Data Processing Addendum

1. About this addendum

This Data Processing Addendum (the "addendum") forms part of Chirpedly's Terms of Service (the "Terms") and applies to every business that uses Chirpedly. It covers the personal data Chirpedly processes for you while providing the service, such as the details of the customers your AI agent talks with.

For that data, you are the controller and Chirpedly is your processor: we process it only for you, on your instructions. For the data Chirpedly controls itself, such as your account details and visits to our website, our Privacy Policy applies instead.

2. Definitions

• Customer, you: the business that agrees to the Terms and uses Chirpedly
• Authorized Users: your team, meaning the teammates who use Chirpedly for your business
• End Users: your customers, and anyone else your AI agent talks with or looks up for you
• Customer Personal Data: personal data about End Users and Authorized Users that Chirpedly processes for you to provide the service
• Data protection law: the laws on personal data that apply to that processing, such as the GDPR, the UK GDPR, the CCPA and Canada's PIPEDA
• Controller, processor, personal data and processing: what data protection law means by them, including the matching terms in other laws, such as business and service provider under the CCPA
• Personal data breach: any unauthorized access to Customer Personal Data, or its accidental or unlawful loss, change or disclosure
• Subprocessor: a service provider Chirpedly uses that processes Customer Personal Data

3. What we process

Whose data

• End Users: your customers and anyone else who messages or calls your AI agent, or whom it calls or texts for you, and the people whose records it looks up in the apps you connect
• Authorized Users: your team's names, and what they write and do in your workspace, such as their replies to End Users and their approvals

What data

• Contact details: names, email addresses, phone numbers and postal addresses
• Notes and summaries: the notes your team keeps about an End User, and the summaries and facts your AI agent keeps about them and their conversations
• Conversations: what End Users write or say in the chats, emails, texts and calls on the channels you connect, any photos they send, and the replies from your AI agent and your team
• Calls: the End User's phone number and a written transcript of each call. We do not store call audio.
• Email: for an email someone sends to a mailbox you connect, the sender's name and address, the subject, what they wrote and any reply sent from the mailbox in that thread
• Website chat: a random identifier kept in the visitor's browser, the address of the page they are on, the kind of device they use, and whether they arrived from a search, social media, an email or another site. On a Shopify store, a signed-in shopper's name and email are linked to that identifier while they stay signed in.
• Records from the apps you connect: the order, customer and other details your AI agent reads to answer a question or carry out a skill, such as orders in a Shopify store, and the order updates a connected store sends us
• Identity checks: what an End User gives to prove who they are when a skill asks, such as their last name and the last four digits of their card, or a code we email to them

Why

To provide the service to you: running your AI agent and the features you turn on. That means answering End Users, calling or texting the people you choose, reading and acting on records in the apps you connect as your skills direct, showing conversations to your team, and sending the emails the service needs, such as alerts to your team and verification codes to End Users. It also means reviewing conversations and call transcripts, when needed, to fix problems in how your AI agent answers, within the limits the Privacy Policy sets.

How long

For as long as you use Chirpedly, and afterwards until the data is deleted as section 9 describes.

4. Your responsibilities

You decide what personal data Chirpedly processes for you and why. You are responsible for having the right to have it processed, including any consent the law requires, and for telling End Users how their data is used, as the law requires where you and they are. Your instructions to us must follow data protection law.

5. Our obligations

Your instructions

We process Customer Personal Data only on your documented instructions: the Terms, this addendum, and what you set in Chirpedly, such as your AI agent's settings, your skills, your Knowledge and the apps and channels you connect. We use it only for the purposes in section 3, to keep the service secure and working, and to meet our legal obligations. If the law requires us to process it in some other way, we tell you first, unless the law forbids that. If we believe an instruction breaks data protection law, we tell you.

We never sell Customer Personal Data, and we share it only with the subprocessors in section 6, with the apps and channels you connect on your instruction, and where the law requires it. We do not train or fine-tune any AI model on it. Google does not train its models on it without our permission, and TypeSafe AI does not train or fine-tune any model on it.

Confidentiality

Everyone at Chirpedly who can reach Customer Personal Data must keep it confidential, and anyone who joins Chirpedly signs a confidentiality agreement before they can reach it.

Security

We protect Customer Personal Data with these measures:

• Encryption at rest: our database, sign-in and file storage encrypt everything with AES-256. The credentials for the apps and channels you connect are encrypted a second time before they are stored, and are never sent back to a browser.
• Encryption in transit: chirpedly.com, the dashboard and the service that answers conversations accept only TLS 1.2 or 1.3, and that service reaches our database and every provider over encrypted connections.
• Separate workspaces: the dashboard can reach only your own workspace's data, and the service that answers conversations scopes every request to your workspace.
• Limited access: only those at Chirpedly whose work needs it can reach the systems that hold your data, each with their own account protected by multi-factor authentication. Access that is no longer needed is removed the same day.
• Logging and review: every request to the service that answers conversations, every change to the cloud account it runs in, and every time our team reaches your data from outside that service is logged, and we review the logs at least every 7 days.

