Data Processing Agreement

1. Parties and conclusion of this Agreement

This Data Processing Agreement ("DPA") is concluded between the person or business that registers an account for reactive.chat and uses it to process personal data of others (the "Customer") and LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP/VAT ID PL7252266190, e-mail contact@lukaswojcik.com (the "Operator").

The Customer is the controller and the Operator is the processor within the meaning of Article 4 of Regulation (EU) 2016/679 ("GDPR") for the personal data described in Annex A.

This DPA is concluded at registration: the registration form contains a checkbox, not pre-ticked, by which the Customer accepts the Terms of Service and this DPA. The Operator stores evidence of that acceptance (time, the version of the text by its checksum, IP address and browser identification). No signature is required. On request sent to contact@lukaswojcik.com the Operator provides this DPA as a signed PDF.

Users whom the Customer invites into its workspace act for the Customer; they do not conclude a separate DPA.

2. Definitions

• "Service" means reactive.chat as described in the Terms of Service, in particular: the live-chat widget on the Customer's website; the agent dashboard ("desk") and the live console; the AI assistant (default name "Ada") and the AI tools for agents (reply drafts, summaries, rewording, translation); Smart Answer (AI answers in the Customer's website search); the knowledge base and its sources; file attachments; order and customer data from the Customer's shop; bot actions; channels (e-mail, WhatsApp, Messenger, Instagram, Telegram, SMS) and campaigns; callback requests, voice and video calls and co-browsing; routing, quality evaluation (AutoQA), service targets and reports; the customer portal; the API, webhooks and the MCP interface; and the optional integrations – each as far as the Customer uses it.
• "Visitor" means a natural person who uses the widget, Smart Answer or the customer portal on the Customer's website, or who contacts the Customer through a channel the Customer has connected or is reached by a campaign of the Customer.
• "User" means a person who has access to the Customer's account in the roles owner, admin, member (agent) or viewer.
• "Customer Data" means all personal data that the Operator processes on behalf of the Customer under this DPA, in particular the data listed in Annex A.
• "Sub-processor" means a further processor engaged by the Operator to process Customer Data.
• "TOMs" means the technical and organisational measures published at /p/technical-and-organisational-measures.
• "AI nodes" means the machines of the Operator on which the language models of the Service run.

Terms defined in the GDPR have the meaning given there.

3. Subject matter, duration, nature and purpose

Subject matter. The Operator provides the Service to the Customer and processes Customer Data to the extent necessary for that purpose.

Duration. This DPA applies for as long as the Operator processes Customer Data for the Customer, that is from registration until all Customer Data has been deleted in accordance with clause 11. The end of a paid subscription does not end this DPA: the workspace then continues on the free plan with its data.

Nature of the processing. Collection, recording, storage, organisation, retrieval, display, transmission, scrubbing of identifiers, analysis by automated filters and rules, generation of AI answers, machine translation, summarisation, embedding of the knowledge base for search, export, anonymisation and deletion of Customer Data by means of the Service, and making backups of it.

Purpose. Enabling conversations between Visitors and the Customer's agents and/or the AI assistant over the widget and the connected channels; storing and organising conversations; answering Visitors from the knowledge base that the Customer builds; supporting agents with drafts, summaries and translations; showing agents the context the Customer enables (page, order data, data from integrations); callbacks and calls; campaigns the Customer sends; evaluation of conversations and reports for the Customer; recording which User opened which conversation (read log, Agency plan); delivering data to the channels and integrations the Customer switches on; protecting the Service and the Customer against abuse.

