Data Processing Addendum

Status and acceptance

These are proposed customer terms, not an executed agreement. Viewing this page, creating an account or continuing to use Comment Command does not by itself accept this addendum. It takes effect only when authorized representatives of TORUT LTD and the customer expressly agree in writing to this version, identify the customer and covered workspace, and record the effective date. Contact [email protected] to arrange agreement before processing that requires a customer DPA.

TORUT LTD is registered in England and Wales, company number 17205563, with registered office at Suite 10803, 5 Brayford Square, London E1 0SG, United Kingdom, and is registered with the UK Information Commissioner’s Office under registration number ZC273354. The customer is the legal person identified in the written acceptance. This addendum supplements the parties’ service agreement and prevails over conflicting service terms concerning the processing of customer personal data. It does not retrospectively establish a lawful basis for previous processing.

1. Scope and roles

“Customer personal data” means personal data processed by TORUT LTD on the customer’s behalf through Comment Command. “Applicable data protection law” means the data protection laws that apply to that processing, including the UK GDPR and Data Protection Act 2018, and the EU GDPR where applicable. Controller, processor, personal data breach and data subject have the meanings given by those laws.

The customer determines the purposes and means of processing its workspace content and acts as controller. TORUT LTD acts as processor. Where the customer is itself a processor, it must have the controller’s authority to appoint TORUT LTD as a sub-processor; references to customer instructions include that controller’s authorized instructions. TORUT LTD separately acts as controller for its own account administration, billing, security and legal obligations, as described in the Privacy Policy.

2. Processing instructions and customer responsibilities

TORUT LTD will process customer personal data only on documented customer instructions, including instructions concerning international transfers, unless required by applicable law. In that case it will inform the customer of the legal requirement before processing, unless the law prohibits this. Instructions consist of this agreed addendum, the service agreement, authorized workspace settings and actions, and additional instructions agreed in writing. TORUT LTD will immediately inform the customer if it considers an instruction to infringe applicable data protection law.

The customer is responsible for a lawful basis, required notices and permissions, the lawfulness of its instructions, and limiting the data supplied to what is necessary. Connecting a social account is not consent from every commenter. Public availability does not remove data protection obligations. Special-category data and criminal-offence data are not requested for the service; the customer must assess and address such data if it appears in comments or other free text.

3. Confidentiality and security

TORUT LTD will ensure that people authorized to process customer personal data are bound by confidentiality obligations. It will implement appropriate technical and organizational measures taking account of the nature, scope, context, purposes and risks of processing, including the requirements of Article 32 where applicable.

The measures covered by this commitment include access limited to authorized personnel, workspace access controls, protection of credentials, encrypted transport, security maintenance, incident handling, and procedures for restoring availability and regularly assessing safeguards. The parties will confirm the measures appropriate to the covered processing before acceptance. This text is not a certification or a guarantee of zero retention, exclusive UK/EU processing, or encryption of every stored record.

4. Sub-processors

By separately accepting this addendum, the customer gives general written authorization for sub-processors identified in the provider list, to the extent they process customer personal data on TORUT LTD’s behalf. A provider acting as an independent controller is not made a sub-processor merely by appearing in that list.

TORUT LTD will inform the customer in writing of intended additions or replacements before they process the customer’s data and allow a reasonable opportunity to object on data protection grounds. The parties will seek an alternative; if no suitable alternative is available, the customer may end the affected processing before the change takes effect. TORUT LTD will impose equivalent data protection obligations on sub-processors by written contract and remain responsible to the customer for their performance of those obligations.

A provider of an AI assistant that the customer connects under section 9 is chosen by the customer and is not a sub-processor of TORUT LTD.

5. Requests, incidents and assistance

Taking account of the nature of processing, TORUT LTD will assist the customer through appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects. It will notify the customer of requests relating to customer personal data and will not decide the response on the customer’s behalf unless authorized or required by law.

TORUT LTD will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, provide available information needed for the customer’s assessment and notifications, and provide further information as it becomes available. Taking account of the nature of processing and information available, TORUT LTD will assist the customer with security, breach notifications, impact assessments and prior consultation obligations under Articles 32–36 where applicable.

6. International transfers

Processing may involve the United Kingdom, the European Union, the United States and other locations used by the listed providers. TORUT LTD will make restricted transfers only on documented instructions and with a lawful transfer mechanism and any necessary supplementary measures. The parties must identify applicable adequacy decisions or execute the relevant transfer clauses, with completed annexes and transfer assessments where required, before the affected transfer.

This addendum alone is not an EU standard contractual clause, a UK International Data Transfer Agreement or UK Addendum, or a Turkish KVKK standard contract. OpenAI’s own DPA addresses its processing and relevant onward transfers; it does not replace the assessment of the customer-to-TORUT LTD transfer or every other provider relationship.

