Data processing agreement

01 Who is controller and who is processor

When you run an assistant on your website, you are the data controller for the conversations your customers have with it. You decide what content it can answer from, which systems it can reach, and how long conversations are kept.

We are your processor. We handle that data to provide the service and act on your instructions, not on our own purposes.

Where we act as controller, for example for your own account and billing details, the privacy notice applies instead.

02 What we process for you

• The documents and website content you add to a knowledge base.
• Messages exchanged between your customers and your assistant.
• Records of lookups the assistant performed against systems you connected, including which tool ran and what it returned.
• Account and team member details needed to give your people access.

03 Acting on your instructions

We process this data to run the assistant, to keep the service secure, and to support you when you ask. We do not use it for our own analytics, we do not sell it, and we do not use it to train public models.

If we ever believed an instruction from you was unlawful, we would tell you rather than quietly carry it out.

04 Sub-processors

We use suppliers to run the service, each bound to process data only on our instructions. Current categories are cloud hosting and databases, object storage, a vector search index, model providers, email delivery, and payments.

We will tell you before adding a sub-processor that handles your customer content, so you have the chance to object.

05 Security measures

• Encryption in transit for the widget, the API, and outbound tool calls.
• Credentials for connected systems encrypted at rest and used server-side only.
• A domain allowlist per deployment, and optional JWT verification, so only your sites and your signed-in users can use your assistant.
• Audit logging of administrative actions and tool executions.
• Access on our side limited to the people who need it to operate the service.

06 Requests from your customers

If one of your customers asks to access or delete their conversation, that request goes to you as the controller. We will help you find and act on the relevant data.

If a request reaches us directly, we will not answer it on your behalf. We will pass it to you.

07 If something goes wrong

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know and what we are doing about it. We will not wait until we have a complete picture before telling you there is a problem.

08 International transfers

Where personal data is transferred across borders we rely on appropriate safeguards for that transfer, such as standard contractual clauses.

09 Return and deletion

You can export your content while your account is active. On termination you can export it, and after a reasonable period we delete it from our systems and instruct our sub-processors to do the same.

10 Getting it signed

Ask us and we will send you the agreement to sign. We are a small pre-launch team, so this is a real person preparing it rather than an automated portal, and we will tell you honestly how long it will take.

If your legal team needs specific clauses or has its own paper, send it over and we will read it.