AI processing. The AI assistant generates answers from the knowledge base that the Customer supplies (a crawl of the Customer's own website, uploaded documents, files from connected sources, product feeds) and, where the knowledge base contains nothing suitable, may answer from the general knowledge of the language model. The Customer decides what goes into the knowledge base, whether the assistant is used at all and under which name. The language models of the Operator's own AI (a chat model, a second chat model as reserve and for projects on the free plan, and an embedding model) are openly licensed and self-hosted: they run on the Operator's AI nodes in its premises in Łódź, Poland, in the same local network as the server. Only nodes entered in the Operator's register receive AI jobs; no third-party AI service is used, not even as a fallback. The AI tools for agents use the same models; they run when an agent calls them up or has switched on automatic translation, and their results reach a Visitor only when an agent sends them. If the Customer connects its own AI node, AI requests of the Customer's projects go to that node according to the Customer's setting; the node and the model running on it are the Customer's own processors. Customer Data is not used to train or fine-tune any model. Individual requests may be used internally by the Operator to compare model versions before an update; they are not used for training and are not passed on.

Instruction. AI generation, the AI tools for agents, the read log, quality evaluation, and every channel, integration or own AI node that the Customer switches on are processing on the documented instruction of the Customer within the meaning of Article 28(3)(a) GDPR.

4. Types of data and categories of data subjects

The types of personal data and the categories of data subjects are set out in Annex A. The Customer decides which optional details (name, e-mail, user identifier, custom fields) it passes to the Service, which content it places in the knowledge base and which functions it uses. The Customer shall not transmit special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) unless this is necessary for the Customer's purposes and the Customer has ensured a legal basis. The Service is not designed for such data; the scrubbing described in the TOMs does not recognise it.

5. Instructions

The Operator processes Customer Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Operator is subject. In that case the Operator informs the Customer of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms of Service, this DPA and the settings the Customer chooses in the dashboard (including the projects and their privacy settings, the retention period, the AI assistant, the knowledge base, channels, integrations, campaigns and the rights of Users) constitute the Customer's instructions. Each change of a setting is a new instruction. Further instructions must be given by an owner or admin in text form to contact@lukaswojcik.com. Instructions that go beyond the functions of the Service may be refused or charged separately at a rate agreed in advance.

The Operator informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection provisions, and may suspend carrying it out until the Customer confirms or changes it.

6. Confidentiality and access by the Operator

The Operator ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The Service is run by the owner of the Operator personally; further persons are given access only where necessary and only after such a commitment.

The Operator does not review conversations editorially and applies only automated filters (scrubbing of identifiers, spam and abuse detection, checks of AI answers). The Operator accesses Customer Data in readable form only where necessary to operate and secure the Service, to handle a support request of the Customer, to handle a personal data breach or abuse, or to comply with a legal obligation, and only to the extent necessary for that purpose.

7. Security of processing

The Operator implements the technical and organisational measures described in the TOMs, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing and the risks for data subjects, as required by Article 32 GDPR. The TOMs form Annex B of this DPA. They also state the limits of the measures (among others: no encryption of the server's storage at disk level, no malware scan of attachments, no separation of duties in a one-person operation), so that the Customer can assess their adequacy.

The Operator may update the TOMs as technology develops, provided that the overall level of protection is not reduced. The current version is published at the address given in clause 2. The risks that remain are assessed in the Operator's data protection impact assessment; the processing operations are recorded in its records of processing activities. Both are made available to the Customer on request.

8. Sub-processors

The Customer gives general authorisation to the engagement of the Sub-processors listed in section 2 of /p/sub-processors. That list forms part of this DPA. It states for each Sub-processor the entity, the purpose, the data concerned, the place of processing, the safeguard for any transfer and since when it is used. At the time of this version they are Google Cloud EMEA Limited (encrypted backup copy, Warsaw) and Namecheap, Inc. (DNS and e-mail, USA).

The Operator informs the Customer of any intended addition or replacement of a Sub-processor at least 30 days before the change takes effect, by notice on the sub-processors page and by e-mail to the e-mail address of the account owner. The Customer may object to the change on reasonable data-protection grounds within that period by e-mail to contact@lukaswojcik.com. If the parties cannot find a solution, the Customer may terminate the contract for the Service with effect from the date the change takes effect.

The Operator imposes on each Sub-processor, by way of a contract, data-protection obligations that correspond to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor fails to fulfil its obligations, the Operator remains fully liable to the Customer for the performance of that Sub-processor's obligations.

