Data Processing Agreement

1. Definitions

Terms not defined here have the meanings in the Terms or in Data Protection Laws.

• Data Protection Laws: all laws on the processing of personal data that apply to a party's processing under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA"), and other US state privacy laws.
• Customer Personal Data: personal data that PageClerk processes on Customer's behalf in providing the Service, including personal data of Visitors and of Customer's staff contained in Customer Content.
• Visitor: a person who interacts with Customer's assistant, on a website, through a channel Customer connects (such as Freshchat), or otherwise.
• Customer-Enabled Integration: a third-party service or endpoint that Customer chooses to connect to the Service, including Cal.com, Slack, HubSpot, Freshdesk, Freshchat, webhook endpoints (for example Zapier, n8n, Make or HighLevel), model provider accounts Customer connects with its own API key, and Customer's own APIs called through Functions.
• Sub-processor: a third party engaged by PageClerk that processes Customer Personal Data on PageClerk's behalf. Customer-Enabled Integrations are not Sub-processors.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by PageClerk or its Sub-processors.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).

2. Roles and scope

• For Customer Personal Data, Customer is the controller (or a processor acting for its own clients) and PageClerk is the processor, and, for the CCPA, a service provider. Where Customer acts for its own clients, Customer confirms that it has their authority to engage PageClerk on these terms.
• PageClerk is an independent controller for personal data it processes for its own business purposes, as described in the Privacy Policy: Customer account and billing data, communications with Customer, and data used to secure the Service, prevent abuse, and measure its use and costs. This DPA does not apply to that data.
• The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are described in Annex I.

3. Customer's instructions

• PageClerk processes Customer Personal Data only on Customer's documented instructions, unless required otherwise by law, in which case PageClerk will inform Customer first unless the law prohibits it.
• The Terms, this DPA, and Customer's use and configuration of the Service (including the settings, sources, Functions and Customer-Enabled Integrations it turns on) are Customer's complete instructions. Turning on a Customer-Enabled Integration instructs PageClerk to send the relevant Customer Personal Data to it.
• PageClerk will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Customer's responsibilities

Customer is responsible for:

• having a lawful basis, and any consent required, for the processing it instructs, including sending Customer Personal Data to Customer-Enabled Integrations;
• giving Visitors the information required by law, including that they are interacting with an automated assistant where the law requires that disclosure, and how their information is used and shared;
• Customer-Enabled Integrations, which process data under Customer's own agreements with their providers, and the security and behaviour of the endpoints it connects through webhooks and Functions;
• keeping its account credentials and the API keys it gives PageClerk secure, and telling PageClerk promptly if one is compromised;
• the accuracy and lawfulness of Customer Content, and of the decisions it makes using the Service.

Restricted data. The Service is not designed for, and Customer must not use it to collect or process, special categories of personal data (such as health information, racial or ethnic origin, religious beliefs or biometric data), personal data of children under 16, government identification numbers, financial account or payment card numbers, or protected health information under HIPAA. PageClerk does not enter into business associate agreements. Customer should configure its assistant, lead form and Functions so that Visitors are not asked for such data.

5. Confidentiality

PageClerk ensures that anyone it authorizes to process Customer Personal Data is bound by an appropriate duty of confidentiality, and limits access to those who need it to provide, support or secure the Service.

6. Security

PageClerk implements and maintains the technical and organizational measures in Annex II, appropriate to the risk of the processing. PageClerk may update these measures, provided the overall level of protection is not reduced.

7. Sub-processors

• Customer gives general authorization for PageClerk to engage Sub-processors. The current list is in Annex III.
• PageClerk will give at least 30 days' notice before a new Sub-processor processes Customer Personal Data, by updating Annex III and emailing the account owner. In an emergency, for example to replace a failed provider, notice may be shorter but will be given as soon as possible.
• Customer may object on reasonable data protection grounds within 15 days of notice. The parties will discuss the objection in good faith. If it is not resolved, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it, as its sole remedy.
• PageClerk imposes data protection obligations on each Sub-processor that are no less protective than this DPA, to the extent applicable to the services it provides, and remains responsible for its Sub-processors as required by Data Protection Laws.

8. AI processing

• PageClerk does not use Customer Personal Data to train or fine-tune AI models, and does not instruct its Sub-processors to do so.
• Replies are generated by the model providers in Annex III, or by a provider Customer connects with its own API key, which is a Customer-Enabled Integration.

9. Automated classification

PageClerk uses an automated decision model provided by TypeSafe AI to classify conversations. Depending on Customer's settings, it filters spam and misuse, chooses which model answers, decides when to offer a lead form or a handoff, labels leads with intent, urgency and qualification, rates how well conversations were answered, and checks actions before they run. These classifications support Customer's own decisions and are provided to Customer as information. PageClerk does not use them to make decisions that produce legal or similarly significant effects on Visitors. If Customer uses them in such decisions, Customer is responsible for the safeguards Data Protection Laws require.

10. Data subject requests

• Customer can view, export and delete individual conversations and leads in the dashboard. Taking into account the nature of the processing, PageClerk will provide reasonable further help for Customer to respond to requests from data subjects.
• If PageClerk receives a request from a data subject that relates to Customer, it will forward it to Customer without undue delay and will not respond itself, except to direct the person to Customer, unless required by law.

11. Assistance

Taking into account the nature of the processing and the information available to it, PageClerk will provide reasonable assistance with Customer's data protection impact assessments and consultations with supervisory authorities relating to the Service. PageClerk may charge reasonable fees for assistance beyond its standard documentation.

