Data Processing Addendum.
Standard SCC-aligned DPA for customers processing personal data through Imposter Hunter services. Signed counter-execution within 5 business days on request.
What the DPA covers.
Detection and classification services.
Processing of personal data submitted to or generated by Imposter Hunter services, including LLM Shield (adversarial input detection) and Social-Media Shield (impersonator detection). Processing is strictly limited to service delivery.
Term of the Service Agreement.
The DPA is effective for the duration of the Customer’s active service subscription and terminates automatically upon service termination, subject to data-return and deletion obligations described in Section 5.
Analysis, classification, and routing.
Automated classification of text inputs against Imposter Hunter’s proprietary detection engine. No training on customer data. No cross-customer data sharing. Processing performed by instruction-tuned LLM pipeline in Customer-selected region.
Text inputs submitted to the API.
Customer-submitted text inputs (prompts, voice transcripts, tool responses, documents). May incidentally contain personal data at Customer’s discretion. No special-category personal data required or solicited. Account metadata (name, email, billing) processed separately under Privacy Policy.
Who we run on.
Current sub-processor list. Updated on our Trust page at /trust#subprocessors whenever sub-processors are added or removed. Customers are notified 30 days in advance of any new sub-processor addition.
| Sub-processor | Purpose | Region(s) | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Compute, inference, storage | US-East-1 / EU-Central-1 (Customer selectable) | AWS DPA + SCCs |
| Stripe | Payment processing | Global (Stripe-controlled) | Stripe DPA + SCCs |
| SendGrid (Twilio) | Transactional email | US | Twilio DPA + SCCs |
| Linear | Support ticket management | US | Linear DPA |
Cross-border data transfer mechanisms.
Controller → Processor
For transfers from EU/EEA Controllers to Imposter Hunter acting as Processor. Standard Contractual Clauses (Module 2) per Commission Implementing Decision (EU) 2021/914 are incorporated by reference into the signed DPA.
Processor → Sub-processor
For onward transfers to AWS and other sub-processors. SCC Module 3 (Processor to Sub-processor) applies. Sub-processor SCCs are maintained on file and available to Customers on request under NDA.
Two entities. Region routes the contract.
EU/EEA and UK Customers contract with IMPOSTERHUNTER S.R.L. (Romania, CUI 54468885, Trade Registry J2026024097006). MENA, GCC, and rest-of-world Customers contract with Imposter Hunter Solutions (Dubai, UAE, Trade License #1540371). Where unspecified, IMPOSTERHUNTER S.R.L. is the default. The applicable entity is identified on each signed DPA.
Our obligations to you and your data subjects.
We support your DSAR obligations.
Imposter Hunter will provide commercially reasonable assistance to Customers in responding to Data Subject Access Requests, including access, portability, rectification, erasure, and restriction of processing, within the scope of data we process on the Customer’s behalf. Response SLA: 10 business days.
72-hour notification commitment.
In the event of a confirmed personal data breach affecting Customer data, Imposter Hunter will notify the affected Customer within 72 hours of becoming aware of the breach, with sufficient detail to enable Customer to fulfill its own notification obligations to supervisory authorities and data subjects.
Audit via SOC 2 reports.
Customers may request evidence of compliance through Imposter Hunter’s SOC 2 Type II report (when available, targeted Q4 2026) or through a third-party methodology attestation report. On-site audits available under NDA for Tier 2 enterprise customers at Processor’s reasonable discretion.
Security baseline included in every DPA.
Full Technical and Organisational Measures (TOMs) annex is included in the signed DPA and updated quarterly. Current TOMs are available to prospective customers under a short-form NDA at the due-diligence stage.
Signed DPA in 5 business days.
Email our legal team. We’ll send the current DPA template for your review, incorporate any negotiated modifications, and return a counter-executed PDF within 5 business days.
Ready to start your evaluation?
Book a 30-minute security review call, or email us to request the DPA directly.