Data Processing Agreement

This Data Processing Agreement (“DPA”) is concluded between the customer who uses Elevion (“Customer”, the controller) and Pelle Krukow, trading as FrostChanger, Ballindamm 3, 20095 Hamburg, Germany (“Elevion”, “we”, the processor).

The DPA is part of our Terms of Service and applies automatically to every Customer workspace from the moment the Customer accepts the Terms. Workspace owners can also accept it explicitly in Settings. We then store who accepted which version and when. If this DPA and the Terms conflict on data protection, this DPA prevails.

1. Subject matter and duration

Elevion processes personal data on behalf of the Customer in order to provide the Service described in the Terms: answering comments and messages on the Customer's connected Instagram accounts, sending DMs and voice notes, running the inbox, collecting leads, and the related analytics, AI and integration features. The DPA runs for as long as we process personal data for the Customer, that is, until the Customer's data has been deleted after the end of the contract (section 12).

2. Nature and purpose of the processing

Collecting, storing, organising, reading, transmitting, transcribing, translating and deleting personal data, solely to provide the Service to the Customer according to the Customer's configuration. We do not process the data for our own purposes, do not sell it, and do not use it to train AI models.

3. Types of personal data and data subjects

Data subjects

• People on Instagram who comment on, reply to a story of, mention, or send a DM to a connected account.
• Leads, that is, people who give the Customer an email address or phone number through a campaign.
• The Customer's team members, to the extent their data is part of the workspace (for example who sent a message, notes and assignments).

Types of personal data

• Instagram-scoped ID, username, profile picture, and whether the person follows the connected account, if a campaign checks this.
• Comment texts, DMs, story replies and mentions, and the replies sent.
• Photos, videos, files and voice messages people send, and text transcripts of voice messages.
• Email address or phone number of leads, together with the consent record (time, wording of the question shown, campaign) when an email address is collected.
• Delivery status of replies and DMs, link taps, opt-outs (STOP), the language of a conversation, giveaway entries, notes and assignments.

The Service is not designed for special categories of personal data (Art. 9 GDPR). The Customer should not ask for such data in campaigns.

4. Instructions

We process the personal data only on documented instructions from the Customer, unless Union or Member State law requires us to do otherwise; in that case we inform the Customer before processing, unless that law prohibits it. The Customer's instructions are set out in the Terms and this DPA and are given through the settings and campaigns in the Service. Further instructions can be given by email to privacy@elevion.cc. If we believe an instruction infringes data protection law, we tell the Customer without delay and may suspend it until it is confirmed or changed.

5. Confidentiality

Everyone who has access to the Customer's personal data at Elevion is committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and accesses the data only as far as needed to provide the Service, handle support requests the Customer makes, or fix faults.

6. Security of processing

We take the technical and organisational measures described in Annex 1 (Art. 32 GDPR). We may develop them further, as long as the level of protection does not fall.

7. Sub-processors

The Customer gives general authorisation for us to engage sub-processors. The sub-processors in Annex 2 are approved. We impose on every sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and we remain responsible to the Customer for their work.

We inform the Customer at least 30 days before we add or replace a sub-processor, by email to the workspace owner and by updating Annex 2. The Customer may object within that period for reasonable reasons relating to data protection. If we cannot resolve the objection, the Customer may terminate the affected subscription with effect from the date the change takes effect, and we refund fees paid in advance for the period after that date.

Not sub-processors under this DPA are: Meta, which operates Instagram and processes the data as its own controller; services the Customer connects itself, such as Kit, Mailchimp, Shopify, webhooks or tools using our API, which act on the Customer's instruction; and the push services of browser vendors, which only transport end-to-end encrypted notifications.

8. Transfers outside the EU

We transfer personal data to a country outside the EU or the EEA only if the requirements of Chapter V GDPR are met, in particular an adequacy decision such as the EU-US Data Privacy Framework for certified recipients, or the Standard Contractual Clauses of the European Commission. Annex 2 shows the mechanism for each sub-processor.

9. Requests from data subjects

The Customer can answer most requests itself in the dashboard: on every plan it can export everything Elevion holds about one contact (messages, lead details, comment replies, link taps, notes) and delete it. A message that only says STOP, STOPP, unsubscribe, abmelden, baja or darme de baja marks the person as opted out, and Elevion sends them nothing automated after that. If a data subject contacts us directly, we pass the request on to the Customer without delay and do not answer it ourselves unless the Customer instructs us to. Beyond that, we help the Customer as far as reasonable to fulfil its obligations under Art. 12 to 22 GDPR.

10. Further assistance

Taking into account the nature of the processing and the information available to us, we help the Customer with its obligations under Art. 32 to 36 GDPR, in particular with security, data protection impact assessments and prior consultation of the supervisory authority, for example by providing the information in this DPA and answering reasonable questions.

11. Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach that affects the Customer's data, by email to the workspace owner. The notice contains, as far as known at the time, the information listed in Art. 33 (3) GDPR, and we provide further information as it becomes available. We take the measures needed to secure the data and to limit possible harm.

12. Deletion and return at the end

Before the end of the contract, the Customer can download its data: the account export under Settings, Account, and the export of single contacts. When the Customer deletes its account, its campaigns stop immediately, and after a 7-day period in which the deletion can be cancelled, we delete all personal data processed for the Customer. Removing an Instagram account from the workspace deletes the data of that account at once. Deleted data disappears from our encrypted backups as they roll over, after 12 months at the latest. This does not apply where Union or Member State law requires us to keep the data.

