1. Scope and definitions
This Data processing agreement (“DPA”) forms part of the Terms of service between Earth Angels L.L.C-FZ, a limited liability company licensed in the Meydan Free Zone, Dubai (licence no. 2314715.01), with its registered office at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (“Chatrevia”) and the customer (“Customer”). It applies whenever Chatrevia processes Customer Personal Data, meaning personal data within Customer Content that Chatrevia processes on Customer’s behalf. Where this DPA conflicts with the Terms on data protection, this DPA prevails.
“Data Protection Law” means all laws on personal data that apply to the processing, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection and US state privacy laws such as the California Consumer Privacy Act (“CCPA”). Terms such as controller, processor, data subject and personal data breach have the meanings given in Data Protection Law.
2. Roles
Customer is the controller of Customer Personal Data, or a processor acting for its own controllers. Chatrevia is Customer’s processor, or subprocessor, and a service provider under the CCPA. Chatrevia is an independent controller of the account, billing and security information described in its Privacy notice.
3. Details of processing
| Item | Description |
|---|---|
| Purpose | Providing the Chatrevia service: website messaging, AI answers, the team inbox, knowledge, help centers, notifications and the integrations Customer enables. |
| Duration | For the term of the Terms, and afterwards until deletion under this DPA. |
| Data subjects | Visitors to Customer’s websites and channels, Customer’s leads and contacts, and Customer’s team members. |
| Personal data | Names, email addresses and other contact details; message content; attachments; voice-message transcripts; answers to qualification questions; copies of emails sent to visitors; records of each visitor’s tracking choice (choice, version and time); order details from a connected store when Customer enables it; and, where the visitor consents, pages viewed, campaign parameters, referring website, a visitor identifier, a device signature used to recognise the same person across visits and masked session replays. |
| Sensitive data | Not required by the service. Customer will not configure the service to collect special categories of data unless it has a lawful basis to do so. |
| Frequency | Continuous, while the service is in use. |
| Retention | Conversations until Customer deletes them or the automatic-deletion period Customer chooses ends; other categories as scheduled in the Privacy notice, such as session replays for 90 days. |
4. Customer instructions
Chatrevia processes Customer Personal Data only on Customer’s documented instructions, which are the Terms, this DPA and Customer’s configuration of the service, unless the law requires otherwise. Chatrevia will inform Customer if it believes an instruction infringes Data Protection Law. Customer is responsible for the lawfulness of its instructions and for giving any notices and obtaining any consents its visitors require.
5. Confidentiality and security
Chatrevia ensures that people authorized to process Customer Personal Data are bound by confidentiality. It maintains appropriate technical and organizational measures, including:
- Encryption in transit with TLS, and AES-256-GCM encryption of integration credentials and push-notification subscriptions.
- Salted password hashing with checks against known breached passwords, optional or workspace-required two-factor authentication, workspace roles and optional SAML single sign-on on the Enterprise plan.
- An append-only audit log of sign-ins and important workspace actions, retained for 365 days.
- Enforced two-factor authentication and audited, reason-bound access for Chatrevia staff.
- Hosting on infrastructure with encryption at rest and point-in-time database backups.
- Automatic deletion of data on the schedules in the Privacy notice, and deletion of stored files with their records.
- Short-lived signed tokens for messenger sessions, and rate limiting of public endpoints.
- Private storage for attachments.
- Session replay only with the visitor’s consent, with all text and inputs masked and media blocked.
- Staff support access limited to 60 minutes per session, with a recorded reason, logged in the workspace’s audit log.
6. Subprocessors
Customer gives Chatrevia general authorization to engage the subprocessors listed on Service providers & subprocessors. Chatrevia will update that page and email workspace owners at least 14 days before a new subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected service and receive a refund of unused prepaid fees.
Chatrevia engages subprocessors under written terms and remains responsible for their performance. AI model providers accessed through OpenRouter process data under their published terms, which for some models allow the provider to retain prompts and responses; Customer acknowledges this and decides what knowledge to publish.
7. Assistance and data subject requests
Customer can export workspace data, export or erase everything held about one person, delete conversations and delete the workspace in the product. Chatrevia will pass on any data subject request it receives about Customer Personal Data without responding to it, unless Customer authorizes a response. Taking into account the nature of the processing, Chatrevia will reasonably assist Customer with requests, data protection impact assessments and consultations with authorities.
8. Personal data breaches
Chatrevia will notify Customer without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects likely affected, the likely consequences and the measures taken or proposed, and Chatrevia will provide updates as more is learned. Notifying a breach is not an admission of fault.
9. International transfers
Chatrevia processes Customer Personal Data in the United States and in the other locations listed for its subprocessors. Where Data Protection Law requires a transfer mechanism:
- For transfers from the European Economic Area, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module Two where Customer is a controller and Module Three where Customer is a processor. Clause 7 does not apply; option 2 of Clause 9 applies with the notice period in this DPA; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; Annex I is completed by the details of processing above, and Annex II by the security measures above.
- For transfers from the United Kingdom, the UK International Data Transfer Addendum applies to those clauses. For transfers from Switzerland, the clauses apply as adapted for the Swiss Federal Act on Data Protection.
- For transfers from the UAE, the parties rely on the contractual safeguards in this DPA and any mechanism required under UAE law.
10. Audits
Chatrevia will make available the information necessary to demonstrate compliance with this DPA, including answers to a security questionnaire once a year and any independent audit reports it holds. Customer, or an independent auditor it mandates who is bound by confidentiality, may audit Chatrevia’s compliance once a year, and additionally after a personal data breach or when a supervisory authority requires it. Audits take place at Customer’s cost, with at least 30 days’ notice (or less if an authority requires), during business hours and in a way that does not compromise other customers’ data or Chatrevia’s security.
11. Return and deletion
Customer can export its data at any time before its workspace is deleted. When the workspace is deleted, Chatrevia deletes Customer Personal Data and stored files from its production systems. Encrypted database backups expire within 30 days. If the law requires Chatrevia to keep any data longer, this DPA continues to protect it.
12. CCPA service provider terms
Chatrevia will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the service, or combine it with personal information from other sources except as the CCPA permits.
Chatrevia will comply with the CCPA and provide the same level of privacy protection it requires, will notify Customer if it determines it can no longer meet its obligations, and allows Customer to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data. Chatrevia certifies that it understands and will comply with these restrictions.
13. Liability
Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not permit them.