Data processing addendum

Forms part of the terms of service, and applies whenever we process personal data on your behalf.

Last updated 3 September 2026

Roles

You are the controller of the personal data your bot handles — your website visitors' messages and any contact details they give. We are your processor, and we act only on your documented instructions, which are these terms plus the settings you choose in the dashboard.

What we do with it

• Subject matter: running an AI chat assistant on your website.
• Duration: for as long as your account is open, plus the time it takes to delete afterwards.
• Data subjects: your website visitors, and the colleagues you invite to your account.
• Data: chat messages, and — only where you have switched capture on and the visitor agreed — name, email address and phone number.

Our obligations

• We process only on your instructions, and tell you if we think an instruction breaks the law.
• Everyone with access is under a duty of confidence.
• Data is encrypted in transit and at rest, access is limited to staff who need it, and every staff action in the back office is logged.
• We help you answer requests from data subjects, and help with impact assessments where you need one.
• We tell you without undue delay if there is a breach affecting your data.
• On request at the end of the contract we delete or return the data.

Sub-processors

We use the processors below. We will give you notice before adding another, and you may object.

Transfers outside the UK and EEA

Where a processor is outside the UK or EEA we rely on the standard contractual clauses. Your data is stored in Germany; only the text needed to answer a question is sent to a model provider, and it is not retained by them for training.

Audit

We will answer reasonable questions about our security and, on notice, allow an audit no more than once a year unless a regulator requires otherwise.

Questions, or a signed copy: [email protected]