Data Processing Addendum (DPA)
How we process your data on your behalf
Last updated: February 6, 2026
This Data Processing Addendum ("Addendum") forms part of the Terms and Conditions between Orsana ("Processor") and the User/Subscriber ("Controller").
1. DEFINITIONS
- "Personal Data" means any information relating to an identified or identifiable natural person processed within Orsana.
- "Process/Processing" means any operation performed on data (generating text, storing prompts, etc.).
- "Sub-processor" means any third party (e.g., AI model providers, hosting services) appointed by Orsana to process data.
2. SUBJECT MATTER AND DURATION
Processor shall process Personal Data only to provide the AI content generation services for LinkedIn and Instagram as requested by the Controller. The duration of processing is the term of the active subscription.
3. CONTROLLER OBLIGATIONS (The User)
The Controller (User) represents and warrants that:
- They have a legal basis (consent or legitimate interest) to process any data they input into Orsana or pull from LinkedIn/Instagram.
- They will not input highly sensitive data (health, biometric, or criminal records) into the AI tool.
- They are responsible for the accuracy and legality of the generated outputs they choose to publish.
4. PROCESSOR OBLIGATIONS (Orsana)
Orsana shall process data only on the documented instructions of the User (e.g., clicking "Generate").
5. SUB-PROCESSORS
The Controller grants a general authorization to Orsana to engage Sub-processors (e.g., OpenAI, Anthropic, AWS). Orsana shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors via its website or email. In case the Controller does not agree with such change, the subscription may be terminated with a 30 day notice.
6. DATA BREACH NOTIFICATION
In the event of a confirmed personal data breach affecting the Controller's data, Orsana shall notify the Controller without undue delay and provide reasonable cooperation to help the Controller meet their reporting obligations under GDPR.
7. DELETION OF DATA
Upon termination of the subscription, Orsana shall delete or return the User Content within 30 days, unless French or European Union law requires the continued storage of the data.