Data processing addendum

About this addendum

This addendum forms part of the Chatsoro terms of service between you, the business that uses Chatsoro, and us. Chatsoro is operated by Archibald John Blades Collinson, a sole trader based in Arrawarra, New South Wales, Australia. It applies whenever we process personal information on your behalf to provide the service, which we call your personal data.

For your personal data, you decide why and how it is processed and we act on your instructions. Under the GDPR and UK GDPR you are the controller and we are your processor; under other laws, such as Australia’s Privacy Act and US state privacy laws, we are your service provider. Personal information we use for our own purposes, such as your contact and billing details, is covered by our privacy notice instead.

Details of the processing

• Subject matter and purpose: running a chatbot on your website that answers visitors’ questions from your content, records conversations, captures the contact details visitors choose to leave, and makes them available for you to review.
• Duration: for as long as you use the service, and up to 30 days after your account closes.
• People concerned: visitors to your website who use the chatbot, and your staff whose details appear in your content or settings.
• Types of personal data: what visitors type into the chatbot; the contact details they choose to leave, such as a name, email address, phone number and company; the page a conversation started on and the referring page; the browser’s user agent; a random visitor identifier; and the IP address, which is used to apply rate limits and stored only as a salted hash.
• Sensitive information: none is intended. You must not set a chatbot up to collect health, financial, identity or other sensitive information.

What we commit to

For your personal data, we will:

• process it only on your documented instructions, which are these terms, how your chatbot is set up, and what you ask of us in writing, unless the law requires otherwise, in which case we will tell you first unless the law prevents it
• tell you if we believe an instruction breaks data protection law
• make sure anyone who processes it is bound by confidentiality, and not sell it, share it for advertising, or use it for any purpose other than providing the service to you
• keep it secure using the measures described below
• help you respond to people exercising their rights, including by passing on any request we receive about your chatbot
• give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator

Security measures

• All traffic to the chatbot and the application is encrypted in transit.
• Our hosting, database and model providers encrypt stored data.
• Access to conversations and leads is limited to the people who run the service, through a password-protected operations dashboard with signed sessions.
• Each chatbot’s indexed content is held separately from every other chatbot’s, and its conversations and leads are only shown against that chatbot.
• The chatbot only answers on the websites you approve, and rate limits protect it from abuse.
• IP addresses are stored only as salted hashes.
• Answers are requested from the model provider with its storage turned off; conversations are kept in our own database.

Sub-processors

You authorise us to use these sub-processors for your personal data:

• Vercel, United States: hosting the Chatsoro application and widget.
• OpenAI, United States: generating answers, and storing your chatbot’s indexed content.
• A managed PostgreSQL database host: storing conversations, leads and settings. Its name and location are available on request.

Each sub-processor is bound by data protection terms that protect your personal data at least as well as this addendum, and we remain responsible to you for them. We will email you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address the objection, you may end your subscription, and we will refund any fees you have paid for the period after it ends.

International transfers

We are based in Australia, and our sub-processors process personal data in the United States. Where these transfers need safeguards, they are covered as follows:

• From the European Economic Area: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 apply, using Module Two (controller to processor), or Module Three (processor to processor) where you are yourself a processor. They are incorporated into this addendum by reference, with clause 7 included, option 2 of clause 9(a) with 30 days’ notice, the optional wording in clause 11 left out, clause 13 as it applies to you, and Ireland chosen for clauses 17 and 18. The annexes are completed by the details of processing, the security measures and the sub-processors set out on this page.
• From the United Kingdom: the International Data Transfer Addendum to those clauses, issued by the UK Information Commissioner (version B1.0), applies, with its tables completed by the same information.
• From Switzerland: the same clauses apply, read with the changes the Swiss Federal Data Protection and Information Commissioner requires.
• From Australia: we take reasonable steps to make sure overseas recipients handle personal information consistently with the Australian Privacy Principles.

Where the clauses conflict with the rest of this addendum or the terms, the clauses prevail.

Personal data breaches

If we become aware of a breach of security that affects your personal data, we will tell you without undue delay, and where possible within 48 hours, with the information we have about what happened, what is affected and what we are doing about it. We will update you as we learn more and help you meet any duty you have to notify a regulator or the people affected.

At the end of the service

When your account closes, you can ask us for a copy of your conversations and leads for 30 days. After that we delete your personal data, including your chatbot’s indexed content held by our model provider, unless the law requires us to keep it.

Information and audits

We will make available the information you reasonably need to check that we meet this addendum, including written answers to your questions, at most once a year unless a regulator requires more. Where written answers are not enough, you may appoint an independent auditor, at your cost, on reasonable notice and under a duty of confidentiality.

Your responsibilities

• Have a lawful basis for using the chatbot on your website, and tell your visitors about it, for example in your privacy policy, including that answers are generated by an AI model provider.
• Do not set up a chatbot to collect sensitive information.
• Keep the list of websites approved for your chatbot accurate.
• Tell us promptly about any request or complaint about your chatbot that we need to act on.

Liability and order of documents

The limits on liability in the terms of service apply to this addendum. For your personal data, this addendum takes priority over the rest of the terms, and the clauses described under international transfers take priority over both.

Contact

For anything about this addendum, including a signed copy if your business needs one, email contact@chatsoro.com. The service is operated by Archibald John Blades Collinson.