12. Personal Data Breaches

• PageClerk will notify Customer of a Personal Data Breach without undue delay, and where feasible within 72 hours, after becoming aware of it, by email to the account owner.
• The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available.
• PageClerk will take reasonable steps to contain and investigate the breach. Notifying a breach is not an acknowledgment of fault or liability.

13. Deletion and return

• During the term, Customer can export and delete Customer Personal Data in the dashboard. Conversation history is deleted automatically once it is older than the period included in Customer's plan, and other retention periods are set out in Annex I.
• When the Terms end, or when Customer asks PageClerk to close its account, PageClerk will delete Customer Personal Data within 30 days, unless the law requires it to be kept. Copies in backups are deleted as backups rotate, and are protected by this DPA until then.
• Data already sent to Customer-Enabled Integrations is held by those services and is not deleted by PageClerk.

14. Audits

• PageClerk will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire, no more than once in any 12-month period.
• Where Data Protection Laws or a supervisory authority require more, Customer (or an independent auditor bound by confidentiality and not a competitor of PageClerk) may audit PageClerk, at Customer's cost, on at least 30 days' notice, during business hours, no more than once in any 12-month period, and without access to other customers' data. Audits of Sub-processors rely on their own reports and certifications.

15. International transfers

• Customer Personal Data is processed in the United States, and by Sub-processors in the locations listed in Annex III. PageClerk is not certified under the EU-US Data Privacy Framework.
• EU. For transfers of Customer Personal Data subject to the GDPR to PageClerk, the SCCs are incorporated into this DPA: Module Two where Customer is a controller, and Module Three where Customer is a processor. Customer is the data exporter and PageClerk is the data importer. Clause 7 (docking) does not apply. Under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in section 7. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative. Under Clauses 17 and 18, the SCCs are governed by the laws of Ireland and disputes are resolved by the courts of Ireland. Annexes I, II and III of this DPA complete the corresponding annexes of the SCCs.
• UK. For transfers subject to the UK GDPR, the UK Addendum is incorporated, completed with the information in this DPA and its annexes. In Table 4, either party may end the UK Addendum as set out in its Section 19.
• Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland for data subjects to enforce their rights there.
• If the SCCs or UK Addendum are replaced or invalidated, the parties will cooperate to put an alternative lawful transfer mechanism in place.

16. US state privacy laws

Where the CCPA or similar US state laws apply, PageClerk acts as a service provider or processor and will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose, including any commercial purpose, other than providing the Service and the other business purposes permitted by those laws, or outside the direct business relationship with Customer;
• combine it with personal data PageClerk receives from other sources, except as those laws permit.

PageClerk will comply with the obligations those laws place on service providers, provide the same level of privacy protection they require, and notify Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data. PageClerk certifies that it understands these restrictions.

17. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except to the extent those limitations are not permitted under the SCCs or Data Protection Laws.

18. General

• This DPA lasts for as long as PageClerk processes Customer Personal Data under the Terms.
• If there is a conflict, the SCCs (and UK Addendum) prevail over this DPA, and this DPA prevails over the Terms, in each case only for the processing of Customer Personal Data.
• Except as stated for the SCCs in section 15, this DPA is governed by the laws of the State of Delaware, and the state and federal courts located in Delaware have exclusive jurisdiction.
• PageClerk may update this DPA to reflect changes in law, the Service or its Sub-processors. Updates that materially reduce Customer's protection take effect only with 30 days' notice, and Customer may terminate the Service before they take effect.

Annex I: Description of the processing

Annex II: Technical and organizational measures

• Encryption: TLS for data in transit; encryption at rest by PageClerk's hosting providers; API keys Customer provides for model providers and integrations are additionally encrypted with AES-256-GCM, are never shown again in the dashboard, and are decrypted only when used.
• Tenant isolation: every query is scoped to the authenticated account; each assistant can only retrieve its own sources.
• Access control: hashed passwords, secure HTTP-only session cookies, and administrative access limited to designated accounts.
• Minimization: IP addresses are anonymized before being stored with conversations and leads, and full addresses are used only briefly for rate limiting; conversation history is deleted after the plan's retention period.
• Outbound requests: requests to Customer webhooks and Functions are signed with HMAC-SHA256 and protected against server-side request forgery (private and internal addresses are blocked); responses are size- and time-limited.
• Inbound requests: Freshchat webhooks are verified against the Customer account's RSA public key; where Customer sets allowed domains, the widget only answers on those domains.
• Abuse prevention: rate limits per assistant and per Visitor; automated filtering of spam and attempts to manipulate the assistant; safety checks before actions run.
• Resilience: managed infrastructure with provider backups; automatic fallback between AI providers.
• Personnel: confidentiality obligations and least-privilege access for anyone with access to production data.
• Sub-processors: engaged under written terms with data protection obligations (section 7).
• Incident response: breach investigation and notification as set out in section 12.

Annex III: Sub-processors

Convex engages its own sub-processors, including OpenRouter, Inc. for routing requests to AI model providers and Amazon Web Services and PlanetScale for hosting, listed at convex.dev/legal/subprocessors. The model providers above are reached through Convex's AI gateway.

Not Sub-processors: Customer-Enabled Integrations (such as Cal.com, Slack, HubSpot, Freshdesk, Freshchat, Zapier, n8n, Make, HighLevel, model provider accounts connected with Customer's own key, and Customer's own APIs) are chosen and controlled by Customer and process data under Customer's agreements with them.

Contact

Questions about this DPA, requests for a countersigned copy, or security questionnaires: privacy@pageclerk.com.