Data Processing Addendum

Last updated 28 October 2026

This Data Processing Addendum ("Addendum") forms part of the Terms and conditions between Phantom Dialogue AI Pty Ltd (ABN 94 670 034 607) ("we", "us") and the customer that uses AI-gagement (the "service") for an Organization ("you"). It applies whenever we process personal data on your behalf in providing the service, and you accept it by accepting the Terms.

If this Addendum and the Terms conflict about personal data, this Addendum wins. If this Addendum and the Standard Contractual Clauses in section 10 conflict, the Clauses win.

1. Definitions

• Data protection law means the laws that apply to the processing: the Privacy Act 1988 (Cth) and the Australian Privacy Principles; the EU General Data Protection Regulation ("GDPR"); the GDPR as it forms part of UK law, and the UK Data Protection Act 2018 ("UK GDPR"); and any other privacy law that applies.
• Customer personal data means personal data in the content of your Organization's workspace that we process on your behalf. Annex 1 describes it.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings the GDPR gives them.
• Sub-processor means another processor we engage to process customer personal data.
• Security incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, customer personal data.
• Organization, User and connected account have the meanings they have in the Terms and the Privacy Policy.

2. Roles

For customer personal data, you are the controller and we are your processor. You decide which social media accounts to connect, which messages to read and answer, which members to invite, and whether to use the service's AI features and automation rules.

This Addendum does not cover personal data we handle as a controller ourselves: Users' own account details, the website, the waitlist, and messages people send to us. Our Privacy Policy covers those.

3. Your instructions

We process customer personal data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing, unless the law forbids it.

Your instructions are the Terms, this Addendum, and what you and your Organization's members do in the service: connecting accounts, writing and approving posts and replies, and setting up the voice description, rules and reports. We will tell you if we think an instruction breaks data protection law.

You are responsible for having a lawful basis for the processing you instruct, and for giving the people concerned any notice the law requires. That includes the people who comment on, mention or message your connected accounts.

4. Confidentiality

Everyone we authorise to process customer personal data is bound by a duty of confidentiality, by contract or by law, and has access only as far as their work requires.

5. Security

We maintain the technical and organisational measures in Annex 2, which are designed to protect customer personal data against security incidents, taking into account the state of the art, the cost, and the risks to the people concerned. We may change them over time, but we will not reduce the overall protection they give.

6. Sub-processors

You authorise us to engage the sub-processors listed in Annex 3.

We will give you at least 30 days' notice before we add or replace a sub-processor, by email to your Organization's owners or in the service, and by updating Annex 3. You may object on reasonable data protection grounds within that time. If we cannot resolve the objection, you may stop using the service, and we will delete your Organization's data as section 9 describes.

We will impose data protection obligations on each sub-processor that give at least the protection of this Addendum, and we remain responsible to you for its performance.

Social media platforms are not our sub-processors. When you connect an account, the platform (X, or Meta for Facebook and Instagram) receives what you instruct us to send, and returns what it holds about the account and the messages it receives, under your own agreement with that platform.

7. Helping you

Taking into account the nature of the processing, we will help you:

• answer requests from data subjects to exercise their rights. If we receive one directly about customer personal data, we will pass it to you without undue delay and will not answer it ourselves unless you tell us to. Much of this you can do in the service yourself: hide or reply to a comment, or disconnect an account. For anything else, write to [email protected].
• meet your obligations on security, security incidents, data protection impact assessments, and consultations with a supervisory authority.

8. Security incidents

If we become aware of a security incident affecting customer personal data, we will notify your Organization's owners without undue delay, and in any case within 48 hours.

The notice will describe, as far as we know them at the time:

• what happened;
• the categories and approximate number of people and records concerned;
• the likely consequences;
• what we have done and propose to do; and
• who you can contact.

We will add further information as we learn it, and take reasonable steps to contain the incident and reduce its effects. Notifying you is not an admission of fault.

9. Deletion at the end

Customer personal data is deleted on the schedule in Annex 1 while the service runs.

When your use of the service ends, or when you ask us to delete your Organization, we will delete the customer personal data we hold for it within 30 days. That includes its connected accounts and their access tokens, its messages, posts and voice descriptions. Copies in backups are overwritten within the backup period in Annex 1.

