Data Processing Addendum.

This Data Processing Addendum (DPA) is part of your Aiva Chat Terms of Service. It governs how we process personal data on your behalf when you use Aiva Chat.

For the purposes of GDPR (and equivalent privacy laws):

• You are the data controller — your customers' personal data is your responsibility.
• Aiva Chat is the data processor — we handle your customers' data only to provide the service you've signed up for.
• We don't decide why your customers' data is being processed. You do. We just do what you tell us.

This DPA applies automatically to all customers. A countersigned standalone copy is available on request via support@aivachat.io.

We process the following categories of personal data only as needed to provide Aiva Chat:

We don't process sensitive special categories of data (health, religion, political views, biometric IDs) unless you've explicitly configured Aiva Chat to handle them, and only with appropriate safeguards.

We process your customers' data only on your documented instructions. The following count as your instructions:

• Configuration choices in your Aiva Chat dashboard.
• Integrations, custom actions and webhooks you configure.
• Email instructions sent to support@aivachat.io.

If we believe one of your instructions violates the law, we'll tell you immediately and stop processing pending discussion. We won't act on instructions that ask us to break GDPR, CCPA, or equivalent laws.

We use the following sub-processors. The full list, with the data each one handles, is kept at aivachat.io/sub-processors, and we notify customers 30 days in advance of any addition.

Twilio and OpenAI run on your own accounts and credentials, so you contract with them directly and their data terms apply. The same goes for integrations you connect, such as Google Calendar, HubSpot and Stripe payment links.

You can object to a new sub-processor within 30 days of notification. If we can't accommodate you, you may terminate without penalty.

We implement the following technical and organisational measures (Article 32 GDPR):

Technical

• Encryption in transit — between browsers, the widget, webhooks and our servers.
• Stored credentials encrypted — third-party keys you give us (such as Twilio credentials) are encrypted in our database.
• Authentication — bcrypt-hashed passwords and a one-time code at sign-in.
• Audit log — records what changed on your account and when.
• PII scrubbing — card numbers, SSNs, dates of birth and terms you add are removed from transcripts and summaries.
• Retention controls — you set how long recordings and transcripts are kept, and a daily job deletes older ones.
• Short-lived recording links — call recordings play back through links that expire.

Organisational

• Production access is limited to the people who run Aiva Chat.
• We hold no third-party certifications (such as SOC 2 or ISO 27001) today.

If we discover a personal data breach, we notify you without undue delay and within 72 hours of discovery. The notification will include:

• Nature and scope of the breach.
• Categories and approximate number of affected data subjects.
• Likely consequences.
• Measures taken or proposed to address the breach.

We help you fulfill your own GDPR Article 33 / 34 notification obligations, including the technical details you need for any customer-facing notice.

Customer data is stored on AWS in the United States (US East, N. Virginia), whichever country you're in. We don't offer a choice of region today.

For cross-border transfers (EU personal data stored in the US, or accessed by our Rajkot team for support), we use the Standard Contractual Clauses (SCCs) approved by the European Commission, plus supplementary technical measures.

UK customers can request the UK International Data Transfer Addendum at no extra cost.

You can audit our compliance with this DPA. Specifically:

• Request answers to your security questionnaire — usually within 5 business days.
• Request a review call and supporting documentation once a year, or after any incident that affects your data.

On termination of your Aiva Chat agreement, we will:

• Help you take your data with you: call logs, appointments, contacts and form submissions can be downloaded as CSV from the dashboard at any time, and we'll provide anything else you ask for within 30 days.
• Permanently delete all your data from our systems and sub-processors within 90 days of termination — unless you've requested otherwise.
• Provide written confirmation that deletion is complete.

Backup copies age out on the normal backup cycle. After that, no individual data remains.

Email support@aivachat.io for any DPA, GDPR, or compliance question.