AI Website Chat — Data Processing Agreement
This agreement forms part of the Terms of Service and is accepted together with them. It governs NexusCaller's processing of personal data of the customer's website visitors on the customer's behalf, under Article 28 of the EU General Data Protection Regulation (GDPR) and as a "service provider" under the California Consumer Privacy Act (CCPA/CPRA). A countersigned copy is available on request to info@nexuscaller.com.
1. Processing on instructions
The Processor processes visitor personal data only to provide the AI Website Chat, on the Controller's documented instructions — its settings in the Service and these terms — unless required otherwise by law, in which case it will inform the Controller where permitted. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.
2. Purpose limitation
The Processor will not sell or share the data, will not use it for its own purposes (including training AI models or advertising), and will not combine it with data from other customers or sources, except as needed to provide the Service.
3. Confidentiality
Persons authorized to process the data are bound by confidentiality, and access is limited to what is needed to operate and support the Service.
4. Security
The Processor implements the measures in Annex 2 and keeps them appropriate to the risk.
5. Sub-processors
The Controller authorizes the sub-processors listed in the Privacy Policy. The Processor imposes equivalent data protection obligations on them, remains responsible for them, and gives at least 30 days' notice of any new sub-processor, during which the Controller may object; if the objection cannot be resolved, the Controller may terminate the affected Service.
6. Assistance
The Processor helps the Controller respond to data-subject requests (including a tool to find and delete all conversations for an email or phone number), and with security, breach notification and data protection impact assessments, taking into account the nature of the processing.
7. Personal data breaches
The Processor notifies the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available. For California personal information, the Processor notifies the Controller immediately after discovery.
8. Deletion and return
Conversations are deleted automatically 12 months after they took place. When the Service ends, the Processor deletes the Controller's data within 30 days, after the Controller has had the opportunity to export it, unless law requires keeping it.
9. Information and audits
The Processor makes available the information necessary to demonstrate compliance, in the first instance by answering a reasonable security questionnaire once a year. On-site audits, where required by law, are at the Controller's cost and on reasonable notice.
10. International transfers
Data is processed in the United States. Where GDPR applies, transfers are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914, the "SCCs"), which are incorporated by reference, with the Controller as data exporter and the Processor as data importer: Module 2 (controller to processor) and, where the Controller acts as a processor for another controller, Module 3 (processor to processor). For the SCCs: Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorization) applies, and the Processor gives at least 30 days' notice of any new sub-processor, during which the Controller may object; under Clause 13, the competent supervisory authority is the one competent for the Controller; for Clause 17 (governing law) and Clause 18 (courts), the law and courts of the Republic of Ireland apply, unless the Controller's Member State is required. Annexes 1 and 2 of this agreement and the sub-processor list in the Privacy Policy provide the information for the SCCs' annexes. If this agreement conflicts with the SCCs, the SCCs prevail. A copy of the SCCs is available on request at info@nexuscaller.com.
11. Controller's responsibilities
The Controller is responsible for having a lawful basis for the processing, for its own privacy notice to visitors, for the content and instructions of its assistant, and for not instructing the collection of sensitive data through the chat.
12. California (CCPA) service-provider terms
Where the CCPA applies, the Processor is the Controller's service provider, and the Controller discloses personal information to it only for the limited and specified business purpose of providing the Service described in Annex 1. The Processor:
- complies with the CCPA and provides the same level of privacy protection as the CCPA requires;
- does not sell or share the personal information;
- does not retain, use or disclose it for any purpose other than that business purpose, or outside its direct business relationship with the Controller;
- does not combine it with personal information it receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as the CCPA and its regulations allow; and
- notifies the Controller if it determines that it can no longer meet its obligations under the CCPA.
The Controller may take reasonable and appropriate steps to ensure that the Processor uses the personal information consistently with the Controller's CCPA obligations and, on notice, to stop and remediate unauthorized use.
Annex 1 — Description of processing
| Subject matter | Operating an AI chat assistant on the Controller's website |
|---|---|
| Data subjects | Visitors who use the chat on the Controller's website |
| Personal data | Chat messages; page and time; name, email, phone or other details the visitor chooses to share; AI-generated summary of the request; consent method and time; IP address (transiently, for abuse prevention) |
| Special categories | None intended; visitors are asked not to share sensitive data |
| Nature and purpose | Generating replies with AI models, storing conversations, extracting leads and follow-ups, alerting the Controller |
| Duration | For the term of the Service; conversations up to 12 months; deletion within 30 days of the Service ending |
| Transfers | To the United States, under the Standard Contractual Clauses |
Annex 2 — Security measures
- Encryption in transit (HTTPS/TLS) for all access to the Service
- Passwords stored only as salted hashes (scrypt); two-step sign-in for administrator access
- Strict separation of customers' data — each customer's logins can access only that customer's assistants and conversations
- Audit log of administrative actions; sign-in rate limiting
- Third-party API keys stored encrypted (AES-256-GCM)
- Abuse protections: per-visitor and per-assistant rate limits, origin restrictions, blocking of requests to private network addresses
- Automatic deletion of conversations after 12 months; one-step erasure of a person's data on request
- Hosting on Railway's managed infrastructure, with access limited to NexusCaller administrators