We may keep customer personal data only where the law requires it, and then only for as long as it requires. The activity records in Annex 1 are an exception: they record who did what in your Organization, and we keep them as described there. Until deletion, this Addendum continues to apply to anything we keep.

Before your use ends, you can ask us for a copy of your Organization's content, and we will provide it in a commonly used format.

10. International transfers

We store customer personal data in Australia (Amazon Web Services, Sydney). Some sub-processors process it in the United States (Annex 3).

• From the EEA. To the extent you transfer customer personal data to us from the European Economic Area, or the GDPR applies to the transfer, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 ("the Clauses") are incorporated into this Addendum by reference. Module Two (controller to processor) applies, with you as data exporter and us as data importer, completed as follows:
  • Clause 7 (docking clause) does not apply.
  • Clause 9: option 2, general written authorisation, with the notice period in section 6.
  • Clause 11: the optional language does not apply.
  • Clauses 17 and 18: the law and the courts of Ireland.
  • Annexes I to III: Annexes 1 to 3 of this Addendum. The competent supervisory authority is the one that is competent for you under Clause 13.
• From the United Kingdom. The International Data Transfer Addendum to the Clauses, issued by the UK Information Commissioner, version B1.0, is incorporated by reference. Its Tables 1 to 3 are completed with the information in this Addendum, and either party may end it as its section 19 allows.
• Onward. We transfer customer personal data to sub-processors outside Australia, the EEA or the UK only under an appropriate safeguard, such as the Clauses (Module Three, processor to processor). For Australian law, we take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

11. Information and audits

We will make available to you the information reasonably necessary to show that we meet this Addendum.

You, or an independent auditor you appoint who is bound by confidentiality, may audit our compliance once in any 12 months, with at least 30 days' written notice. You may also audit sooner after a security incident, or when a supervisory authority requires it. An audit takes place during business hours, in a way that does not disrupt the service or expose other customers' data, and at your cost. We will first try to answer your questions with documents and written answers.

12. Liability and term

Each party's liability under this Addendum is subject to the limits in the Terms, except where data protection law does not allow those limits. This Addendum lasts as long as we process customer personal data for you.

Annex 1: Details of processing

Retention while the service runs

Annex 2: Security measures

Encryption

• All traffic to the service is encrypted in transit with TLS 1.2 or 1.3. Plain HTTP is redirected. Connections to the database require TLS.
• The database, file storage and server volumes are encrypted at rest.
• Platform access tokens and two-step sign-in secrets are encrypted again inside the database, with AES-256-GCM, under keys held in AWS Secrets Manager.
• Passwords are hashed with bcrypt. Recovery codes, and the tokens in links we email, are stored only as SHA-256 hashes.

Access and separation

• Each Organization's data is separated from every other's by row-level security in the database, in addition to the application's own checks.
• Inside an Organization, what a member can do depends on their role, and the service checks it again on every request. Revoking a membership or changing a role takes effect on the member's next request.
• Authors and managers cannot approve their own posts.
• Sessions are short-lived (24 hours), carried in an HttpOnly cookie, and can be revoked individually. Changing or resetting a password ends all of a User's sessions.
• Users can protect their accounts with two-step sign-in (TOTP).
• State-changing requests are checked for cross-site request forgery.
• Access to production systems is limited to named personnel, through AWS identity controls and a bastion reached through AWS Systems Manager. The database is not reachable from the internet.

Resilience and monitoring

• The production database runs in more than one availability zone, with deletion protection, daily automated backups, and a final snapshot if it is ever deleted.
• A web application firewall rate-limits requests in front of the service.
• Server logs redact secrets such as passwords, tokens and keys, and are kept for 14 days.
• Security-relevant actions are written to an append-only activity record that the application cannot alter.

AI processing

• Only what each task needs is sent to an AI provider (Privacy Policy, section 4). Sentiment classification anonymises the authors of earlier messages in a conversation.
• No customer personal data is used to train AI models.
• The Co-pilot's drafts are labelled as its own, and a draft is sent only after a member approves it, or under an automation rule you switched on.

Annex 3: Sub-processors