BrandShip
Data Processing Agreement
This agreement applies whenever BrandShip processes personal data on your behalf while providing the Service under our Terms of Service. It is part of those Terms and is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Turkey's Personal Data Protection Law No. 6698 (KVKK). If this agreement and the Terms conflict on personal data, this agreement wins.
Need a countersigned copy? Email legal@getbrandship.com with your company name and address and we will send one back signed.
1. Roles
You decide why and how personal data about your leads, customers and contacts is processed; you are the controller (under KVKK, the veri sorumlusu). BrandShip processes that data only to provide the Service to you; we are your processor (veri işleyen). For your own account data (your login, billing contact), BrandShip is a controller under our Privacy Policy.
2. Details of the processing
| Subject matter | Running AI agents for sales, content, revenue operations, customer success, support and finance in your workspace. |
|---|---|
| Duration | For as long as your workspace exists, plus the deletion period in section 9. |
| Nature and purpose | Storing, organising, analysing and generating content from your data; sending the messages, invoices and posts you approve (or have set to send automatically); syncing with the services you connect. |
| Data subjects | Your leads, customers, support contacts, and your own staff who use the workspace. |
| Categories of data | Names, business email addresses, phone numbers, job titles, company details, message contents (email, WhatsApp, chat), deal and invoice details, calendar availability, and any documents you upload to the Knowledge Base. |
| Special categories | None intended. Please don't upload health, biometric or other special-category data; the Service is not designed for it. |
3. Our obligations
- Instructions. We process personal data only on your documented instructions, which are the Terms, this agreement and the settings and approvals you give in the app. If we believe an instruction breaks data protection law, we will tell you.
- Confidentiality. Anyone we authorise to process your data is bound by confidentiality.
- Security. We maintain the technical and organisational measures in section 6.
- Subprocessors. We use subprocessors only as set out in section 5.
- Assistance. We help you answer requests from data subjects (access, correction, deletion, objection, portability), mostly through the app itself, and otherwise on request, and we help with data protection impact assessments and consultations with a supervisory authority where our processing is relevant.
- Deletion or return. At the end of the Service we delete or return your data as set out in section 9.
- Information and audits. We make available the information needed to show compliance with this agreement, as described in section 8.
4. Your obligations
You confirm that you have a lawful basis for the personal data you bring into BrandShip (including leads you import) and for the messages you ask the agents to send, including any consent that marketing rules such as the ePrivacy Directive, CAN-SPAM, or Turkish commercial electronic message rules (İYS) require.
5. Subprocessors
You authorise us to use the subprocessors below. Some are engaged only when you connect the matching service.
| Subprocessor | Purpose |
|---|---|
| Neon | Managed PostgreSQL database (EU, Frankfurt) |
| Cloudflare | Network delivery, website hosting, receiving email replies from your leads |
| Anthropic | AI text generation |
| AI images; sign-in; Gmail, Calendar and Google Ads when you connect them | |
| Higgsfield | AI video, when used |
| ElevenLabs | Speech-to-text and voice, only when you talk to Apex during setup; recordings are not stored by BrandShip |
| Zernio | Connection partner for Instagram and WhatsApp, when you connect them |
| Meta | WhatsApp messaging and Instagram publishing, when you connect them |
| Publishing, when you connect it | |
| Slack | Notifications, when you connect it |
| Microsoft | Sign-in |
| Paddle | Reseller and Merchant of Record: payment, billing details, tax and invoices for your subscription |
| Postmark | Account emails from BrandShip to you: setup links, password resets and account notices (name and email address) |
We bind each subprocessor to data protection terms at least as protective as this agreement and remain responsible to you for its performance. We will email you at least 14 days before adding or replacing a subprocessor that handles your personal data. If you object on reasonable data protection grounds and we can't address the objection, you may end the affected part of the Service before the change takes effect.
6. Security measures
- Encryption in transit (TLS, HTTPS-only with HSTS) and at rest (database encryption at rest).
- Passwords stored as bcrypt hashes; single-use, expiring setup and reset links stored only as hashes.
- Access tokens for connected services kept server-side, never sent to the browser; each service connected with the narrowest permission that does the job.
- Workspace isolation enforced on the server; rate limiting on sign-in and the API; signature verification on incoming webhooks.
- Human approval before ad spend changes and, by default, before public posts; a log of every message sent on your behalf.
- Database point-in-time restore.
More detail is on our Security page. We may improve these measures over time but will not reduce the overall level of protection.
7. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. The notice will describe what happened, the data and people likely affected, the likely consequences and what we have done or propose to do, so you can meet your own obligations (72 hours to the supervisory authority under the GDPR; as soon as possible, and within the period the Turkish Personal Data Protection Board sets, under KVKK).
8. Information and audits
On request we will answer a reasonable security questionnaire and provide the information needed to show compliance with this agreement. If that isn't enough to meet a requirement of data protection law or a supervisory authority, you may audit our compliance once a year, with 30 days' notice, at your cost, during business hours, and under confidentiality.
9. Deletion and return
You can ask us to export (as CSV or JSON) or delete your data at any time while your workspace is active. When the Service ends, we delete your personal data within 30 days, or return it first if you ask before then, unless the law requires us to keep it. Data in backups is overwritten on the normal backup cycle.
10. International transfers
Your data is stored in the EU. Some subprocessors (for example, AI providers) process data in other countries, including the United States. Where a transfer needs a legal safeguard, it relies on an adequacy decision or on the EU Standard Contractual Clauses (with the UK addendum for UK data), and for personal data subject to KVKK on the standard contracts and procedures under Article 9 of KVKK.
11. Requests from authorities
If a public authority asks us for your personal data, we will only disclose it where the request is legally binding, we will limit it to what is strictly required, and we will tell you first unless the law forbids it.
12. Liability and term
Each party's liability under this agreement is subject to the limitations in the Terms, except where the law does not allow them to be limited. This agreement lasts as long as we process personal data for you.
13. Contact
Yiğit Taluy · legal@getbrandship.com