Draft of 26 October 2026, before legal review. The version published before the service launches will be binding.
Data Processing Agreement
An agreement under Article 28 GDPR between the Customer (controller) and Grade System sp. z o.o. (processor). The Customer accepts it at registration together with the Terms of Service.
Version of 26 Oct 2026
1. Parties and subject matter
The controller is the Customer that has concluded an agreement to use fanero studio. The processor is Grade System sp. z o.o., ul. Alfonsa Flisykowskiego 1/58, 80-180 Gdańsk, Poland, KRS 0000926334, NIP 5833438266 (the “Processor”).
The Customer entrusts the Processor with processing personal data to the extent and for the purpose necessary to provide fanero studio in accordance with the Terms of Service. This agreement remains in force for as long as fanero studio is used and until the data is deleted afterwards.
2. Scope of processing
| Item | Description |
|---|---|
| Categories of data subjects | people who comment on, send messages to, leave reviews on or tag the Customer’s profiles; followers in aggregated data; members of the Customer’s team and external people with whom the Customer shares reports |
| Types of data | platform account name and ID, profile picture, content of comments, messages and reviews, date and place of publication, content sentiment detected by AI, team notes and labels, email addresses of report recipients |
| Nature and purpose | retrieval from platforms, storage, viewing, organising, statistical analysis, preparation of reply suggestions by AI, sending replies and publishing posts on the Customer’s instructions, creating reports |
| Special categories of personal data | fanero studio is not intended for processing them; they may appear only in content that people publish themselves on the Customer’s profiles |
3. Obligations of the Processor
- processes data only on the Customer’s documented instructions; the agreement, the settings and the actions performed in fanero studio constitute instructions,
- informs the Customer if, in its opinion, an instruction infringes data protection law,
- allows access to the data only to authorised persons who have committed themselves to confidentiality,
- applies the security measures under Article 32 GDPR described in section 5,
- assists the Customer in responding to requests to exercise data subjects’ rights, in particular through the export, deletion and anonymisation features in fanero studio,
- assists the Customer with the obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available,
- notifies the Customer of a personal data breach without undue delay, no later than 48 hours after becoming aware of it, with the information listed in Article 33(3) GDPR,
- makes available the information needed to demonstrate compliance with Article 28 GDPR and allows audits under the terms set out in section 7.
4. Sub-processing
The Customer gives general authorisation to engage the sub-processors listed at fanerostudio.pl/podprocesorzy. The Processor imposes on them the same data protection obligations as in this agreement and is liable for their actions as for its own.
The Processor informs workspace owners by email at least 14 days in advance of any intended addition or replacement of a sub-processor. During this period the Customer may raise a reasoned objection; if the parties cannot reach agreement, the Customer may terminate the agreement with effect before the change is made.
Platforms (Meta, Google, TikTok, LinkedIn) are not sub-processors: the Customer connects its profiles to them itself, and data is sent to them on the Customer’s instructions under those platforms’ terms.
5. Security measures
- encryption of connections (TLS) and of platform access tokens (AES-256-GCM),
- separation of Customers’ data by RLS policies in the PostgreSQL database, checked by automated tests,
- roles and permissions in the workspace assigned by the Customer, activity log,
- passwords as argon2id hashes, two-factor authentication, session expiry,
- servers in Poland, daily encrypted backups in another data centre in the EU, a restore test once a month,
- access by the Processor’s staff only with 2FA and from allowlisted IP addresses; access to a Customer’s workspace only with the Customer’s consent given in the application, for a limited time and recorded in the activity log,
- regular software updates and a penetration test once a year.
6. End of processing
After the Customer stops using fanero studio, the Processor keeps the data for 90 days so the Customer can download it or resume the service, and then deletes it unless the law requires further storage. When the Customer deletes a workspace, the data is deleted after 7 days. Data is removed from backups after 30 days at the latest.
7. Audit
The Customer may carry out an audit once a year, and also after a personal data breach, giving at least 30 days’ notice. An audit is carried out primarily by answering questions and providing documentation, including the penetration test report. An on-site audit takes place during business hours, without access to other customers’ data and at the Customer’s expense.
8. Final provisions
The parties’ liability is governed by Article 82 GDPR and section 12 of the Terms of Service to the extent permitted by law. Matters not covered by this agreement are governed by the Terms of Service and the GDPR. In the event of a conflict with the Terms of Service on data protection matters, this agreement prevails.
A Customer that needs a signed agreement in documentary form or with provisions of its own can request one at pomoc@fanerostudio.pl.