Data Processing Agreement

• You are the controller of the personal information you, your team and your customers put into StaceyChat (“your data”): you decide why and how it is used.
• We are your processor: we handle your data only to provide StaceyChat to you, as this agreement sets out.
• For the accounts of the people who sign up to StaceyChat, we are the controller, and our Privacy Policy applies.
• “Data protection law” means the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies to you.

• Subject matter and purpose: providing StaceyChat, an assistant that receives your customers' messages, drafts or sends replies with the AI provider you choose, and gives your team an inbox, alerts and reports.
• Nature: receiving, storing, organising, reading with AI, sending, showing and deleting.
• Duration: while you use StaceyChat, then until your data is deleted as sections 11 and 12 say.
• People it is about: your customers and website visitors who chat with you, people they mention, and your team.
• Kinds of data: names, phone numbers, usernames and other details the chat app gives; messages and anything in them; your team's notes; Stacey's drafts, replies and the reasons for them; each chat's memory; dates and times, and which chat app or website a chat came from; website chat ratings; a scrambled copy of a website visitor's browser code; and your team's names and roles, and who sent or taught what.
• Special category data (such as health): StaceyChat doesn't ask for it. It is processed only if a customer chooses to share it in a message, and then only as part of that message.

• We process your data only on your documented instructions. They are the Terms, this agreement, and how you use and set up StaceyChat: for example connecting a chat app, choosing whether Stacey drafts or sends replies, teaching her, and deleting chats or customers.
• If the law makes us process your data in another way, we tell you first, unless that law forbids it.
• We tell you if we think an instruction breaks data protection law.

• You need a lawful basis for your customers' data, and must tell them how you use it: that you use StaceyChat as your processor, and that replies may be written by an AI.
• You choose your AI provider and add your own key, under your own agreement with that provider.
• Don't ask customers for payment card numbers through StaceyChat, or for health or other sensitive details unless your service needs them.
• You decide who is on your team and what role each person has.

Only the people who run, secure and support StaceyChat can reach your data, and only as far as their work needs. Each is bound to keep it confidential. We don't read your chats unless you ask us to for support, it is needed to keep StaceyChat secure or stop misuse, or the law requires it.

We keep your data safe with measures that fit the risk. Today they include:

• All traffic to and from StaceyChat uses HTTPS.
• Database access rules keep each business's data apart: a person reaches only the businesses they belong to.
• Roles: owners, admins and agents. Changing settings, approving what Stacey learns, and downloading or deleting a customer's data are for owners and admins.
• AI keys, chat-app tokens and other connection secrets are kept in storage only our servers can read.
• Passwords are kept only as a secure hash by our sign-in provider.
• Messages from a chat app are accepted only with the secret that chat app was given. The website chat answers only on your own websites, and limits how much each visitor can send.
• What Stacey is taught through Train Stacey, and what she learns from files and past chats, is checked first, so one customer's private details aren't kept in it.
• Chats are deleted automatically 24 months after their last message (section 11).
• Our database and servers are in Frankfurt, Germany (EU).

We review these measures as StaceyChat changes, and won't lower the overall protection they give.

You give us general permission to use these sub-processors:

• Supabase: database, file storage and sign-in. Frankfurt, Germany (EU).
• Vercel: website and server hosting. Frankfurt, Germany (EU).
• The AI provider you choose, Google (Gemini) or Anthropic (Claude): reads the messages, notes and look-ups Stacey needs to write each reply. It works on your own API key, so your agreement with that provider applies too. It may process data in the United States and other countries.
• Telegram, if you connect a Telegram bot: carries messages between your customers and your bot. It may process data outside the UK and EEA.
• Google Calendar, if you connect it: free and busy times, and with Read & write, the holds Stacey adds, which name the chat app and customer. It may process data in the United States and other countries.
• Push services of the browser makers (such as Apple, Google, Mozilla or Microsoft), and Apple's push service for the StaceyChat iPhone app, if your team turns alerts on: carry each alert to the device it goes to.

Systems you connect to StaceyChat yourself are your own choice, under your own terms with them. Each sub-processor we engage is bound by a written contract with data protection terms that protect your data at least as well as this agreement, and we remain responsible to you for its work.

At least 30 days before a new sub-processor handles your data, we update this list and email your account's owner. You can object by writing to hello@staceychat.com within that time, with your reasons. If we can't resolve it, you can stop using the part concerned, or close your account before the change and have your data deleted as section 12 says.

• In the Inbox, an owner or admin can download everything StaceyChat keeps about one customer (“Download customer data”) or delete it (“Delete customer data”): their contact details and notes, their chats, ratings and notes on replies, and anything Stacey learned from reading their chat.
• If a customer asks us directly, we pass the request to you without undue delay, and help you answer it. We don't answer it ourselves unless you ask us to.
• For anything the Inbox tools don't cover, write to hello@staceychat.com and we'll help.

We help you meet your own duties on security, telling the regulator and people about a breach, data protection impact assessments and consulting the regulator, using what we know about how StaceyChat works and your data in it.

• If your data is lost, destroyed, changed, disclosed or reached without permission, we tell your account's owner without undue delay, and within 48 hours of becoming aware of it.
• We say what happened, the kinds of data and roughly how many people and records, the likely effects, and what we have done or plan to do. If we don't know it all at once, we tell you in stages.
• We act quickly to contain it and limit the harm, and keep a record. Whether to tell the regulator or your customers is your decision; we help you with it.

• A chat, with its messages, Stacey's drafts and the reasons for her replies, its memory, ratings and the notes on its replies, is deleted automatically 24 months after its last message. The customer's contact details and notes go with their last chat.
• You can delete sooner: “Clear chat” deletes a chat's messages, and “Delete customer data” deletes everything about one customer.
• Disconnecting a chat app keeps its chats; they are deleted as above.
• What Stacey knows, including what she learned from past chats (checked to hold no one customer's details), stays until you change or remove it, or your account closes.

• Before you close your account, you can ask us for a copy of your data, which we give you in a common, machine-readable format.
• Within 30 days of your account closing, we delete your data, unless the law requires us to keep something. Copies in backups are overwritten on their normal cycle, and are not used in the meantime.

We give you the information you reasonably need to show that this agreement is kept, and answer your reasonable questions about it. You, or an independent auditor bound to confidentiality, may audit our compliance once a year on 30 days' written notice, or sooner after a breach or when a regulator requires it. We will first try to answer with documents; an audit must not disrupt StaceyChat or expose other businesses' data, and each side pays its own costs.

Your data is stored in the EU. Where a sub-processor handles it in a country outside the UK and EEA that isn't recognised as protecting it adequately, we make sure the transfer is covered by the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as the case needs.

• The limits on liability in section 10 of the Terms apply to this agreement too, as far as data protection law allows.
• This agreement is governed by the laws of England and Wales, and its courts decide disputes, as section 13 of the Terms says. Where the EU Standard Contractual Clauses apply, their own choice of law and courts applies to them.
• We may update this agreement. We will change the date at the top and tell account owners by email or in the app before a significant change takes effect. A change won't lower the protection your data has, unless the law requires it.

Plugged-In Ventures Ltd, company number 16576189 (registered office). Email: hello@staceychat.com.