Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [COMPANY LEGAL NAME] (“we”, the “Service Provider”) and the Customer. It applies automatically when the Customer uses AIPageBuilder and applies to personal information the Customer, or its End-Customers, put into the Service (“Customer Personal Information”).

For Customer Personal Information the Customer is the business (controller) and we are its service provider (processor) under the California Consumer Privacy Act as amended by the CPRA (“CCPA”) and comparable US state privacy laws. If this DPA conflicts with the Terms on data protection, this DPA wins.

• Purpose: providing the Service as described in the Terms and as the Customer configures it (pages, forms, CRM, booking, payments, messaging, automations, AI features, analytics and client portal), plus support, security and legal compliance.
• People: the Customer’s leads, clients, page visitors, message recipients and team members.
• Data: contact details, form answers, booking and calendar details, invoice and payment records (card data is held by Stripe), messages, notes, files, page analytics and session replays, and any other data the Customer chooses to add.
• Duration: the term of the Customer’s subscription plus the deletion period in section 9.

We will process Customer Personal Information only for the business purposes above and under the Customer’s documented instructions (the Terms, this DPA and the Customer’s settings). In particular, we will not:

• sell or share Customer Personal Information (including for cross-context behavioural advertising);
• retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside our direct business relationship with the Customer;
• combine it with personal information we receive from others or collect ourselves, except as the CCPA permits for service providers (for example, to detect security incidents or prevent fraud);
• use it to train AI models.

We will comply with the CCPA as it applies to service providers and provide the same level of privacy protection it requires. We will tell the Customer if we can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.

We may use de-identified or aggregated data that no longer identifies anyone to operate and improve the Service.

Staff and contractors who can access Customer Personal Information are bound by confidentiality obligations and get access only when needed to run, support or secure the Service.

• Encryption in transit (TLS) and at rest; OAuth tokens and app passwords for connected accounts encrypted with a separate key.
• Database row-level security that isolates each workspace’s data, and role-based access inside workspaces.
• Least-privilege access for our personnel, with multi-factor authentication on production systems.
• Rate limiting, input validation, error monitoring and logging to detect abuse and incidents.
• Managed backups with our hosting and database providers.
• Vendor review of subprocessors and contracts with data-protection terms.

The Customer authorises us to use the subprocessors on our subprocessors page. Each is bound by written terms that protect personal information at least as well as this DPA, and we remain responsible for their performance. We will give at least 30 days’ notice of a new subprocessor by updating that page and notifying workspace owners by email. The Customer may object on reasonable data-protection grounds; if we cannot address the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for it. Services the Customer connects itself (such as Google, Microsoft, Zoom or iCloud) act under the Customer’s own agreement with that provider.

We will notify the Customer without undue delay, and in any case within 72 hours, after confirming a breach of security that leads to unauthorised access to, or loss of, Customer Personal Information. The notice will describe what happened, the data affected, the steps we are taking and a contact point, and we will update it as we learn more. We will help the Customer meet its own notification obligations to regulators and affected individuals.

The Service lets the Customer find, export, correct and delete End-Customer records. Where the Customer cannot do so itself, we will reasonably help it respond to consumer requests to know, delete, correct or opt out, and with privacy assessments. If we receive a request directly from an End-Customer, we will tell them to contact the Customer or pass the request on, and will not respond ourselves unless the Customer instructs us or the law requires.

The Customer can export its data at any time while its account is active and for 30 days after termination. After that, we delete Customer Personal Information within 90 days, except where the law requires us to keep it; backups are overwritten on their normal cycle and remain protected by this DPA until then.

On written request (no more than once a year, unless required by a regulator or after an incident) we will provide information reasonably needed to show compliance with this DPA, such as security documentation and our subprocessors’ audit reports where available. If that is not enough, the Customer may conduct an audit at its own cost, with 30 days’ notice, during business hours and under confidentiality, in a way that does not disrupt the Service or expose other customers’ data.

The Customer is responsible for its relationship with its End-Customers, including:

• giving any required privacy notice (for example a privacy policy linked from its pages and forms) and having a lawful basis for the data it collects;
• obtaining and recording consent where required, including prior express written consent before marketing text messages (TCPA), honouring STOP requests and quiet hours;
• following CAN-SPAM for commercial email: a valid physical postal address, accurate sender details and honouring unsubscribe requests;
• not uploading sensitive personal information the Service is not designed for unless the law allows it;
• responding to its End-Customers’ privacy requests, with our assistance as described above.

Customer Personal Information is stored and processed in the United States. Each party’s liability under this DPA is subject to the limitations in the Terms. This DPA lasts as long as we process Customer Personal Information for the Customer. It is governed by the law chosen in the Terms ([GOVERNING LAW STATE]). Questions: support@aipagebuilder.app.