1. Parties
Controller: the creator who signs in to QuietDrop with their Instagram account and accepts this agreement.
Processor: Sina Ramalho Claro
Erik-Nölting-Str. 8, 40227 Düsseldorf, Germany
Email: contact@quietdadclub.com
2. Subject, duration, nature and purpose
The processor runs QuietDrop for the controller: it receives comments and messages on the controller’s Instagram account through Meta’s Instagram API, sends the private replies, public replies and link messages the controller configured, and shows the controller statistics. Processing lasts as long as the controller uses QuietDrop.
3. Types of data and data subjects
Data subjects: people who comment on the controller’s Instagram posts, reply to or mention the controller in a story, or write to the controller’s account.
Data: Instagram-scoped ID, username, comment or message ID, time of the last message, which messages were sent, link click times, and, in email automations, the email address with the question it answered. Comment and message text is only read to check for keywords (and for an email address) and is not stored otherwise. No special categories of data (Art. 9 GDPR) are intended to be processed.
4. Instructions
The processor processes the data only on the controller’s documented instructions, which are the automations and settings the controller makes in the dashboard, unless EU or member state law requires otherwise. If the processor considers an instruction unlawful, it tells the controller.
5. Confidentiality
Only the operator has access to the data, and is bound to confidentiality.
6. Security (Art. 32 GDPR)
- Access tokens and Kit API keys are encrypted at rest (AES-256-GCM); all traffic uses HTTPS.
- Every webhook from Meta is checked with its HMAC-SHA256 signature; Meta’s deauthorize and deletion requests are verified the same way.
- The dashboard is only reachable after signing in with Instagram; each creator only sees their own data.
- Data minimisation: no message text is stored (only an email address someone sends in answer to an email automation); usernames are deleted after 30 days; delivery logs after 7 days.
- Hosting on Cloudflare’s infrastructure with its physical and organisational safeguards.
7. Sub-processors
The controller authorises Cloudflare, Inc. (hosting: Workers, D1 database) as a sub-processor; transfers to the USA rely on the EU-US Data Privacy Framework and the EU standard contractual clauses. The processor tells the controller in the dashboard before adding or replacing a sub-processor; the controller can object and stop using QuietDrop.
If the controller connects its own Kit account, the processor sends collected email addresses to it on the controller’s instruction. Kit is engaged by the controller, not by the processor, and is not a sub-processor under this agreement.
8. Assistance
The processor helps the controller answer data subject requests (Art. 12–23 GDPR) and with Art. 32–36 GDPR obligations, as far as possible given the nature of the processing. Requests that reach the processor directly are passed on to the controller.
9. Personal data breaches
The processor tells the controller without undue delay after becoming aware of a breach affecting the controller’s data, with the information the controller needs for its own notification duties.
10. Deletion
When the controller deletes their data on the Account page or removes QuietDrop on Instagram, all data processed for them is deleted right away, unless law requires keeping it.
11. Information and audits
The processor makes available the information needed to show compliance with Art. 28 GDPR and allows for and contributes to reasonable audits, after reasonable notice and at the controller’s cost.