Legal

Data Processing Agreement

Last updated: June 2026 · Version 1.1 · InfrAgent AI Ltd

In plain English

•You're the data controller; we only process your customers' data on your instructions, to run the service.
•We use vetted sub-processors, each under a data-protection agreement, with 14 days' notice of changes.
•Data is encrypted, isolated per business, EU-hosted, and we tell you promptly about any breach.
•You can export your data any time, and we delete it within 30 days of you leaving.
•Built to UK/EU GDPR (Article 28) and India's DPDP Act.

Summary for convenience; the full agreement below governs.

1. Scope & roles

This Data Processing Agreement ("DPA") forms part of the Terms between InfrAgent AI Ltd (the "Processor") and the tenant business (the "Controller"). It applies whenever we process your customers' personal data on your behalf, and incorporates UK GDPR, EU GDPR (Article 28) and India's Digital Personal Data Protection Act 2023.

2. What we process

Processing means receiving, storing, analysing and responding to customer communications across your connected channels (WhatsApp, Instagram, Facebook, Gmail, website chat, inbound calls) and operating bookings, CRM, campaigns and automations — solely to provide the platform, for the duration of your subscription. Data subjects are your customers, prospects and callers; data includes names, contact details and handles, message and call content, booking/enquiry details, and technical metadata. You must not direct us to process special-category data unless your lawful basis supports it.

3. Our obligations as processor

We process personal data only on your documented instructions (expressed through your platform configuration); ensure our personnel are bound by confidentiality; apply the security measures in section 5; assist you with data-subject requests and your own compliance; and make available the information reasonably needed to demonstrate compliance.

4. Sub-processors

You authorise the sub-processors listed in our Privacy Policy — Supabase (database/auth), OpenAI (AI via API), Twilio (telephony), Meta (channel APIs), Google (Gmail API), Stripe (payments) and Hetzner (EU hosting) — each bound by a written agreement with equivalent data-protection obligations. We give at least 14 days' notice of material changes so you can object.

5. Security & international transfers

AES-256-GCM at rest; TLS 1.3 in transit; per-tenant isolation via Postgres row-level security; signature-verified inbound webhooks; role-restricted, MFA-protected, logged production access; encrypted rolling backups; and a responsible-disclosure programme (ISO 27001 / SOC 2 in progress). Primary hosting is in Germany (EU); transfers outside the UK/EEA rely on the UK International Data Transfer Addendum and EU Standard Contractual Clauses, and comply with DPDP cross-border provisions for Indian Controllers.

6. Data-subject requests & breaches

The platform lets you search, export, correct and delete customer data directly, satisfying most requests without us. Where our assistance is needed, we act on your instruction within 7 days, and we redirect data subjects who contact us directly back to you. If we become aware of a breach affecting your tenant, we notify you without undue delay with the details you need to meet your own 72-hour obligations.

7. Deletion, return & audit

You can export your data any time during the subscription. On termination, we delete all tenant personal data within 30 days except where law requires retention; backups expire on a rolling schedule and are never used to restore deleted tenant data. We provide compliance documentation on request and, where that's insufficient for a legal requirement, will cooperate with an audit on reasonable notice, during business hours, up to once a year, under confidentiality.

8. Liability & precedence

Liability under this DPA is subject to the limits in the Terms. Where this DPA conflicts with the Terms, this DPA prevails for data-protection matters. Enterprise customers may request a countersigned DPA with custom annexes via support@infragentai.com.