Data Processing Agreement

This Data Processing Agreement ("DPA") applies when BotBeaver LLC processes personal data on behalf of a business customer in connection with BotBeaver services. It supplements the Terms and Privacy Policy. Customers who need a countersigned PDF may request one at privacy@botbeaver.ai.

1. Roles

Customer is the controller (or business). BotBeaver is the processor (or service provider). Each party will comply with applicable privacy law in its role.

2. Scope of processing

• Subject matter: operation of AI chat and phone agents and related support.
• Duration: term of the customer agreement plus deletion timelines in the Data Deletion policy.
• Nature: hosting, transmission, transcription, LLM inference under customer configuration, CRM write-back.
• Types of data: contact details, message and call content, metadata, transcripts, scheduling data.
• Data subjects: customer's staff and customer's end-users.

3. Instructions

BotBeaver will process personal data only on documented instructions from Customer, including the Terms, order forms, and dashboard configuration, unless law requires otherwise. Customer instructs BotBeaver to process data as necessary to provide the service.

4. Subprocessors

Customer authorizes BotBeaver to use subprocessors for hosting, email, telephony, storage, AI inference, billing, and integrations needed to deliver the service. Categories are listed in the Privacy Policy. BotBeaver imposes data-protection terms no less protective than this DPA and remains responsible for subprocessors' performance. A named list is available at privacy@botbeaver.ai.

5. Security

BotBeaver will implement appropriate technical and organizational measures described in the Security Overview and Privacy Policy, including encryption in transit, encryption at rest for secrets, and access controls.

6. Assistance and breach notification

BotBeaver will assist Customer with data subject requests directed to Customer, reasonably assist with security assessments, and notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data.

7. International transfers

Where personal data is transferred outside the EEA or UK, the parties will execute Standard Contractual Clauses or rely on equivalent mechanisms offered by subprocessors where required.

8. Return and deletion

On termination, BotBeaver will return or delete Customer personal data per the Data Deletion policy, except where retention is required by law.

9. Contact

privacy@botbeaver.ai