Not Sub-processors. The following are not Sub-processors; the reasons are given on the sub-processors page: providers the Operator uses for its own purposes as controller (Stripe for payments, Google reCAPTCHA on the account and support forms); the Operator's own server and AI nodes; the network operator; the push services of browser manufacturers, which receive encrypted content (kind of event, project name and identifiers) and, unencrypted, only a conversation identifier; Telegram as recipient of the Operator's own notifications, which contain no personal data; Let's Encrypt, which receives domain names only; MousePlayer and Answely (which answers Smart Answer requests), which are operated by the same legal entity. The channels and integrations that the Customer switches on with its own accounts and credentials (for example WhatsApp, Messenger and Instagram directly with Meta, Telegram through the Customer's own bot, SMS with the Customer's Twilio account, e-mail through the Customer's mailbox, Slack, HubSpot, Zendesk, Shopify, webhooks), the Customer's Cal.com and Stripe accounts and own endpoints used for bot actions, Google Drive connected with the Customer's Google account, the Customer's identity provider, the AI tools the Customer connects to the MCP server and the Customer's own AI node are the Customer's own recipients or processors.

9. Assistance to the Controller

Data-subject rights. Taking into account the nature of the processing, the Operator assists the Customer by appropriate technical and organisational measures in fulfilling the Customer's obligation to respond to requests under Articles 15 to 22 GDPR. The Service provides in particular:

• search of conversations and Visitors in the desk;
• an export per project in the dashboard, as JSON or as a ZIP archive of CSV files including attachments (up to 2 GiB), and a personal export for each User;
• deletion by the Visitor in the widget ("Your data", "Delete everything"), withdrawal of consent and the handling of a written deletion request in the chat, each processed by the server within a few minutes, either as deletion or as anonymisation according to the Customer's setting;
• a retention period per project, set by the Customer (clause 11);
• deletion of the workspace and of User accounts in the dashboard.

Measures the Customer cannot take itself in the dashboard (for example the deletion of an individual conversation, of a project or of a single Visitor's data on the Customer's request, or an export of knowledge-base original files and of the names and e-mail addresses of the team) are carried out by the Operator on request of an owner or admin in text form, without undue delay.

Visitors exercise their rights towards the Customer. If the Operator receives a request directly from a Visitor, it forwards the request to the Customer without undue delay and does not respond on the merits unless the Customer instructs it to; it may tell the Visitor which Customer it has forwarded the request to. Details are published at /p/access-and-deletion.

Articles 32 to 36. The Operator assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, notification of breaches, data-protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to the Operator, in particular by the TOMs, the Data Protection Impact Assessment and the Records of Processing Activities it publishes.

Assistance that goes beyond the functions of the Service and the information already published may be charged at a reasonable rate agreed in advance, unless it is required because of a breach of this DPA by the Operator.

10. Personal data breaches

The Operator notifies the Customer of a personal data breach concerning Customer Data without undue delay and at the latest within 48 hours of becoming aware of it, so that the Customer can meet its own 72-hour deadline under Article 33 GDPR. The notification is sent by e-mail to the e-mail address of the account owner and contains, as far as known at that time, the information listed in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point. Information that is not yet available is provided in phases without undue further delay.

A breach in this sense is also the loss or unauthorised alteration of Customer Data, not only its disclosure. The Operator documents every breach and every assessment, takes measures to contain it and supports the Customer in its notification to the supervisory authority and, where applicable, to the data subjects. The Operator does not notify the supervisory authority or data subjects on the Customer's behalf without the Customer's instruction, unless the law requires the Operator to do so.

11. Retention, deletion and return of Customer Data

During the term. The Customer sets a retention period for conversations per project (0 to 3,650 days; 0 means no limit) and chooses whether expired conversations are deleted or anonymised. No period is preset: unless the Customer sets one, conversations are kept until the project or workspace is deleted. Other data has periods set by the Service; where there is none, Annex A.6 says so. The Customer can export its data at any time as described in clause 9 and on the Data Act page.

End of a subscription. When a paid subscription ends, the workspace returns to the free plan. No data is deleted; the free plan's limits apply from then on (for example to file attachments, which are deleted after 7 days on the free plan).

Deletion on request. The contract for the Service, and with it this DPA, ends when the Customer deletes its workspace or its account, or terminates the contract and asks for deletion. A deletion started in the dashboard takes effect after a grace period of 30 days, during which it can be reversed; after that the deletion run removes the workspace with its projects, conversations, Visitor data, attachments, knowledge-base files and settings. A deletion requested by e-mail is carried out in the same way. As long as a paid subscription is running for a workspace, its deletion is refused and the deletion run does not delete it; the Customer must cancel the subscription first.

What the automated deletion currently leaves. The Operator states the following so that it is not hidden: since 16 October 2026 the deletion run also removes the records of Visitors' consent decisions (including IP address and browser identification), together with the project or workspace, and the company logo file, together with the workspace. A line recording that the workspace was deleted, without content, remains in the log. Invoices and payment records are the Operator's own records as controller and are retained as required by tax law; they contain the Customer's billing data, never Visitor data.

Backups. Customer Data is contained in the backups described in the TOMs and leaves them only when they expire: off-site, encrypted, daily copies after 7 days and weekly copies after at most 364 days; locally, unencrypted, after about 8 days (server copy) and 30 days (database dump). Deleted data is therefore removed from all backups at the latest 364 days after its deletion from the live system. Selective deletion inside a backup is not performed. Backups are used only to restore the Service after a loss. If a backup has to be restored, the Operator will re-apply the deletions carried out after the date of the copy before the Service returns to normal operation.

Return. Return of Customer Data takes place by the export the Customer makes itself before deletion. On request made before the deletion takes effect, the Operator additionally provides the parts that the dashboard export does not contain (clause 9).

Legal retention. Where Union or Member State law requires the Operator to store Customer Data, the Operator restricts its processing to that purpose and deletes it when the obligation ends.

12. Audits and information

The Operator makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and the obligations of this DPA. In the first instance it does so by means of the TOMs, the sub-processors page, the Records of Processing Activities, the Data Protection Impact Assessment, the Privacy Policy and written answers to reasonable questions.

The Customer, or an independent auditor mandated by the Customer and bound to confidentiality, may carry out an audit, including an inspection, where the information provided is not sufficient to demonstrate compliance, where a supervisory authority requires it, or after a personal data breach concerning Customer Data. Audits are announced at least 30 days in advance in text form (after a breach: 7 days), take place at most once per calendar year (an audit after a breach does not count), during normal business hours, without disturbing the operation of the Service and without access to data of other customers, and are limited to the systems used to process Customer Data. Each party bears its own costs; the Operator may charge a reasonable fee agreed in advance for effort exceeding one working day, unless the audit reveals a material breach of this DPA by the Operator. The powers of the supervisory authorities remain unaffected.

13. Obligations of the Customer

The Customer is responsible for the lawfulness of the processing, in particular for a legal basis for the collection of Visitor data, for informing Visitors under Articles 13 and 14 GDPR (the Operator provides a text module for the Customer's privacy policy), for choosing the consent level of each project and for connecting the widget to the Customer's consent management platform where storage in the Visitor's browser requires consent, for setting a retention period appropriate to its purposes, and for responding to data-subject requests.

The Customer is solely responsible for the content of the knowledge base: its accuracy, lawfulness, intellectual-property rights and the decision what to include. AI answers are generated from this content and may be inaccurate. The Customer must review the behaviour of the AI assistant before and during use and may switch it off at any time. The Customer must not remove or obscure the notice and the badge that identify the assistant and its messages as AI (Article 50 of Regulation (EU) 2024/1689; see the AI Act page), even though the texts of the widget can technically be changed.

The Customer is responsible for campaigns it sends, in particular for the consent of recipients and for the proof of the opt-in it states when importing WhatsApp contacts, and for the legal basis of calls and co-browsing sessions it conducts. For Visitors from the GDPR area (EU, EEA, United Kingdom, Switzerland) and where the country is unknown, the Service shows campaigns, the full line of the live visitor list and invitations from it only with the Visitor's consent; for other Visitors the Customer's consent level applies, and the Customer remains responsible for the legal basis. The Customer must not use the Service to accept or assess job applications or to evaluate Team Members with AI output (AI Act page, sections 6.3 and 6.5). File attachments are not scanned for malware; the Customer instructs its agents to handle them with care.

The Customer keeps its credentials and those of connected channels and integrations confidential, assigns roles (owner, admin, member, viewer) according to need, considers enabling two-factor authentication for its Users, registers the domains of its websites for each project, and removes access that is no longer required. When the Customer uses the /ban command, the block of the IP address (for IPv6 the whole /64 network) applies to the real-time server as a whole; the Customer uses it only against actual abuse.

14. International transfers

The Operator processes Customer Data on its own server and AI nodes in Poland. Transfers to third countries by the Operator take place only where stated in section 2 of the sub-processors page and only on the basis of Chapter V GDPR: e-mail through Namecheap, Inc. (USA) on the basis of the standard contractual clauses of the European Commission; possible access by Google from outside the EEA to the encrypted backup copy on the basis of the standard contractual clauses contained in the Google Cloud Data Processing Addendum. The metadata that push services of browser manufacturers in the USA receive when an agent subscribes to push notifications are described on the sub-processors page; the content of those notifications is encrypted, apart from a conversation identifier. Notifications to Telegram FZ-LLC (Dubai) contain no personal data.

Where the Customer switches on a channel, integration or own AI node whose provider is located outside the EEA, the resulting transfer is made on the Customer's instruction to the Customer's own provider and is the Customer's responsibility.

15. Liability

The parties are liable in accordance with Article 82 GDPR. Between the parties, liability is governed by the Terms of Service, which apply to this DPA. Each party is liable for damage caused by its own breach of this DPA or the GDPR.

The Operator's responsibility for AI-generated messages covers the selection, configuration and operation of the language models only. The Operator does not warrant that AI answers are accurate, complete or fit for a purpose. The Operator is not a party to the conversations conducted through the Service: messages from agents to Visitors are statements of the Customer, messages from Visitors to agents are statements of the Visitor. The Operator does not review them editorially. Illegal content can be reported to contact@lukaswojcik.com.

16. Term and termination

This DPA enters into force on registration and ends when the Operator no longer processes Customer Data for the Customer, that is when all Customer Data has been deleted in accordance with clause 11, including its expiry from backups. Clauses 6, 10, 11, 12, 15 and 17 survive termination to the extent required by their purpose.

17. Precedence, governing law and final provisions

In case of conflict, this DPA prevails over the Terms of Service with regard to the processing of Customer Data. The mandatory provisions of the GDPR prevail over this DPA.

Contact point for data protection under this DPA: contact@lukaswojcik.com.

This DPA is drawn up in English. Translations into German (/de/p/auftragsverarbeitungsvertrag) and Polish (/pl/p/umowa-powierzenia-przetwarzania) are provided for convenience; the English version prevails.

This DPA is governed by Polish law. The courts of Łódź, Poland, have jurisdiction, unless mandatory law provides otherwise. Should a provision be invalid, the remaining provisions remain unaffected.

The complaints procedure is described at /p/complaints. The Operator's details are in the Imprint.

18. Amendments

The Operator may amend this DPA, the TOMs and the sub-processors page where the Service, the law or the infrastructure changes. Changes to Sub-processors follow clause 8. Other changes that affect the Customer adversely are notified by e-mail to the account owner or by notice in the dashboard at least 30 days before they take effect; the Customer may object within that period in text form, and if the parties cannot agree, the Customer may terminate the contract for the Service with effect from the date the change takes effect. Changes required by law or that only improve the protection of Customer Data can take effect at once. Each version is published with its date; the changes are listed in the changelog.

Annex A – Details of processing

A.1 Categories of data subjects

• Visitors of the Customer's websites who use the widget, Smart Answer or the customer portal.
• Persons who contact the Customer through a connected channel (e-mail, WhatsApp, Messenger, Instagram, Telegram, SMS) or who are contacted by a campaign of the Customer.
• Persons who ask for a callback or take part in a call or co-browsing session.
• End customers of the Customer whose order or customer data the Customer makes available to the Service.
• Users of the Customer's account (owners, admins, members/agents, viewers), as far as their data appears in conversations, assignments, notes, the audit log, the read log, quality evaluations, call logs and push subscriptions.
• Persons whose data is contained in the knowledge base or in data the Customer imports from a former provider.

A.2 Types of personal data

• Conversations: messages (after scrubbing), attachments, time stamps, status, assignment, tags, quick-reply and button choices, form replies, ratings and comments (CSAT), the reason for a handover, internal notes of agents.
• Visitor profile: random visitor and session identifiers; details the Customer passes or the Visitor enters (name, e-mail address, telephone number, user identifier, custom fields); where enabled a user identifier verified with an HMAC hash; "do not disturb" status; first and last visit.
• Technical session data: browser identification, language, country (derived from the IP address on the server, without storing the IP address in the conversation), referrer and campaign parameters, page address and title, recently visited pages of the session, page text of the visited page where the Customer enables it.
• IP addresses: used during the connection for setup, country derivation and abuse protection; stored in full in the record of the Visitor's consent decision, in temporary blocks and the security log of the real-time server, in the web server's access logs and the system journal and, for Users, in the sign-in log and session list; stored shortened (IPv4 without the last octet, IPv6 to the /48 network) in Smart Answer's counter.
• Consent records of Visitors: decision, level, language, text shown and its checksum, address of the privacy notice shown, IP address, browser identification, time.
• File attachments: the file, its name, type and size, upload time, checksum, a preview, a text extract (PDF, text, CSV) and recognised text (OCR).
• AI processing: the job record with instruction and conversation text, sources used and results of the checks (AI log, without text), translations of messages and, for replies sent in translation, the agent's original wording; texts processed for drafts, summaries and rewording; quality evaluations of conversations, with a reference to the agent where the evaluation per agent is switched on and, only for conversations without the participation of an agent, an AI rationale.
• Channels and campaigns: telephone numbers, chat and profile identifiers, display names, e-mail addresses, subjects and message references, message numbers of the channels; for WhatsApp campaigns contact, labels, language, evidence of opt-in, opt-out and delivery and reading times and, after an opt-out followed by a deletion request, a blocking note (keyed hash of the number); for campaigns in the widget hashed visitor identifiers in counters, repetition locks and a returning-visitor marker.
• Callbacks and calls: telephone number and country of the Visitor, preferred time, note, assigned agent; call log (agent, times, media); telephone numbers of agents.
• Order and customer data that the Customer enables for its signed-in end customers (order number, date and status, total and currency, items and quantity, carrier, tracking number and shipping status, invoice number, payment status and due date; city and postcode of the delivery address only if expressly enabled): when fetched, used only for the respective answer; when imported, stored encrypted.
• Bot actions: the request, the confirmation of the Visitor and the result of actions the Customer configures (for example order status, appointment booking).
• Routing: topic labels, urgency and mood value of a conversation (word lists and, where switched on, the model's estimate from the first Visitor message), held in the working copy of the conversation; labels assigned are added to the conversation's tags and remain stored with it like other tags.
• Live visitor list: per website a snapshot of the Visitors currently present (identifier, times and, where permitted, page without parameters, referring host, campaign parameters, device family, country, language, returning visitor), held in memory and renewed at most every 90 seconds.
• Guided flows, test runs and versions: answers of Visitors to the questions of a flow, as messages; test questions, including questions adopted from knowledge gaps after scrubbing, and results of test runs; versions of the bot settings and of guided flows with the User who saved them.
• Identity: an e-mail address of the Visitor signed by the Customer's website, used for appointment bookings.
• Smart Answer: the question, the page address and the referring page without parameters and anchors, the language and where applicable the visitor identifier; depending on the Customer's setting processed only for the answer or stored as a conversation; a counter entry per request (time, shortened IP address, website identifier, length, result).
• Customer portal: cases of the Customer's end customers and their contributions.
• Error reports and frustration signals: page path, browser, operating system, error stack, aggregated counts per page and day, and a link to a session recording only where the Visitor has consented to recording.
• Statistics and tests: aggregated counters; for A/B tests and campaigns visitor identifiers in a form that allows counting but not reading back (HyperLogLog).
• Users: name, e-mail address, role, project scope, sign-in history with IP address and browser identification, sessions and devices, push subscriptions, single sign-on identity, read log (Agency plan: who opened which conversation, when and by which route, without IP address and content), actions in the audit log.
• Knowledge base: content supplied by the Customer (crawl of its website, documents, connected sources, product feeds, corrections).
• Knowledge-base files and Google Drive: files uploaded by the Customer (PDF, DOCX, text, Markdown, CSV, HTML) and the text extracted from them; for Google Drive the encrypted access token, the e-mail address of the connected Google account and the text of the selected files, not the files themselves.
• Security and administration of the account: audit-log entries, including sign-ins through single sign-on and calls of MCP tools, with the IP address of the caller; the single sign-on link (issuer, identifier, first and last sign-in); pseudonyms of agents in evaluations.
• Data exchanged with channels and integrations switched on by the Customer, to the extent the Customer instructs.

A.3 Special categories of data

None intended. The Customer decides whether such data may be entered by Visitors or placed in the knowledge base and bears responsibility for it (clause 4).

A.4 Processing operations

Collection through the widget, Smart Answer, the customer portal and connected channels; storage; scrubbing of identifiers before storage; checking file attachments against their declared type and extracting their text; display to agents; spam and abuse detection; AI answer generation, embedding and search of the knowledge base on the Operator's AI nodes; drafts, summaries, rewording and translation for agents on the same nodes or a node the Customer has connected, after additional replacement of e-mail addresses, telephone numbers and digit sequences of six or more digits for drafts, summaries and rewording; quality evaluation; routing; sending campaigns; callbacks and calls; delivering data to channels and integrations switched on by the Customer; recording the read log (Agency plan) and the audit log; export; anonymisation and deletion; backups.

A.5 Location of processing

Poland (EU): the Operator's server and AI nodes in Łódź; the encrypted backup copy in Warsaw (Google Cloud Storage). E-mail: USA (Namecheap). Further transfers only as stated in clause 14.

A.6 Retention

• Conversations with their messages, tags, AI job records, AI log, read log and evaluations: according to the retention period the Customer sets per project; none preset, in that case until deletion of the project or workspace. Visitor profiles are deleted once no conversation of the Visitor remains.
• Deletion by the Visitor: processed within a few minutes, as deletion or anonymisation according to the Customer's setting.
• File attachments: 7 days (free plan) or 90 days (paid plans) after upload, or the period agreed in an individual contract; earlier together with their conversation, project or workspace.
• Imported order data: 90 days; fetched order data: only for the answer (about 30 seconds in the cache).
• AI job records without a conversation: 30 days; confidential jobs (order data, bot actions, simulations, routing classification, AI verdict of quality assurance, drafts, summaries, rewording and translations for agents) are emptied when the result has been delivered, otherwise after about ten minutes.
• Conversation cache of the real-time server (recent messages, details given by the Visitor, visited pages): 30 days after the last activity; session data 30 minutes after the last activity; visitor proof token 400 days after the last use.
• Smart Answer: counter entries 7 days; questions not beyond the answer if storing is off; otherwise like conversations, and generated answers (the question only as a hash) are additionally cached for 24 hours.
• Translations: like the message they belong to.
• Read log: 731 days at most.
• Audit log: as chosen by the Customer (90, 180, 365 or 730 days, or until deletion of the workspace, which is the default); entries without workspace: sign-ins, failed sign-ins (also without an existing account) and IP blocks 90 days, other entries of an account until deletion of the account.
• Callback requests: 30 days after completion, open requests 90 days; call log 365 days.
• Frustration statistics: 400 days; error reports 90 days, examples 30 days.
• Counters of A/B tests: 200 to 400 days. Campaign counters per Visitor: until one day after the end of the campaign or 90 days after the last contact; reach counters up to 400 days. WhatsApp campaign deliveries: 90 days after the last status. Message numbers of channels: 7 days.
• Live visitor list: renewed at most every 90 seconds, not stored beyond that. Knowledge-base files and texts from Google Drive: until deleted by the Customer or Drive is disconnected, at the latest with the project. Versions of guided flows: the latest 100 per project; versions of bot settings: until deletion of the project.
• Channel identities, e-mail threads, campaign contacts, knowledge base and page texts, customer portal cases, consent records of Visitors: until deletion of the project or workspace.
• Web server access logs: at most 15 days. System journal (also with IP addresses from the real-time server): limited only by size, no time limit.
• E-mails of the Service stored on the server instead of being delivered: 30 days. Logs of background processes: currently no automatic deletion (TOMs section 4.2).
• Backups: see clause 11 (at most 364 days).

Annex B – Technical and organisational measures

The TOMs published at /p/technical-and-organisational-measures, in the version current at the time of processing, form Annex B of this DPA. The Customer confirms that it has reviewed them and considers them appropriate for the Customer Data it entrusts to the Operator.

Annex C – Sub-processors

The list in section 2 of /p/sub-processors, in the version current at the time of processing, forms Annex C of this DPA.

Version 2.0 replaces version 1.4 of 7 October 2026. Changed: conclusion by checkbox with stored evidence; definitions extended to all functions; AI processing with named models, register of nodes, own AI node of the Customer, no training, internal comparison of model versions; Google Cloud Storage named as sub-processor and Stripe and reCAPTCHA reclassified; deletion now on request with a 30-day grace period instead of "within 30 days after the end of the contract", end of a subscription returns to the free plan; backups up to 364 days instead of 30 days, re-application of deletions after a restore; retention period of conversations set by the Customer, none preset; known exceptions of the automated deletion stated; Annex A completed with channels, campaigns, calls, order data, consent records and IP addresses; audits after a breach, amendments procedure (clause 18), Annex C.

Version 2.1 replaces version 2.0 of 11 October 2026. Changed: recipients that are not Sub-processors completed with Telegram through the Customer's bot, the Customer's Cal.com and Stripe accounts, Google Drive and AI tools connected through MCP (clause 8); obligations of the Customer for WhatsApp opt-ins, the consent requirement for Visitors from the GDPR area and the excluded use for applications and the evaluation of Team Members (clause 13); Annex A completed with routing, live visitor list, guided flows, test runs and versions, signed e-mail address, knowledge-base files and Google Drive, single sign-on, audit log and pseudonyms, and with the new periods for campaigns and channels.

Version 2.2 replaces version 2.1 of 11 October 2026. Corrected: push services receive identifiers and, unencrypted, a conversation identifier; Answely as a service of the same legal entity (8, 14); /ban per /64 network for IPv6 (13); system journal, routing labels as tags (A.2); periods without automatic deletion stated: audit-log entries without an account, system journal, logs of background processes; e-mails stored instead of delivered (11, A.6); Smart Answer answer cache and confidential jobs of the AI tools for agents (A.6).

Version 2.3 replaces version 2.2 of 12 October 2026. Corrected: chat models of the Operator's own AI, with a reserve model that also serves the free plan (3); Smart Answer counter with a shortened IP address (A.2); periods and deletion paths of 16 October 2026: no workspace deletion while a paid subscription is running, consent records and logo file removed by the deletion run (11); audit-log entries without a workspace after 90 days, consent records with the project or workspace (A.6).

Version 2.4 replaces version 2.3 of 16 October 2026. Changed: the AI is described uniformly as the Operator's own, self-hosted AI; model names removed, the facts are unchanged (3).

Version 2.5 replaces version 2.4 of 17 October 2026. Changed: the data protection impact assessment and the records of processing activities are made available on request instead of being published (7). The obligations of the parties are unchanged.

Version 2.5 – effective 19 October 2026.