whose clients' data (accounts, content) flows through A1 Lane. This document is final as of its effective date.

1. Parties and roles

This addendum forms part of the Terms of Service between A1Lane LLC ("Processor") and the customer who owns a workspace ("Controller"). For the social media content, account identities and credentials the Controller connects or uploads, the Controller determines purposes and means; A1 Lane processes on the Controller's documented instructions as expressed through the product (schedule, publish, read back, export, delete).

2. Subject matter and duration

Processing of the data described in the Privacy Policy section 2 for the purpose of publishing and verifying social media posts, for the life of the workspace plus the 30-day retention period.

3. Instructions

The Controller's instructions are the actions taken in the product, API, CLI or through an authorised assistant. A1 Lane will not publish, modify or delete content other than as instructed, except to comply with law (in which case it will inform the Controller unless prohibited).

4. Confidentiality and security

A1 Lane applies the measures on https://a1lane.ai/security: credentials encrypted at rest with a separately held key; password and token hashes only; per-workspace databases, media directories and event logs; signed webhooks; sanitised error handling; least-privilege roles and scoped tokens. Production systems are administered by one named individual, the operator's principal; A1Lane has no employees or contractors with production access. Routine operations (deploys, backups, monitoring) run through automation under the principal's control; that automation does not read customer content or credentials. The product provides no operator backdoor into workspace content: operator tooling reaches only aggregate counts, never a workspace's posts, receipts or connected accounts. Connected-account credentials are encrypted at rest with a separately held key and are never decrypted for support. Support is handled from material the customer shares (review links, receipts, support bundles); should A1Lane add personnel, they will be bound by written confidentiality terms before receiving access, and this addendum will be updated.

5. Sub-processors

Stripe (billing), Amazon Web Services (AWS Lightsail), US West (Oregon), Resend, and the social media platforms the Controller connects (as independent recipients, not sub-processors). The Controller's own link shortener and AI assistant providers act under the Controller's own agreements. A1 Lane will notify Controllers of sub-processor changes at least 30 days in advance by email. If the Controller objects to a new sub-processor, it may terminate the affected workspace without penalty before the change takes effect.

6. Assistance and rights requests

A1 Lane provides self-serve export and deletion in the product and will assist with other data-subject requests within 10 business days of a request to [email protected].

7. Breach notification

A1 Lane will notify the Controller without undue delay, and in any case within 72 hours of becoming aware, of a personal-data breach affecting the Controller's workspace, with the information needed for the Controller's own notifications.

8. Deletion and return

On termination the Controller may export its data for 30 days; afterwards the data is deleted per the Privacy Policy section 5. (Deletion after the retention period is operator-confirmed — see Privacy Policy section 5.)

9. Audits

A1 Lane will make available the information reasonably necessary to demonstrate compliance (this document, the security page, the billing and operator audit logs relevant to the Controller) and will allow audits by an independent auditor at the Controller's expense with 30 days' notice, no more than once a year. Audit materials are treated as confidential.

10. International transfers

Personal data is hosted in US West (Oregon), United States. The EU Standard Contractual Clauses (Module Two — controller to processor) and the UK Addendum to those clauses are incorporated into this Addendum by reference; their annexes are completed by §2 (description of processing), §4 (technical and organisational measures) and §5 (sub-processors) of this Addendum.

11. Precedence

In case of conflict, this addendum prevails over the Terms of Service for the processing of personal data.