Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) supplements the Terms of Service and Privacy Policy between PersonaliAI (“Processor”, “we”, “us”) and the customer agreeing to these terms (“Controller”, “you”). This DPA governs the processing of Personal Data in connection with your use of Chatty (the “Service”) pursuant to Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).

1. Roles and Scope of Processing

1.1 Roles of the Parties: You acknowledge and agree that with respect to end-user Personal Data collected or processed through your chatbots, web widgets, and integrated omnichannel messaging channels (WhatsApp, Instagram, Telegram, SMS, and Email), you are the Data Controller and PersonaliAI is the Data Processor.

1.2 Scope and Subject Matter: The Processor shall process Personal Data solely on behalf of and in accordance with the Controller’s documented instructions, including with respect to transfers of Personal Data outside the European Economic Area (EEA), unless required to do so by applicable European Union or Member State law.

1.3 Categories of Data: Contact information (name, email address, phone number), chat transcripts, support inquiries, meeting booking records, and conversational metadata submitted by end users.

1.4 Categories of Data Subjects: Website visitors, customers, and prospects who communicate with the Controller through the Chatty service.

2. Confidentiality and Security (Article 32)

2.1 Personnel Confidentiality: The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.2 Technical and Organizational Measures: The Processor implements and maintains state-of-the-art technical and organizational security measures, including:

• Cryptographic Isolation: Symmetric authenticated encryption (Fernet / AES-256) for stored secrets, BYOK API keys, and OAuth tokens.
• Encryption in Transit: Mandatory TLS 1.3 encryption across all public APIs, widgets, and webhook delivery pipelines.
• Multi-Tenant Row-Level Security: Strict PostgreSQL database Row-Level Security (RLS) isolating each Controller’s workspace data.
• Automated Data Loss Prevention (DLP): Inbound PII redaction of credit cards (Luhn algorithm), Social Security numbers, and bank account details (ISO 7064 IBAN MOD 97).
• HMAC Webhook Verification: Cryptographic verification of all incoming omnichannel webhooks (Meta Graph API, Twilio, Telegram).

3. Sub-processors (Article 28(2) & 28(4))

3.1 Authorized Sub-processors: The Controller provides general authorization for the Processor to engage the sub-processors listed in the official Chatty Sub-processor Registry.

3.2 Sub-processor Obligations: The Processor shall impose data protection terms on each sub-processor that provide at least the same level of protection for Personal Data as those in this DPA. The Processor remains fully liable to the Controller for the performance of each sub-processor’s obligations.

3.3 Zero AI Foundation Training Guarantee: Chatty contracts with LLM inference providers (Google Vertex AI, OpenAI) under enterprise terms ensuring customer chat data and uploaded business documents are never used to train or retrain generalized or foundational AI models.

4. Assistance with Data Subject Rights (Articles 12–23)

4.1 Assistance: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights under Chapter III of the GDPR:

• Right to Erasure (“Right to be Forgotten”): The Controller can trigger instant, cascading erasure of contact and conversation data via the dashboard or API endpoint (DELETE /api/admin/inbox/contacts/{id}).
• Right of Access & Portability: Controllers can export complete contact and lead records in standard JSON/CSV format.
• Visitor Self-Service Erasure: Website visitors can independently erase their session credentials and local conversational storage directly within the chat widget.

5. Personal Data Breach Notification (Article 33)

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s Personal Data, and in any event within 72 hours. The notice shall describe the nature of the breach, the categories and approximate number of data subjects affected, and the mitigation measures taken.

6. International Data Transfers (Articles 44–49)

6.1 Standard Contractual Clauses: Where Personal Data is transferred outside the European Economic Area (EEA) to a country not recognized as providing an adequate level of data protection, the parties agree that the transfer shall be governed by Module 2 (Controller-to-Processor) of the Standard Contractual Clauses (SCCs)adopted by the European Commission (Implementing Decision (EU) 2021/914).

6.2 Data Privacy Framework: Where applicable, transfers to US sub-processors are conducted pursuant to the EU-U.S. Data Privacy Framework (DPF).

7. Return and Deletion of Personal Data

Upon termination of the Service or upon Controller’s request, the Processor shall delete or return all Personal Data to the Controller and delete existing copies, unless applicable European Union or Member State law requires continued storage. Deleting a bot immediately purges all associated conversational history, indexed knowledge embeddings, and contact records.

8. Contact and DPO Inquiries

To execute an enterprise-signed copy of this DPA, or for Data Protection Officer (DPO) inquiries, contact privacy@personaliai.com.