§ Legal — DPA

Data Processing Agreement

Last updated : October 18, 2026

1. Framework

This Data Processing Agreement (the “DPA”) supplements the Terms of Service when the User is a professional and the Publisher acts as a processor within the meaning of article 28 of the GDPR.

It is deemed concluded when the User subscribes to a Business plan or explicitly requests DPA signature by e-mail at contact@sponge-theory.ai.

2. Roles

The User acts as controller of the data they entrust to the Platform (product URL, editorial content, third-party platform OAuth credentials).
The Publisher (Sponge Theory) acts as a processor for those data, and as controller for the data strictly necessary for account management and billing.

3. Subject matter, duration and nature of processing

Subject matter : delivery of Rayonne Services (brief, strategy, content, distribution, measurement).
Nature : crawl, extraction, AI inference, content generation, multi-channel submission, AARRR measurement.
Categories of data subjects : prospects and customers of the User mentioned on their website or in their marketing content.
Categories of data : commercial identifiers, editorial content, engagement metrics.
Duration : as long as the workspace exists, including after cancellation; processing ends when the workspace or the organisation is deleted, or on request.

4. Processor obligations

Sponge Theory undertakes to :

Process personal data only on documented instructions from the controller.
Ensure that persons authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures described in § 10 of the Privacy Policy.
Assist the controller in responding to data subject rights requests.
Notify any data breach within 72 hours of discovery.
Make available the information needed to demonstrate compliance with article 28 GDPR and allow for audits.

5. Sub-processors

Sponge Theory uses the sub-processors listed on the Subprocessors page. Any material change to this list will be notified by e-mail at least 30 days in advance; the User may object by terminating their subscription, without penalty.

6. Transfers outside the EU

Transfers to third countries (Clerk, Resend) are framed by the EU-U.S. Data Privacy Framework and / or Standard Contractual Clauses adopted by the European Commission.

All of Rayonne’s AI inference runs in France, on Sponge Theory’s own infrastructure (SPT Models). No data is transmitted to OpenAI, Anthropic, Mistral, Google (Gemini), Groq or any other external AI provider. The one exception: the GEO measurement (Audigeo, a Sponge Theory service) asks public AI assistants — ChatGPT, Gemini and Perplexity, run from the United States — the questions of the User’s market, to measure whether they mention it; those questions carry the product’s name, its category, its competitors and its audience’s problems as its brief describes them, plus the questions the User adds themselves — never private data.

7. Deletion and return

At the end of the provision of services, and at the User’s choice, Sponge Theory returns or deletes all personal data within 30 days, save where legal retention obligations apply. Exception: the audited site and the GEO audits kept by Audigeo are not covered by this period — Rayonne does not delete them (the tracked questions and their readings are deleted with the workspace); their deletion is requested separately at contact@sponge-theory.ai.

The User may at any time obtain an export of their briefs, strategies, content, submissions and metrics in JSON format, on request to contact@sponge-theory.ai.

8. Liability

Sponge Theory’s liability under this DPA is governed by article 8 of the Terms and article 82 of the GDPR.

9. Contact

For any question regarding this DPA, or to request its electronic signature :

Sponge Theory — contact@sponge-theory.ai