// Data Processing Agreement — same shape/convention as terms.jsx and // privacy.jsx: real company facts and real sub-processors (confirmed // against the actual plugin/relay integrations), [INSERT ...] placeholders // only for genuinely pending specifics a lawyer/the business needs to set. const DPA_SOURCE = `# Data Processing Agreement This Data Processing Agreement ("DPA") forms part of the Terms of Service between Famcom Labs, Inc., a Delaware corporation ("Processor," "we," "us"), and the customer agreeing to it ("Controller," "you"), and applies to the extent we process personal data on your behalf in connection with the Fire Your Agency service (the "Service"). ## 1. Subject Matter and Duration This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the Service, for as long as the Controller's subscription to the Service remains active, as described in the Terms of Service. ## 2. Nature and Purpose of Processing The Processor processes personal data solely to provide the Service: generating marketing copy and campaign recommendations, managing advertising campaigns on connected platforms, sending and automating email/SMS communications, and producing performance reporting and attribution. The categories of data subjects are the Controller's own store customers; the categories of personal data are those described in the Privacy Policy §1.2–1.3 (order/customer data, third-party platform engagement data). ## 3. Processor Obligations 3.1 The Processor shall process personal data only on the Controller's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law. 3.2 The Processor shall ensure that persons authorized to process the personal data are subject to confidentiality obligations. 3.3 The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of credentials and access tokens at rest and access controls restricting who can reach production data — see [Security](security.html) for the current technical detail. 3.4 The Processor shall assist the Controller, insofar as reasonably possible, in responding to requests from data subjects seeking to exercise their rights under applicable data protection law. 3.5 The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and in any event within [INSERT NOTIFICATION WINDOW, e.g., 72 hours]. ## 4. Sub-processors 4.1 The Controller authorizes the Processor to engage the following sub-processors in connection with the Service: - **Anthropic, OpenAI, Google (Gemini)** — AI content and image generation - **Meta, Google Ads** — advertising campaign management (data flows directly between the Controller's own connected accounts and these platforms) - **Klaviyo, SendGrid** — email and SMS delivery - **DigitalOcean** — infrastructure hosting for the Processor's relay service 4.2 The Processor shall enter into a written agreement with each sub-processor imposing data protection obligations equivalent to those in this DPA. The Processor will provide notice of any new sub-processor with material access to Controller data at least [INSERT NOTICE PERIOD] before granting that access, during which the Controller may object. ## 5. International Data Transfers Where personal data is transferred outside the country in which it originates, the Processor relies on [INSERT TRANSFER MECHANISM, e.g., Standard Contractual Clauses] to ensure an adequate level of protection. ## 6. Audit Rights Upon reasonable written request, no more than once per 12-month period, the Processor shall make available information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied by providing a summary of relevant security documentation in lieu of an on-site audit. ## 7. Deletion or Return of Data Upon termination of the Service, the Processor shall, at the Controller's election, delete or return all personal data processed on the Controller's behalf, except to the extent retention is required by applicable law, consistent with the Privacy Policy's data retention terms. ## 8. Liability Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service. ## 9. Governing Law This DPA is governed by the same governing law as the Terms of Service. ## 10. Contact Famcom Labs, Inc. 147 Prince Street, Brooklyn, NY 11201 help@fireyouragency.net `; const InfernoDpa = () => ( ); Object.assign(window, { InfernoDpa });