An AI assistant connected under section 9 may process data outside the United Kingdom and the European Union. Because the customer chooses that recipient and instructs the disclosure, the customer is responsible for identifying and putting in place any transfer mechanism that disclosure requires. TORUT LTD will give the customer the information about the disclosure it reasonably needs for that assessment.

7. Return, deletion and duration

Processing continues for the service term and the period needed to carry out authorized return or deletion. At the customer’s choice, TORUT LTD will return or delete customer personal data after the processing services end, and delete existing copies unless applicable law requires storage. The parties will agree a practicable return or deletion procedure covering active systems, exports, backups and sub-processors. Any legally retained data will remain protected and be restricted to the purpose requiring retention.

Connected platforms' terms can require earlier deletion, and the customer instructs TORUT LTD to follow them: for example, data from YouTube that cannot be refreshed from YouTube within 30 days, or that is no longer available on YouTube, is deleted. Disconnecting a platform stops the relevant connection; it is not a request to erase every retained copy. Deleting service data does not itself remove comments from the source social platform. Provider safety logs and other provider-controlled records may have separate retention rules. See the deletion instructions and OpenAI data controls. Disabling optional API call logging does not establish Zero Data Retention.

8. Accountability and audits

TORUT LTD will make available information necessary to demonstrate compliance with this addendum and applicable processor obligations, and allow and contribute to audits, including inspections, by the customer or its mandated auditor. The parties will arrange reasonable notice, confidentiality and safeguards for other customers’ data without preventing legally required oversight.

9. AI assistant access

Owners and admins of eligible workspaces may connect an AI assistant chosen by the customer, such as claude.ai, ChatGPT, Claude Code, Cursor or Codex, to the workspace's YouTube and Instagram data with an access token or an OAuth connection. Creating a token or approving a connection is a documented customer instruction. So is each request the assistant makes with it, within the scopes granted. The instruction covers disclosing the requested customer personal data to that assistant and, where granted, saving reply drafts or sending a saved draft to the workspace's reply approval queue.

The customer or its user selects and engages the assistant provider. TORUT LTD does not engage that provider. The customer is responsible for its terms with the provider, the provider’s processing, retention and training settings, and the lawful basis and notices the disclosure requires. Content returned to an assistant includes text written by members of the public. The customer is responsible for how its assistant uses that content and for the drafts it saves or sends. An assistant never publishes a reply itself: a reply it sends is posted only when an owner or admin approves it in Comment Command.

AI assistant access is off unless a member creates a token or approves a connection. It is limited to the scopes granted (read comments, read insights, save reply drafts, send saved drafts for approval) and bound to the member and the workspace. Only owners and admins can use it, and every request is checked against the member’s current role and sign-in details and the workspace’s plan and subscription. Access tokens are stored as hashes and expire after 30, 90 or 365 days. OAuth access tokens last one hour and can be renewed for up to 30 days without use. Each request is recorded in the workspace audit log. Sending for approval is limited to replies already saved as drafts in Comment Command, at most 20 per hour per workspace.

The customer can revoke tokens and connections at any time, which ends the instruction for further requests, and must keep tokens confidential and revoke any that may be compromised. TORUT LTD may suspend or revoke AI assistant access to protect the service or customer personal data. Section 5 applies to personal data breaches involving AI assistant access.

Schedule: covered processing

Subject matter and purposes

Connected social comment management: synchronization, storage, search, classification, semantic embeddings, topic and insight reporting, exports, suggested replies, customer-authorized publishing or moderation, and AI assistant access the customer enables.

Nature and frequency

Collection through connected platform APIs or customer input; recording, organization, analysis, retrieval, disclosure to service providers and to AI assistants the customer connects, return and deletion. Processing is repeated or scheduled according to enabled features and customer instructions.

Data subjects

Comment authors, channel or social-account owners, customer team members, and other identifiable people mentioned in submitted content.

Data categories

Comment and parent-thread text; author display names, handles and platform identifiers; channel, video and post metadata, captions, permalinks and media URLs; timestamps, language and engagement information; customer-provided brand voice, templates and team notes; labels, embeddings, reports and reply drafts. Connection credentials are used to access source platforms and are not intended as AI prompt content.

AI processing

OpenAI receives the text and context selected for the requested feature, which may include names and identifying information within free text. This processing is not assumed to be anonymous. The scope depends on the enabled feature and documented instructions.

AI assistant access

Recipient: the AI assistant provider chosen by the customer. Disclosed, within the granted scopes: comment text, author names and handles, post or video context, labels, status, saved drafts and replies, top questions and insight reports, which can quote public content. Written back: reply drafts and, with the approval scope, saved drafts sent to the reply approval queue; a person posts them. Access tokens, connection credentials and platform credentials are never returned to the assistant.

Duration and contact

The agreed service term and subsequent authorized return or deletion period. Privacy and DPA requests: [email protected].