Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Geddes Ventures LLC ("Processor"). It applies when we process personal data on your behalf, mainly the personal data inside App Store reviews and replies for your apps.
1. Roles
You are the controller of personal data in your app data (for example, reviewer nicknames and review text). We are your processor. For your own account details, we are a controller under our Privacy Policy.
2. Instructions
We process personal data only to provide the Service and as you instruct through the dashboard. If we believe an instruction breaks the law, we will tell you.
3. Confidentiality
Anyone who processes your data for us is bound by confidentiality.
4. Security
- Encryption in transit (TLS) and at rest.
- App Store Connect keys and publishing tokens encrypted in Supabase Vault and readable only by our server.
- Row-level security isolating each customer's data at the database level.
- Access limited to the people who run the Service.
- Logging of every change we make to your listing or replies.
5. Subprocessors
You authorize the subprocessors below. We give at least 30 days' notice by email before adding or replacing one, and you may object on reasonable grounds; if we cannot resolve it, you may cancel without penalty for the affected part of the Service.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, authentication, encrypted key storage and servers | United States |
| Stripe | Payments and invoices | United States |
| Resend | Sending email | United States |
| Cloudflare | Website hosting and network | Global |
| Anthropic | AI model for analysis and writing (Claude) | United States |
| OpenAI | AI assistant checks (ChatGPT), AI Search only | United States |
| Perplexity | AI assistant checks, AI Search only | United States |
| AI assistant checks (Gemini), AI Search only; Google sign-in if you choose it | United States | |
| Apple | App Store Connect, at your direction | United States |
6. International transfers
Data is processed in the United States. For transfers from the EU, UK or Switzerland, the EU Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum are incorporated by reference, with this DPA supplying the required details.
7. Assistance
We help you respond to data subject requests (most are self-serve through export and deletion in Settings) and, where needed, with data protection impact assessments.
8. Breach notice
We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the details we have.
9. Deletion and return
When you delete your account, we delete your data within 30 days, except where the law requires us to keep it. You can export it first from Settings.
10. Audits
On request, once a year, we will answer a reasonable written security questionnaire and share our providers' current security reports.
11. Order of precedence
If this DPA conflicts with the Terms on data protection, this DPA wins.
Details of processing
| Subject matter | App Store growth services for Customer's apps |
| Duration | The term of the Customer's account, plus up to 30 days |
| Data subjects | People who review Customer's apps; Customer's team members |
| Personal data | Reviewer nicknames, review text, territory; team names and emails |
| Sensitive data | None intended |
To sign a countersigned copy, email [email protected].