Data Processing
Last updated: June 4, 2026
This page describes how Easley Labs LLC (“Easley Labs,” “we”) processes data on behalf of business customers using Easley Signal, and the subprocessors we rely on to deliver the service. Read it alongside our Privacy Policy and Terms of Service.
Our role
When a business customer uses Signal to manage its own social media content, the business is the “controller” of the personal information it puts into Signal (its team members, its guests, the people shown in its content). Easley Labs is the “processor,” acting on the instructions of the customer.
Where Signal collects information directly from end users for our own purposes (account holders, billing contacts, support requests), Easley Labs is the controller and the Privacy Policy applies.
What we process
- Account profiles and roles inside an organization.
- Photos, videos, captions, and brand information uploaded by staff.
- Guest submissions captured via QR-coded links, with consent records.
- Social platform tokens, encrypted at rest, used only to publish what the customer schedules.
- Activity logs needed to operate and troubleshoot the service.
How we process
- Only as needed to deliver the service the customer requested.
- Under written confidentiality with our team and subprocessors.
- Behind authentication and role-based access controls.
- With audit logging on actions that touch customer data.
- Never to train third-party AI models.
Subprocessors
We use the following subprocessors. Each is bound by terms requiring them to protect customer data and to use it only for the purposes listed.
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting and edge delivery | USA |
| Supabase | Authentication and primary Postgres database | USA |
| Cloudinary | Image and video storage, transformations, delivery | USA, EU |
| Anthropic | AI drafting of captions and content suggestions | USA |
| Meta Platforms | Publishing scheduled posts to Facebook Pages and Instagram Business accounts | USA, global |
| Google (Business Profile API) | Publishing scheduled posts to connected Google Business Profile locations | USA, global |
| Publishing scheduled posts to connected LinkedIn member feeds | USA, global | |
| Stripe | Subscription billing and payment processing | USA |
| Resend | Transactional email delivery | USA |
| Upstash | Rate limiting and short-lived caching | USA |
We will notify customers before adding a new subprocessor that materially changes the processing of their data, with at least 14 days’ notice.
International transfers
Our subprocessors are primarily in the United States. If you are outside the US, your data will be transferred to and processed in the US. We rely on the contractual terms our subprocessors offer for cross-border transfers, including standard contractual clauses where applicable.
Security measures
- TLS for all data in transit.
- AES-256-GCM encryption at rest for social access tokens.
- Service-role database keys held only on our servers, with row-level security configured on sensitive tables.
- Parameterized database queries and validated server actions.
- Rate limiting on AI and authentication endpoints.
- Vulnerability monitoring on dependencies.
Retention and deletion
Customer content is retained for the life of the customer’s subscription. On cancellation, content is kept for 30 days to allow recovery, then deleted. A customer can request earlier deletion at any time by writing to nate@easleylabs.com.
Backups roll off on a 35-day cycle, after which deleted content is unrecoverable.
Incident response
If we discover a security incident involving customer data, we will notify affected customers without undue delay, share what we know about scope and cause, and cooperate with reasonable customer investigations. Notification will be by email to the account owner and, when appropriate, a notice inside Signal.
Customer requests
A customer can request a list of the personal information we hold for them or for their end users, ask us to correct it, or ask us to delete it. Send the request from the account owner’s email to nate@easleylabs.com. We respond within 30 days.
Contact
Easley Labs LLC, Denver, Colorado, USA. Email nate@easleylabs.com.