Data Processing Addendum (DPA)

www.chatagentx.com

Last Updated: June 2026

This Data Processing Addendum (“DPA”) forms part of the Chat AgentX Terms & Conditions and applies to the processing of personal data in connection with the Chat AgentX platform and related services (“Services”).

Where there is any inconsistency between this DPA and the Terms & Conditions regarding the processing of personal data, this DPA shall prevail to the extent of that inconsistency.

1. Roles of the Parties

For the purposes of applicable privacy and data protection laws, the Customer generally acts as the data controller, business or equivalent role under applicable law, and Chat AgentX generally acts as a data processor or service provider processing personal data on behalf of the Customer.

Customers are responsible for ensuring that they have appropriate rights, permissions, notices and legal bases for collecting and using personal data through the Services.

2. Processing Instructions

Chat AgentX processes personal data only as reasonably necessary to provide and operate the Services, in accordance with the Customer’s instructions, this DPA, the Terms & Conditions and applicable law.

Customer instructions include chatbot configurations, website URLs, uploaded documents, knowledge base content and settings configured through the Customer dashboard.

3. Purpose of Processing

Chat AgentX processes personal data for the purpose of providing and maintaining the Services, including:

  • AI chatbot functionality;
  • website visitor interactions;
  • lead capture and enquiry management;
  • customer account administration;
  • transactional communications;
  • subscription and billing management;
  • platform security and abuse prevention;
  • customer support; and
  • compliance with applicable laws.

4. Types of Personal Data

Depending on how Customers use the Services, personal data processed may include:

  • names;
  • email addresses;
  • phone numbers;
  • business contact details;
  • chatbot messages and conversation summaries;
  • enquiry details;
  • uploaded documents and knowledge-base content;
  • website URLs and indexed website text;
  • account and billing information;
  • usage and analytics data; and
  • customer support communications.

Customers control the personal data submitted to the Services.

5. Customer Responsibilities

Customers are responsible for:

  • ensuring they have appropriate rights and permissions to process personal data;
  • maintaining lawful privacy notices and disclosures;
  • determining what information is collected through the chatbot;
  • responding to requests from their own end users; and
  • ensuring that the Services are appropriate for their intended use.

6. Confidentiality

Chat AgentX takes reasonable steps to ensure that personnel authorised to process personal data are subject to appropriate confidentiality obligations and access controls.

7. Security Measures

Chat AgentX maintains reasonable technical and organisational safeguards designed to help protect personal data against unauthorised access, disclosure, alteration or loss.

Such measures may include:

  • authentication controls;
  • access restrictions;
  • encrypted transmission using HTTPS/TLS;
  • logical separation of customer workspaces;
  • infrastructure security controls;
  • monitoring and abuse prevention measures;
  • software maintenance and updates; and
  • security incident response procedures.

No method of electronic transmission or storage can be guaranteed to be completely secure.

8. Subprocessors

Chat AgentX engages trusted third-party infrastructure providers and service providers to support delivery of the Services. Current subprocessors include:

Provider Purpose
OpenAI, LLCAI text processing and embeddings
Neon, Inc.Managed PostgreSQL database hosting
Hasura, Inc.API orchestration and access controls
Vercel, Inc.Hosting and serverless infrastructure
Upstash, Inc.Caching and serverless data services
Resend, Inc.Transactional email delivery
Stripe, Inc.Subscription billing and payment processing
PayPal, Inc.Payment processing, where enabled

Chat AgentX takes reasonable steps to require subprocessors to maintain appropriate confidentiality and security measures.

Chat AgentX may update its subprocessors from time to time to reflect changes in infrastructure, technologies or business requirements.

9. International Data Transfers

Because Chat AgentX and its subprocessors operate globally, personal data may be transferred to and processed outside the Customer’s jurisdiction, including in the United States.

Where required by applicable law, Chat AgentX aims to implement reasonable safeguards designed to support lawful international data transfers.

10. Data Subject Requests

Where reasonably possible and appropriate, Chat AgentX will assist Customers in responding to valid requests relating to personal data, including requests for access, correction and deletion.

Customers remain responsible for responding to requests from their own end users and determining their legal obligations.

11. Security Incidents

If Chat AgentX becomes aware of a security incident affecting Customer personal data, Chat AgentX will take reasonable steps to investigate the matter and provide notice where required by applicable law.

12. Data Retention and Deletion

Chat AgentX retains chatbot conversation data and personal data collected through the Services for a period of 30 days, after which it is automatically deleted from active systems.

Where Customers delete content or terminate their account, Chat AgentX will take reasonable steps to delete or de-identify applicable data from active systems within that timeframe in accordance with normal platform functionality.

Residual copies may temporarily remain within backup or disaster recovery systems until automatically overwritten or removed in accordance with normal retention practices.

Chat AgentX does not use personal data or chatbot conversation data to train, fine-tune or improve any AI or machine learning models.

13. Limitation of Liability

Liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability contained in the Chat AgentX Terms & Conditions or any other applicable agreement between the parties.

14. Relationship to Other Agreements

This DPA forms part of the Chat AgentX Terms & Conditions and related policies.

In the event of any inconsistency between this DPA and the Terms & Conditions regarding data processing obligations, this DPA shall prevail to the extent of that inconsistency.

15. Changes to this DPA

Chat AgentX may update this DPA from time to time to reflect changes in laws, regulations, technologies, services or business practices.

Any changes will be reflected by the “Last Updated” date appearing at the top of this document.

Schedule 1 – Description of Processing

Purpose of Processing

Provision of AI chatbot services, website assistance, lead capture, customer account administration, billing, customer support and platform security.

Categories of Personal Data

  • Names
  • Email addresses
  • Phone numbers
  • Business contact details
  • Chatbot messages
  • Enquiry details
  • Uploaded documents
  • Website content
  • Billing information
  • Usage and analytics data

Categories of Data Subjects

  • Website visitors
  • Customers
  • Prospective customers
  • Employees
  • Contractors
  • Volunteers
  • Members
  • Donors
  • Suppliers

Duration

For the duration of the Services and thereafter as reasonably necessary to comply with legal obligations, resolve disputes and enforce agreements.

Schedule 2 – Technical and Organisational Measures

Chat AgentX maintains safeguards designed to protect personal data, including:

  • account authentication controls;
  • logical separation of customer workspaces;
  • encrypted communications using HTTPS/TLS;
  • infrastructure and database access controls;
  • restricted personnel access where required;
  • monitoring and abuse prevention mechanisms;
  • software maintenance and security updates;
  • backup and disaster recovery practices where applicable; and
  • incident response procedures.

Contact

If you have questions regarding this DPA or Chat AgentX’s data processing practices, please contact: support@chatagentx.com

United States
Alt Deluxe Inc. DBA Chat AgentX
2810 North Church Street, Wilmington, Delaware 19802, United States

Australia
With You Group Pty Ltd trading as Chat AgentX Australia
Level 2, 302–304 Lygon Street, Carlton VIC 3053, Australia