Template. This agreement is a template that must be reviewed by a lawyer before use. To sign it, write to [legal@yourdomain].
This agreement is between the business that uses our service (the Customer) and [Company legal name], [Registered address] (we). It forms part of our terms and applies when we process personal data for the Customer.
1. Roles
The Customer decides why and how personal data of its customers and website visitors is processed (controller, or data fiduciary under the DPDP Act). We process it only to provide the service and only on the Customer's documented instructions (processor). The Customer's settings in the service are those instructions.
2. What is processed
- People: visitors and customers who write to the Customer through the chat, WhatsApp, Messenger, Instagram, email, Slack or a connected help desk; the Customer's own team.
- Data: messages and anything people choose to write in them, contact details (name, email, phone), request details, and technical details such as IP address and browser.
- Purpose and length: to answer, route and store these conversations for as long as the Customer keeps its account, or until the Customer deletes them.
3. Our duties
- Everyone at [Company legal name] with access to personal data is bound to keep it confidential.
- We help the Customer answer requests from people to see, correct or delete their data. The Customer can delete conversations, leads and its whole account in the service at any time, and download all its data.
- We do not use the Customer's data to train AI models, and we do not sell it.
4. Security measures
- Each account's data is kept separate: every request is limited to the signed-in account and workspace.
- Passwords are hashed. AI provider keys, mail passwords, access tokens and app secrets are encrypted at rest (AES-256-GCM) and never shown back.
- All traffic is encrypted in transit (HTTPS). Webhooks from messaging platforms and payment providers are checked with their signatures.
- Sign-in attempts are limited and accounts are locked after repeated failures. Changes in an account are recorded in an audit log kept for one year.
- Backups of the database are encrypted and kept by our hosting provider [backup period].
5. Sub-processors
The Customer allows us to use these sub-processors. We will tell the Customer before adding or replacing one, and the Customer may object.
- [Hosting provider, region]: runs the service and stores its database.
- [AI provider]: writes the chatbot's answers from the Customer's content (only when the Customer uses the AI included in its plan).
- [Email provider]: sends account emails.
- Dodo Payments: handles payments; it does not receive conversation data.
- Meta, Slack, Zendesk, Freshdesk and other services the Customer connects: messages go to them because the Customer chose to connect them.
6. Transfers
Data may be processed outside the country where it was collected, by the sub-processors above. Where the law requires it, we rely on [standard contractual clauses / another lawful basis].
7. Personal data breach
We will tell the Customer without undue delay, and in any case within [72] hours of becoming aware of a personal data breach that affects its data, with what we know and what we are doing about it.
8. End of the service
When the Customer deletes its account, its data is deleted from the service at once and from backups within [backup period]. The Customer can download all its data before that.
9. Audits
On request, we will give the Customer the information it reasonably needs to show that this agreement is kept, [once a year / as agreed].