Skip to content

Data Processing Agreement (DPA)

Last updated: · Version: 2026-10-05 · Previous versions

This Agreement is part of the Terms of Service and applies automatically to every user who connects an Instagram account to Rudud (the "Customer"). It governs how Alhramayn LLC (the "Processor" or "Rudud") processes data about people who interact with the Customer's account, on the Customer's behalf. No signature is needed; a signed PDF copy is available on request at legal@rudud.app.

1. Roles

  1. The Customer is the controller of commenter data (people who comment on the Customer's posts and receive replies). The Customer decides the purposes and means of processing by choosing keywords, messages and posts.
  2. Rudud is the processor and processes this data only on the Customer's documented instructions, which are the Customer's instructions in the Service (creating, editing, pausing automations, deleting people, deleting the account) and this Agreement.
  3. This split matches the "Tech Provider" model in Meta's Platform Terms: we process Platform Data on behalf of and at the direction of the Customer, and keep each Customer's data separate.
  4. Rudud is an independent controller of the Customer's own account data (name, email, consent record, audit log) under the Privacy Policy, and of the global suppression list (a hashed fingerprint of people who asked not to be messaged by any account), based on our legitimate interest in preventing abuse and honoring people's requests.

2. Details of processing (Annex I)

  • Subject matter: sending one private reply per comment that matches the Customer's keyword, and showing the Customer their People list and insights.
  • Duration: the Customer's use of the Service, then the deletion periods in Section 8.
  • Nature: receipt from Meta's API, storage, matching, sending, display, deletion.
  • Categories of data subjects: Instagram users who comment on the Customer's posts.
  • Types of data: Instagram username, scoped ID (IGSID), interaction dates, message count, last automation, and comment and message text in a temporary archive deleted within 23 hours.
  • No sensitive data as defined by applicable laws, and the Customer may not instruct us to process any.

3. Processor obligations

We will:

  1. Process the data only on the Customer's instructions; if the law requires otherwise, inform the Customer beforehand unless the law prohibits it.
  2. Inform the Customer if we believe an instruction violates data protection law or Meta's terms.
  3. Ensure that everyone with access to the data is bound by confidentiality.
  4. Apply the security measures in Annex II.
  5. Assist the Customer, first through the Service's own features, in responding to data subject requests (access, deletion, objection) within legal deadlines; forward any request we receive about the Customer's data, or fulfil it directly if it is a deletion or opt-out request from the commenter, and inform the Customer.
  6. Assist the Customer with impact assessments and consultations with authorities where required, with the information we hold.
  7. Notify the Customer of any breach affecting commenter data without undue delay and within 72 hours of becoming aware, describing the incident, the categories of data and people affected, and the measures taken, by email to the registered address.
  8. Delete the data at the end of the Service under Section 8.
  9. Make available the information needed to demonstrate compliance under Section 7.

4. Customer obligations

The Customer will:

  1. Have a lawful basis in their country and the commenters' countries to send the reply and process their data, and keep the reply content lawful under the Acceptable Use Policy.
  2. Give commenters adequate information about the processing; Rudud's publicly available Commenter Privacy Notice is sufficient for this.
  3. Honor opt-out and deletion requests and not attempt to circumvent them.
  4. Remain responsible for their instructions and for any use of the data outside the Service.

5. Sub-processors

  1. The Customer gives general authorization for the sub-processors listed on the Subprocessors page, currently Cloudflare (hosting and storage), Resend (email), Apple and Google (sign-in and notifications).
  2. We bind each sub-processor by contract to obligations no less protective than this Agreement, and remain liable to the Customer for its performance.
  3. We give 30 days' notice of any new sub-processor on the same page and by email to subscribers. The Customer may object in writing within that period; if no resolution is possible, the Customer may terminate the Service without charge.

6. International transfers

Data is processed on Cloudflare's global network and may be stored in the United States. For transfers from Saudi Arabia, the UAE and Egypt we apply the safeguards their transfer rules require and provide the necessary contractual commitments on request. For the EU, UK and Switzerland, when the Service becomes available there, the European Commission's Standard Contractual Clauses (Module 2: controller to processor) and the UK Addendum are incorporated into this Agreement, or the Data Privacy Framework where it applies.

7. Audits

On request, and no more than once a year unless a breach occurs, we provide written answers to a security questionnaire and copies of our providers' certifications. If that is insufficient for a legal obligation of the Customer, we allow an audit at the Customer's expense on 30 days' notice, during business hours, without access to other customers' data.

8. Deletion at the end of the Service

  1. When the Customer deletes their account, commenter data is deleted immediately from the database and from backups within 35 days.
  2. When Instagram is disconnected without deleting the account, the data is deleted after 30 days.
  3. People with no interaction for 12 months are deleted automatically.
  4. The Customer can export the People list before deletion from Account → Export my data.
  5. We retain only what the law requires, plus the hashed fingerprint of people who requested a global opt-out.

9. Liability

Each party's liability under this Agreement is subject to the limitation of liability and its exceptions in the Terms of Service. This does not limit data subjects' rights against either party.

10. General

This Agreement is read together with the Terms. In a conflict about data protection, this Agreement prevails, and the Standard Contractual Clauses prevail over it where they apply. It is amended by the same procedure as the Terms. Language, governing law and venue are as in the Terms.

Annex II: Security measures

  • Encryption in transit (TLS 1.2 or higher) and at rest, with additional encryption of access tokens using a separate key managed as a secret and rotated.
  • Separation of each Customer's data by workspace ID in every table and query, with automated tests that prevent cross-workspace reads.
  • Least privilege, mandatory two-factor authentication on all admin and provider accounts, and access logging.
  • No Instagram passwords ever; access only through Meta's official API with approved permissions.
  • Automatic deletion of the raw archive within 23 hours, and of data under the retention schedule.
  • Encrypted backups, restore-tested regularly, purged within 35 days.
  • Monitoring, incident response, a written notification plan, and a vulnerability reporting channel on the Security page.
  • Annual review of these measures and at every material change.