Requests from End Users

If an End User asks you to see, correct or delete their personal data, we help you answer. Email support@chirpedly.com with the request. If an End User sends such a request to us instead, we pass it to you.

When a platform such as Shopify passes on a request from one of your customers to see their data, we tell you, so you can answer it. When it passes on a request to delete their data, we remove that person's records, conversations and call transcripts from your workspace. We act on both within 30 days.

Risk assessments

Where data protection law requires you to assess the risks of the processing, or to consult a regulator about it, we give you the information we have about how we process Customer Personal Data to help you do so.

Showing that we comply

On request, we give you the information you reasonably need to show that we meet this addendum, such as a description of our security measures and our subprocessors.

6. Subprocessors

We use these subprocessors to run Chirpedly. These are all of them:

• Supabase: our database, sign-in and file storage
• Google Cloud: hosting for the service that answers conversations
• Google Vertex AI: the AI models that read conversations and your Knowledge, and write replies
• Google Gemini API: the same AI models, for any request Vertex AI is too busy to take, sent here with the same content
• TypeSafe AI: quick decisions during a conversation, such as which of your skills fits a customer's message. Its Jev model reads what each decision needs, such as the latest messages, what a caller says, your business's name and your skills' descriptions, and writes no replies.
• Anthropic and OpenAI: the AI assistants our team works with (Claude, ChatGPT and Codex). They see Customer Personal Data only when our team opens it to fix a problem.
• ElevenLabs: speech recognition and the voice on phone calls, including test calls. What your AI agent says on a call is sent here to be spoken, and the transcript is returned to us.
• Twilio: phone numbers, carrying the calls and text messages to and from them, and texting the codes that verify your mobile number
• Telnyx: carrying calls to one Chirpedly phone number until that number moves to Twilio
• Postmark: the email we send, including notifications to your team that carry a customer's name and message, and verification codes sent to your customers
• Vercel: hosting for chirpedly.com and the dashboard
• Google Fonts: the fonts on chirpedly.com and in the dashboard, so Google receives visitors' IP addresses

Apps and channels you connect

The apps and channels you connect, such as Shopify, Telegram, an app from Integrations or any MCP server, are not our subprocessors. They receive what your AI agent sends them on your instruction, and each one handles the data under its own terms.

Changes to subprocessors

When we add or replace a subprocessor, we update this list, the Privacy Policy's list and the version line at the top of this page.

7. Personal data breaches

If a personal data breach affects Customer Personal Data, we act at once to contain it, and we tell you without undue delay, and no later than 72 hours after we know your data was affected: what happened, what data, what we have done, and what you should do. You control your End Users' data and decide what to tell them.

8. Where data is processed

Our database, sign-in and file storage, which hold Customer Personal Data, are run by Supabase on Amazon Web Services in Oregon, in the United States (us-west-2). The service that answers conversations runs on Google Cloud in Oregon (us-west1), and Google Vertex AI indexes your Knowledge for search in Iowa (us-central1).

The Google Vertex AI models that read conversations and write replies are reached through Google's global endpoint, which does not guarantee the region where a request is processed. Our other subprocessors process data where their own services run, which may be outside your country or your End Users' country.

When those transfers require additional safeguards, we use contractual and operational measures intended to protect personal data and meet applicable legal requirements.

9. Retention and deletion

• Conversations, call transcripts, order updates and Knowledge: kept while your workspace is active. You can delete Knowledge articles in the product. To delete uploaded files, conversations or a whole workspace, email support@chirpedly.com.
• Messages exactly as a platform you connect delivers them to us: deleted after 30 days. What End Users wrote stays in their conversation.
• Call audio: not stored by us. ElevenLabs, which runs the call, is set not to save recordings and to delete its copy of the call after 7 days.
• Records of what the AI agent did: a log of every action the AI agent attempted and its outcome, with identifying details stripped out. It survives a deletion request on purpose: it is the anonymous audit trail that shows a deletion happened.

Uninstalling a connected store

If you remove Chirpedly from a connected store, we drop that store's credentials as soon as the platform tells us, and the store can immediately be connected somewhere else. When the platform then asks us to erase the store's data, 48 hours later on Shopify, we delete what came from that store: the orders and customer details it sent us, and the links between your website chat visitors and the store's customer accounts. Your workspace and its conversations are kept, so that an accidental uninstall does not destroy your history. To remove them, email support@chirpedly.com.

When you stop using Chirpedly

You can ask us for a copy of your data within 30 days of termination, as the Terms allow. Your workspace and its data are kept until you ask us to delete them. When you do, by email to support@chirpedly.com, we delete your workspace and the Customer Personal Data in it, except the records of what the AI agent did, which hold no identifying details, and anything the law requires us to keep.

10. Order of precedence

If this addendum and the Terms differ on Customer Personal Data, this addendum applies. Everything else stays as the Terms set it, including their limits on liability, governing law and dispute resolution. The Privacy Policy covers the data Chirpedly controls itself.

11. Changes to this addendum

We may update this addendum from time to time. We will notify you of changes by posting the new version on this page and updating the date and version at the top.

12. Contact us

For questions about this addendum, or to make a request under it, contact us:

Data protection contact
Email: support@chirpedly.com
Website: https://chirpedly.com