Data Processing Addendum

1. Details of processing

2. Processor obligations

• HAL processes personal data only on the Customer's documented instructions: these Terms and this DPA, and the Customer's use and configuration of the Service. If Union or Member State law requires other processing, we will tell the Customer first unless the law prohibits it.
• We tell the Customer promptly if, in our opinion, an instruction infringes data-protection law.
• Everyone authorised to process Customer Data is bound by confidentiality.
• We implement the technical and organisational measures in section 3.
• Taking into account the nature of the processing, we assist the Customer with data-subject requests (Articles 12 to 23), with security, breach notification, data-protection impact assessments and prior consultation (Articles 32 to 36). Most requests can be handled directly in the Service (for example deleting contacts or conversations, or exporting data); if a data subject contacts us directly about Customer Data, we forward the request to the Customer.

3. Technical and organisational measures

• Encryption in transit: the website, dashboard, widget, apps and APIs are served only over HTTPS (TLS). Email is handed to Amazon SES over TLS.
• Encryption at rest: the database is encrypted at rest by our hosting provider (Railway), and backups by our backup storage provider (Cloudflare R2). Credentials for connected Gmail, Google Calendar, Twilio and Damper accounts, and two-factor secrets, are additionally encrypted in the database (AES-256-GCM).
• Credentials: passwords are stored as Argon2id hashes; API keys, MCP keys and session refresh tokens are stored only as hashes. Two-factor authentication (TOTP) is available to every user, required for our own staff with administrative access, and can be required by the Customer for all its team members. Changing two-factor settings ends the user's other sessions, and a password reset revokes the user's long-lived sessions. Webhooks are signed (HMAC-SHA256) so the Customer can verify they come from us, and the Customer can verify the identity of signed-in visitors with an HMAC (identity verification).
• Separation: every request is authorised against one account and project, and every database query is limited to them.
• Access control: access to production systems and data is limited to the people who operate the Service. Security-relevant actions in an account are recorded in its audit log.
• Abuse protection: per-IP rate limits on sign-in, sign-up, password reset and the public widget endpoints. The client IP is taken from our hosting platform's proxy, not from headers a client can set.
• Availability and recovery: the database is backed up daily to EU storage, and each backup is checked after upload and kept for 30 days. Uptime monitoring alerts us when the API, widget or dashboard stops responding. Database changes are applied before a new version replaces the running one, so a failed change does not take the Service down.
• Data minimisation: visitor IP addresses are not stored; product analytics in the browser run only with consent; Customer Data is not used to train AI models.

We review these measures as the Service changes and may update them, as long as the overall level of protection does not decrease. HAL does not currently hold a third-party security certification (such as ISO 27001 or SOC 2).

4. AI features

When the Customer uses HAL's AI features, the content needed for the task (the conversation, the Customer's help-center content and the contact and company details it relies on) is sent to the AI provider listed on the sub-processors page to generate an answer, a suggested reply or a summary. The provider does not use this content to train its models. The Customer decides whether AI answers visitors on its own or only suggests replies to its team, can switch AI off for each project, and visitors can ask to talk to a person instead.

5. Sub-processors

The Customer gives general authorisation for the sub-processors listed on the sub-processors page. We bind each by a written contract to data-protection obligations no less protective than this DPA, and remain responsible to the Customer for their performance. We will update that page before a new or replacement sub-processor starts processing Customer Data and, for paid plans, email the account owner at least 30 days ahead. The Customer may object on reasonable data-protection grounds within that period. We will then try to find a solution; if we cannot, the Customer may cancel the affected part of the Service, and we will refund any prepaid fees for the remaining period.

6. International transfers

Customer Data is stored in the EU (section 1). Where we or a sub-processor transfer personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), which are incorporated into this DPA by reference where needed, together with supplementary measures where required. The mechanism for each sub-processor is listed on the sub-processors page.

7. Return and deletion

• During the term, the Customer can export its data from the dashboard and through the API, and delete individual records (for example contacts and conversations) at any time.
• When the Customer deletes its account, the account is switched off at once and enters a 30-day grace period, during which the account owner can restore it. After the 30 days, all Customer Data in the account and its projects, its uploaded files and the users who belong to no other account are permanently deleted. Billing records are kept only as long as tax law requires.
• If the agreement ends for another reason, we delete Customer Data in the same way within 30 days of the Customer's request, unless Union or Member State law requires us to keep it.
• Copies in backups are removed as the backups roll off, within 30 days after the deletion.
• On request we confirm the deletion in writing.

8. Personal-data breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Customer Data. The notice goes to the email address of the account owner and describes, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available and help the Customer meet its own notification duties.

9. Audits

On reasonable request, we make available the information necessary to demonstrate compliance with Article 28 GDPR: written answers to security questionnaires, a description of our measures and the relevant sub-processor documentation. Requests can be made once a year, and in addition after a personal-data breach or when a supervisory authority requires it. Where this information is not sufficient, the Customer (or an independent auditor bound by confidentiality and not a competitor of ours) may carry out an audit with at least 30 days' notice, during business hours, without disrupting the Service or accessing other customers' data, and at the Customer's cost. Audits of sub-processors take place through their own audit reports and certifications.

10. Customer obligations

The Customer is responsible for the lawfulness of its processing, including: a legal basis for collecting and identifying its visitors and contacts; giving them the privacy information the law requires, including that AI may answer them; consent where the law requires it for marketing emails, email tracking, cookies on its own website and the recording or transcription of calls; and honouring opt-outs.

11. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA prevails; the Standard Contractual Clauses, where they apply, prevail over both.

12. Contact

Data-protection requests and security incidents: [email protected]. If you need a signed copy of this DPA, write to the same address.