Merome legal information
Data Processing Addendum
This DPA forms part of the agreement between a business Customer and SAKAE PTY LTD trading as Merome where we process personal data on Customer's behalf.
1. Roles
Customer determines purposes/means and is controller; Merome is processor. Where Customer is a processor, Merome may be its subprocessor. Each complies with applicable law for its role.
2. Instructions
Processing occurs only to provide service, under documented instructions/agreement/DPA or as required by law.
3. Confidentiality
Authorised personnel must have appropriate confidentiality obligations.
4. Security
We maintain reasonable technical/organisational measures appropriate to service/data. Schedule 2 describes verified controls; planned measures are not represented as operational.
5. Subprocessors
Customer authorises providers required for service and disclosed on Subprocessors. Relevant providers must protect personal data under applicable contractual/legal requirements. Planned integrations are labelled separately.
6. Data-subject requests
Taking account of processing, provide reasonable assistance with lawful requests. Requests relating solely to Customer-controlled data may be directed to Customer unless law requires a direct response.
7. Incidents
Where legally required notify Customer without undue delay after awareness of a confirmed personal-data breach affecting its data, with reasonably available information to assist obligations.
8. Compliance assistance
Where required, provide reasonable assistance with security/breach obligations/impact assessments/regulatory consultations, taking account of processing.
9. Return/deletion
On termination/valid request delete or return data as law/agreement requires. Protected backups may remain until normal expiration.
10. Compliance information
Make reasonably necessary information available where applicable. Further reasonable audits must protect other customers, system security, confidential information and third-party rights.
11. International transfers
Applicable transfer safeguards must be reviewed for actual processing; when required appropriate recognised contractual mechanisms apply. UK/EEA paid launch remains disabled pending separate legal/tax/transfer review; this clause alone does not authorise launch.
12. Schedule 1 — Processing details
Subject: social-media analytics service. Duration: customer relationship plus applicable retention/deletion. Activities: retrieval/storage/organisation/transmission/analysis/transcription/classification/manual refresh/reporting/security/support/deletion. Subjects: users/authorised account holders/individuals lawfully appearing in customer data. Data: contact/user/Meta identifiers, content/metadata/metrics/transcripts/analytics/OAuth and operational/security information. Do not intentionally supply sensitive data unless expressly supported and lawful.
13. Schedule 2 — Verified measures
Verified measures include least-privilege Google IAM, separate production/staging, Secret Manager, encrypted Cloud SQL/GCS, KMS infrastructure for OAuth ciphertext, automated backups and point-in-time recovery. The deployed app implements secure host-only sessions/CSRF, scoped data access and durable object deletion. Public domains use Google-managed HTTPS with TLS 1.2 minimum, separate app/website backends, Cloud Armor Standard host and basic rate protections, and restricted Cloud Run ingress. Managed WAF signatures remain in preview for observation. Configured backups are not a claim that a full production restore exercise has been completed.
PO Box 263, Pyrmont NSW 2009, Australia
support@merome.io · privacy@merome.io · legal@merome.io · security@merome.io