Data processing addendum
Forms part of the terms of service, and applies whenever we process personal data on your behalf.
Last updated 3 September 2026
Roles
You are the controller of the personal data your bot handles — messages from your customers and website visitors and any contact details they provide. We are your processor, and we act only on your documented instructions, which are these terms plus the settings you choose in the dashboard.
What we do with it
- Subject matter: running an AI customer support assistant across your connected channels (website chat, messaging platforms, email, and marketplace channels).
- Duration: for as long as your account is open, plus the time it takes to delete afterwards.
- Data subjects: your website visitors, customers contacting you across connected channels, and the colleagues you invite to your account.
- Data: customer inquiries, conversation turns, and — where enabled by your settings or provided by the customer — name, email address, phone number, and order/booking references.
Our obligations
- We process only on your instructions, and tell you if we think an instruction breaks the law.
- Everyone with access is under a duty of confidence.
- Data is encrypted in transit and connection credentials are encrypted with AES-256-GCM at rest, access is limited to staff who need it, and every staff action in the back office is logged.
- We help you answer requests from data subjects, and help with impact assessments where you need one.
- We tell you without undue delay if there is a breach affecting your data.
- On request at the end of the contract we delete or return the data.
Sub-processors
The service runs on infrastructure operated by Atal Networks. The sub-processors below are the third parties involved. We will give you notice before adding another, and you may object.
| Processor | Purpose | Region |
|---|---|---|
| OpenRouter and the model providers it routes to | Generating answers | US / EU |
| Your chosen mail provider (Postmark, Mailgun, Amazon SES or ZeptoMail) | Sending and receiving email | EU where offered |
| Stripe, PayPal or Payssion | Customer billing only — never visitor data | EU / US |
| Google LLC | Encrypted offsite database backups (Google Drive) | US / Global |
Transfers outside the UK and EEA
Where personal data is transferred outside the UK or EEA, including to our hosting location or to a sub-processor, we rely on the standard contractual clauses. The hosting location is disclosed to customers under a signed DPA on request. Only the text needed to answer a question is sent to a model provider, and it is not retained by them for training.
Audit
We will answer reasonable questions about our security and, on notice, allow an audit no more than once a year unless a regulator requires otherwise.
Questions, or a signed copy: