AboutContactPrivacyTerms

LEGAL

Data Processing
Agreement

For business customers using Clipaist Agent to process their own customers’ personal data. Last updated November 3, 2026.

Security & Trust Center · Privacy Policy · Terms of Service

QUICK SUMMARY

You control the business knowledge and customer data. Clipaist processes it on your instructions, uses listed subprocessors, protects it with the measures in Annex B, and helps you respond to data-subject requests and breaches. A signed copy is available on request.

1. Parties and scope

  • This Data Processing Agreement (“DPA”) applies when a business customer (“Customer”, “you”) uses Clipaist Agent to process personal data about its own customers, visitors, leads or other individuals (“Personal Data”). It forms part of the Clipaist Terms of Service.
  • The Customer is normally the controller of that Personal Data. Clipaist (“Clipaist”, “we”, “us”) acts as a processor and processes Personal Data only on the Customer’s documented instructions, as described in the Terms, this DPA and the Customer’s configuration of the service.
  • For account, login, billing and website-visitor data that Clipaist collects for its own purposes, Clipaist is the controller and the Privacy Policy applies. This DPA does not make Clipaist the controller of the Customer’s end-customer conversations or leads.
  • If there is a conflict between this DPA and the Terms about the processing of Personal Data, this DPA prevails for that processing.

2. Customer instructions

  • The Customer instructs Clipaist to process Personal Data to provide the Agent: crawl and index the website and knowledge the Customer supplies, answer customer messages, capture leads, create handoffs, send notifications, provide support, secure the service and perform the other actions the Customer configures.
  • The Customer is responsible for the lawfulness of its instructions, its website content, its notices, its lead capture and any messages it sends. The Customer must have a lawful basis and provide any required privacy notice or consent to its end customers.
  • The Customer must not instruct Clipaist to process special-category data, children’s data or other highly sensitive data unless it has a lawful basis and appropriate safeguards. The Agent is a customer-service assistant, not a records system for clinical, legal, financial, biometric or government-ID data.
  • Clipaist will tell the Customer if an instruction appears to violate applicable data-protection law, unless the law prohibits us from doing so.

3. Confidentiality and personnel

  • Clipaist restricts access to Personal Data to personnel and contractors who need it to provide, secure or support the service. They are bound by confidentiality obligations and receive access on a least-privilege basis.
  • The owner admin panel requires email, password and a fresh email one-time code on every login. Customer workspace access is scoped to the Customer’s account and the roles the Customer enables.

4. Security measures

  • Clipaist implements the technical and organisational measures summarised in Annex B, including TLS, access controls, salted password hashing, tenant-scoped queries, rate limits, private media storage and provider review.
  • The Customer is responsible for its own account security: strong unique passwords, protecting its email account, limiting team access and reviewing the knowledge and instructions it gives the Agent. Security is a shared responsibility.
  • Clipaist may update its measures as the service develops, provided the overall level of protection does not materially decrease.

5. Subprocessors

  • The Customer authorises Clipaist to use the subprocessors listed in Annex C and on the Security & Trust Center page. They provide hosting, AI inference, messaging, email, payment and storage services.
  • Clipaist will give the Customer reasonable notice of a new subprocessor that processes Personal Data in a materially different way. The Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may stop using the affected feature or terminate the affected service.
  • Clipaist remains responsible for its subprocessors’ performance of data-protection obligations to the same extent as if Clipaist performed the processing itself, as required by applicable law.

6. Data subject requests

  • If an end customer asks the Customer to access, correct, delete, export or restrict their Personal Data, the Customer should use the dashboard controls (conversation deletion, lead deletion, export) or contact Clipaist.
  • Taking into account the nature of the processing, Clipaist will provide reasonable assistance so the Customer can respond. Clipaist will not respond to an end-customer request as controller unless the Customer asks us to or the law requires it.
  • The Customer is responsible for verifying the identity and authority of the person making the request.

7. Personal data breach

  • Clipaist will notify the Customer without undue delay after confirming a personal-data breach affecting the Customer’s Personal Data, and within 72 hours where feasible. The notice will describe what happened, the likely consequences, the measures taken and a contact point.
  • Clipaist will take reasonable steps to contain, investigate and remediate the breach. The Customer is responsible for its own notifications to individuals and regulators, taking into account the information Clipaist provides.
  • The Customer should report suspected incidents immediately to [email protected] with “Security” in the subject.

8. International transfers

  • Clipaist and its providers may process Personal Data in the United States, the European Union and other countries. Where law requires transfer safeguards, Clipaist will use an appropriate mechanism such as the Standard Contractual Clauses, the UK Addendum or another lawful transfer tool.
  • The Customer may request the current transfer mechanism and subprocessor details by emailing [email protected] with “DPA” in the subject.

9. Return and deletion

  • On termination, the Customer may export leads and other data using the dashboard where available. Clipaist will delete or anonymize the Customer’s Personal Data within 30 days after termination, unless law requires retention or the parties agree otherwise.
  • Residual copies may remain in backups and logs for a limited period, typically no more than 90 days, and will be deleted on the normal backup cycle. Backups are not used to provide the service.
  • Chat transcripts follow the workspace retention setting during the account term; deleting a conversation or agent does not automatically delete separate leads unless the Customer does so.

10. Audit and information

  • Clipaist will provide the information reasonably needed to demonstrate compliance with this DPA, such as security documentation, subprocessor details and answers to a written security questionnaire.
  • If a regulator or law requires an audit, Clipaist will allow a remote or on-site audit on reasonable notice, during business hours and subject to confidentiality. On-site audits are at the Customer’s cost unless the audit finds a material breach by Clipaist.
  • Audits must not compromise the security or confidentiality of other customers’ data.

11. Liability and term

  • Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, to the extent permitted by law. Nothing in this DPA limits a mandatory data-protection right or a party’s liability for fraud, wilful misconduct or gross negligence.
  • This DPA applies while Clipaist processes Personal Data for the Customer and survives termination for as long as Clipaist retains Personal Data. It is governed by the laws stated in the Terms, subject to mandatory data-protection law.
  • A signed or counter-signed copy is available on request. Using the Agent after accepting the Terms constitutes acceptance of this DPA for the processing described above.

12. Contact

  • DPA, privacy, security and subprocessor questions: [email protected]. Put “DPA” or “Security” in the subject. See the Security & Trust Center for the current controls and subprocessor list.
  • This DPA is a practical template for the Clipaist Agent service. For a negotiated enterprise agreement, contact us before processing regulated or high-volume personal data.

Annex A — Processing details

Data subjectsThe Customer’s website visitors, social-message senders, leads, customers and any other individuals the Customer chooses to include.
Categories of dataNames, email addresses, phone numbers, message content, approximate technical data, conversation metadata, lead notes and the business knowledge the Customer uploads. Special-category data is not intended.
PurposeAnswering customer questions, capturing leads, creating handoffs, sending notifications, providing support, securing the service and related actions configured by the Customer.
DurationFor the account term and the retention periods described in the Privacy Policy and the workspace settings.

Annex B — Security measures

  • TLS for data in transit; Cloudflare D1 and R2 encryption at rest.
  • Salted password hashing; no plain-text passwords; admin email OTP on every login.
  • Tenant-scoped database queries and per-agent public widget keys.
  • Least-privilege access; secrets remain server-side; no provider tokens in browser bundles.
  • Rate limits, Turnstile where enabled, website origin allowlists and per-IP media caps.
  • Private media storage with a 30-day lifecycle rule; error logs with redaction and restricted access.
  • Provider review and contractual confidentiality; subprocessor list published on the Security page.

Annex C — Subprocessors

CloudflareHosting, CDN, security, D1, R2, email routing
AI inference providersAnswer and media generation
ZernioSocial account connection, messages and publishing
Meta / Instagram / MessengerConnected social messages and permissions
Telegram / SlackConnected channel messages and delivery
ResendVerification, reset, lead and handoff emails
PaddleMerchant of record: payments, tax, receipts and refunds
SupabaseTemporary reference-image storage

Need a signed copy or an enterprise DPA? Email [email protected] with “DPA” in the subject.