Data Processing Information

Controller and processor roles

Under the GDPR, the roles depend on whose data is being processed:

• For your account and the personal data of the people using CopyUp (your team), CopyUp acts as the data controller.
• For the content and business data you upload or generate - including any personal data you choose to include in prompts, brand inputs, or published content - CopyUp acts as a data processor, processing it on your instructions to provide the service. You are the controller of that data.
• Our sub-processors (listed below) act as processors or sub-processors and only handle data as needed to provide their part of the service.

What we process and why

• Account data (name, email, authentication) - to create and secure your account.
• Content inputs and outputs - to generate, schedule, and publish content at your request.
• Connected-platform tokens - to publish to the channels you connect (stored encrypted).
• Usage and diagnostic data - to operate, secure, and improve the service.
• Billing data - to process payments and issue invoices (handled by our payment processor; we do not store full card numbers).

Legal basis

We process personal data on the bases set out in our Privacy Policy: performance of our contract with you, your consent (for example, non-essential cookies and marketing), our legitimate interests in operating and securing the service, and compliance with legal obligations.

International transfers

Some sub-processors are located outside the EU/EEA (for example, in the United States). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards - principally the European Commission's Standard Contractual Clauses (SCCs) and, where available, the provider's certification under an approved framework - together with supplementary measures such as encryption in transit and at rest.

Security measures

We apply the technical and organizational measures described on our Security page, including HTTPS/TLS in transit, encryption of sensitive tokens at rest, row-level access controls, role-based permissions, and least-privilege access to production data.

Retention and deletion

We retain personal data only as long as needed for the purposes above or as required by law. You can delete your account at any time from Settings, which removes or anonymizes your personal data except where retention is legally required. You can also export your data from Settings.

Changes to our sub-processors

We may add or replace sub-processors as the service evolves. Material changes will be reflected on this page and, for customers with a signed DPA that requires it, notified in accordance with that agreement.

Sub-processors

The third parties below process personal data on our behalf to provide core parts of the service.