Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the customer who accepts the Terms of Service ("Customer," the controller) and IMFA Labs LLC, a limited liability company registered in Wyoming, United States ("IMFA," the processor). It is part of the Terms and applies to personal data that IMFA processes for the Customer while providing IMFA Agents ("Customer Personal Data"). It reflects Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws where they apply.

If this DPA conflicts with the Terms, this DPA wins for Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses win.

2. Subject matter and duration

IMFA processes Customer Personal Data to provide the service the Customer configures: hosting agents, answering conversations on the website widget, voice, and connected channels, storing knowledge and files, capturing leads and orders, connecting the services the Customer chooses, and keeping the service secure. Processing lasts while the Customer uses the service and until deletion under section 11. Details are in Annex 1.

3. Customer's obligations

The Customer:

• decides what personal data enters the service and why, and has a lawful basis for it;
• gives its visitors and customers the notices required by law (including that they are talking to an AI where required) and obtains any consent required;
• does not add special categories of data or children's data unless the law allows it and the Customer has every safeguard required;
• configures its agents, channels, team access, and integrations appropriately;
• answers its data subjects' requests, with IMFA's help under section 8.

4. IMFA's obligations

IMFA:

• processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's settings in the service, unless the law requires otherwise (in which case IMFA tells the Customer first unless the law forbids it);
• tells the Customer if it believes an instruction breaks data protection law;
• does not sell Customer Personal Data or use it for its own purposes, except as needed to secure the service, prevent abuse, and comply with the law, as described in the Privacy Policy;
• does not use Customer Personal Data to train AI models.

5. Confidentiality

IMFA makes sure that people authorized to process Customer Personal Data are bound by confidentiality and access it only as needed to provide, support, and secure the service.

6. Security

IMFA applies the technical and organizational measures in Annex 2, taking into account the state of the art, the costs, and the risks. IMFA may update them as long as the overall protection does not decrease.

7. Subprocessors

The Customer gives general authorization for IMFA to use subprocessors. The current list is at Subprocessors. IMFA:

• binds each subprocessor by written contract to data protection obligations that are at least as protective as this DPA, as appropriate to the service it provides;
• updates the list before adding or replacing a subprocessor; the Customer can ask to be told of changes by email at privacy@imfa.io;
• lets the Customer object on reasonable data protection grounds within 30 days of the update; if the parties cannot resolve the objection, the Customer may stop using the affected feature or end the service, and receive a pro rata refund of prepaid fees for the unused period of that subscription;
• remains responsible for its subprocessors' performance as required by law.

Platforms the Customer connects (Meta, Telegram, Discord, Google, and payment methods through Stripe) act as independent controllers for their own processing and are not IMFA's subprocessors.

8. Help with data subject requests

Taking into account the nature of the processing, IMFA helps the Customer answer requests to access, correct, delete, restrict, or port personal data, mainly through the tools in the service (viewing and deleting conversations, leads, files, and agents). Where the tools are not enough, the Customer can ask privacy@imfa.io. If IMFA receives a request directly from a Customer's data subject, it refers the person to the Customer where it can identify them and does not answer it itself unless the Customer asks.

9. Personal data breaches

IMFA notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations, as it becomes available. IMFA takes reasonable steps to contain the breach. A notification is not an admission of fault.

10. Impact assessments and authorities

IMFA gives the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the service, using the information available to it, mainly this DPA, the AI Disclosure, and the Subprocessors list.

11. Return and deletion

The Customer can delete conversations, files, knowledge, agents, and its whole account at any time in the service. On account deletion, IMFA deletes Customer Personal Data as described in the Privacy Policy (after a 3 day period during which the Customer can cancel the deletion), except where the law requires IMFA to keep it. Copies in providers' backups are deleted on their regular schedule. Before deleting, the Customer can request a copy of its data at privacy@imfa.io.

12. Audits

IMFA makes available the information reasonably needed to show compliance with this DPA, including this document, its annexes, and summaries of its providers' certifications. If that is not enough, the Customer may ask for an audit, at most once a year, with 30 days' notice, at its own cost, by an independent auditor bound by confidentiality, in a way that does not disrupt the service or expose other customers' data. Audits of subprocessors are covered by their own reports and certifications.

13. International transfers

IMFA is in the United States and its subprocessors process data in the countries listed in Annex 3. Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as the case may be), with the UK addendum and the Swiss adjustments where they apply, are incorporated into this DPA by reference, with IMFA as data importer. IMFA requires equivalent safeguards from its subprocessors.

14. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them. This DPA lasts as long as IMFA processes Customer Personal Data.

Annex 1: Processing details

Annex 2: Technical and organizational measures

• Access control: authentication for every dashboard and API request; server-side permission checks on every function; roles for shared agents (owner, editor, viewer); admin tools limited to IMFA administrators.
• Credentials: API keys and access tokens stored as hashes; channel credentials and Google tokens stored encrypted; secrets never shown back in the builder chat.
• Transport: encrypted connections (HTTPS) between browsers, our services, and our providers.
• Isolation: each customer's data is scoped to its own account and agents on every query.
• Abuse prevention: rate limits per visitor, conversation, agent, and account; bot checks on the widget; automated content and safety checks; visitor warnings and blocks.
• AI data protection: zero data retention requested on the Convex AI Gateway; contact details removed before lead qualification and summaries; instructions kept out of replies.
• Data minimization and retention: automatic deletion of idle conversations, logs, and records on the schedules in the Privacy Policy; decisions stored without conversation text.
• Activity records: audit and activity logs for sensitive changes and agent activity.
• Providers: infrastructure on providers with their own security certifications (see the Subprocessors list).

Annex 3: International transfer mechanisms