Last updated: May 30, 2026
This data processing agreement forms an integral part of our Terms and Conditions and takes effect automatically as soon as you create a Promobuddy.ai account and have personal data of customers or contacts processed through the platform.
1. Parties
Controller: you (the customer).
Processor: Wefixit BV (trading name Promobuddy.ai), Groenstraat 6A, 3730 Hoeselt (Bilzen), Belgium — VAT BE0695575122.
2. Subject matter and duration
Promobuddy.ai processes personal data on your behalf of individuals to whom you direct social media content (followers, contacts, email addresses you enter). Processing continues for as long as you have an active subscription or free account.
3. Type of data
- Names, handles and public profile information of your social media followers.
- Messages and comments received through connected channels.
- Content (text, images) that you generate or upload.
4. Obligations of Wefixit BV
- Process data solely on the basis of your instructions.
- Implement appropriate technical and organisational security measures (encryption in transit and at rest, Row Level Security at database level, access restrictions).
- Bind employees and sub-processors to confidentiality.
- Assist you with requests from data subjects (access, rectification, erasure).
- Report data breaches within 72 hours.
5. Sub-processors
Wefixit BV uses the following sub-processors for Promobuddy.ai, each operating under their own DPA:
- Supabase (database and authentication, EU).
- Vercel (hosting).
- Stripe (payments).
- Resend (transactional emails).
- Anthropic (AI text generation).
- Higgsfield (AI image generation).
- Zernio (publishing to social media).
- PostHog (product analytics, EU).
Changes to this list will be communicated by email at least 30 days in advance.
6. International transfers
For processors outside the EU, we use the Standard Contractual Clauses (SCCs) of the European Commission.
7. Audit
You have the right to have our security measures audited — with reasonable notice and by mutual agreement — either by your own staff or by an authorised third party.
8. Termination
Upon termination of the agreement, we will delete all personal data within 30 days or return it to you, at your choice. Legally required retention periods (e.g. accounting) continue to apply.
9. Governing law
Belgian law. Disputes before the competent courts in Belgium.