Data processing addendum

This addendum applies when we process personal data on your behalf — your visitors' conversations. It forms part of the terms of service. You are the controller; we are the processor.

1. What we process, and why

• Subject matter: providing AI live chat.
• Duration: as long as your workspace exists, plus the deletion periods below.
• Categories of people: the visitors to your website and the members of your team who use the inbox.
• Categories of data: message content; any name, email or phone a visitor gives; page and referrer; browser; IP address; and whatever else you choose to collect through your assistant.

2. Our obligations

• We process personal data only on your documented instructions, which your use of the product and its settings constitute.
• Everyone with access is bound by confidentiality.
• We keep appropriate technical and organisational measures: encryption in transit, encrypted credentials at rest, hashed passwords, tenant isolation, and least-privilege access to production.
• We tell you without undue delay if we become aware of a personal data breach affecting your data, with what we know and what we are doing.
• We help you answer data subject requests, meet your security duties, and carry out an impact assessment where you need one.
• At the end of the agreement we delete your data within 30 days, or return it if you ask before then.
• We make available the information you need to show we meet these duties, and allow an audit on reasonable notice, no more than once a year unless a regulator requires otherwise.

3. Sub-processors

You give general authorisation for us to use sub-processors. Each is under written terms no less protective than these. We will tell you before adding one, and you may object on reasonable data protection grounds, in which case you may end the affected service.

They fall into these categories: hosting and infrastructure; AI model providers; email delivery; payment processing; and messaging, for a workspace that connects WhatsApp. The current list is on our sub-processors page.

On BYOK plans the AI provider is not our sub-processor. You hold that key and that relationship directly.

4. AI providers and training

Generating an answer means sending the conversation and the relevant part of your knowledge base to a model provider. We contract with providers on terms that prohibit using your data to train their models, and we do not train any model on your data ourselves.

5. International transfers

Where personal data leaves the European Economic Area or the United Kingdom, the transfer is covered by Standard Contractual Clauses or another lawful safeguard, together with any measures the circumstances require.

6. Your obligations

You are responsible for having a lawful basis to collect what your assistant collects, for telling your visitors about it in your own privacy notice, and for not configuring your assistant to gather special category data such as health information through a chat window.

7. Signing

Most customers do not need a signed copy: this addendum applies automatically. If your procurement requires a signed DPA, email hi@magiz.ai and we will send one.