13. Information and audits

We make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, on request by email. The Customer, or an auditor it appoints who is bound to confidentiality and is not a competitor of Elevion, may carry out audits, including inspections. Audits must be announced at least 30 days in advance, take place during normal business hours without disrupting operations, and are limited to once a year unless there was a personal data breach or a supervisory authority requires it. The Customer bears its own costs and reimburses our reasonable costs for the audit. Where possible, we first answer the questions in writing.

14. The Customer's responsibilities

The Customer is responsible for the lawfulness of the processing it instructs, in particular for having a legal basis for the messages it sends and the data it collects, for informing the people concerned in its own privacy policy, for labelling automated messages where required, and for how it uses lead data in tools it connects. When email addresses are synced to a newsletter tool, we recommend using that tool's double opt-in.

15. Liability

Liability under this DPA is governed by the limitation of liability in our Terms of Service. Art. 82 GDPR remains unaffected.

16. Final provisions

• This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction follows the Terms of Service.
• We may update this DPA where the law, a supervisory authority or a change in the Service requires it. We announce material changes by email at least 30 days in advance; changes to sub-processors follow section 7.
• If a provision of this DPA is invalid, the rest remains in effect.
• This DPA is available in English, in German and in Spanish. All versions have the same content.

Annex 1: Technical and organisational measures

Encryption

• All traffic to the Service uses HTTPS, with HTTP Strict Transport Security. Cloudflare connects to our server over TLS as well.
• Instagram access tokens, the keys of connected integrations, webhook secrets and the API keys of the services we use are stored encrypted with AES-256-GCM. The key is kept outside the database.
• Passwords are stored as Argon2id hashes. API keys and login session tokens are stored only as SHA-256 hashes.
• Off-site backups are encrypted before they leave the server.

Access control

• Every request is checked against the workspace it belongs to, so a workspace can only see its own data.
• Roles inside a workspace (owner, admin, editor). Only owners and admins can, for example, delete contacts or remove Instagram accounts.
• Login session cookies are HttpOnly, Secure, SameSite=Lax and bound to our domain. Users can see and end their sessions.
• The internal admin area is limited to named administrator accounts. Server administration uses SSH keys.
• Rate limits on sign-in, account deletion and other sensitive endpoints.

Integrity and transport

• Notifications from Instagram and payment events from Stripe are only accepted with a valid signature. Webhooks we send to the Customer are signed with HMAC-SHA256.
• Inputs are validated on the server. Webhook addresses must be public HTTPS addresses, so requests can't be redirected into our own network.
• Security headers on all pages, including a Content Security Policy, X-Frame-Options and X-Content-Type-Options.
• A security log records important account actions, such as connecting or removing Instagram accounts, API keys, team invitations and deletion requests.

Availability and recovery

• Hosting in Hetzner data centres in Germany, behind Cloudflare's protection against attacks.
• Nightly database backups, checked for completeness, kept on the server for 30 days. Encrypted off-site copies at Hetzner, checked regularly, keep a daily copy for 14 days, a weekly copy for 8 weeks and a monthly copy for 12 months.
• Error monitoring with Sentry, and services that restart automatically.

Data minimisation and deletion

• No data from Instagram is sent to our analytics or advertising tools. Our server checks every analytics event for this before it is sent.
• Error reports leave out request bodies, cookies, URL parameters and headers other than the user agent.
• Automatic deletion: raw notifications from Instagram after 14 days, media from conversations after 60 days, generated voice note audio after 7 days, operational logs after 12 months.

Annex 2: Sub-processors

As of version 2026-10-21.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
  Purpose: Servers, database, file storage (voice notes, media from conversations) and encrypted backups.
  Location: Data centres in Germany. Transfer mechanism: None, processing in the EU.
  Data processing agreement
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
  Purpose: DNS, content delivery and protection against attacks. Every request to elevion.cc passes through Cloudflare's network.
  Location: Global network, company in the USA. Transfer mechanism: EU-US Data Privacy Framework and Standard Contractual Clauses.
  Data processing agreement
• Anthropic, PBC, San Francisco, CA, USA
  Purpose: AI features, only when a workspace uses them: the AI DM assistant, drafting campaigns, translating campaign messages and recognising the language of comments, and the optional AI spam filter for comments.
  Location: USA. Transfer mechanism: Standard Contractual Clauses.
  Data processing agreement
• ElevenLabs, Inc., USA
  Purpose: Text to speech for voice notes, and transcription of voice messages people send and of voice recordings the customer uploads.
  Location: USA. Transfer mechanism: EU-US Data Privacy Framework and Standard Contractual Clauses.
  Data processing agreement
• Resend (Plus Five Five, Inc.), USA
  Purpose: Emails to the customer and their team, such as invitations, notifications and weekly reports, which can contain details from the workspace.
  Location: USA. Transfer mechanism: EU-US Data Privacy Framework and Standard Contractual Clauses.
  Data processing agreement
• Functional Software, Inc. (Sentry), San Francisco, CA, USA
  Purpose: Error reports, which can occasionally contain parts of customer data. Request bodies, cookies, URL parameters and headers other than the user agent are removed before sending.
  Location: EU data region in Germany, company in the USA. Transfer mechanism: EU-US Data Privacy Framework and Standard Contractual Clauses.
  Data processing agreement