1. Who this agreement is for
This agreement applies to every customer who uses PoriFyx Chat to process personal data covered by the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection or similar laws such as the California Consumer Privacy Act. If anything in this agreement conflicts with our terms, this agreement wins for anything to do with personal data.
2. Our roles
- You are the controller for the personal data of your website visitors, leads, customers and team members that passes through your account. You decide why and how it is used.
- We are your processor. We only use that data to run the service for you.
- For your own account details (your name, email, billing), we are the controller and our privacy policy applies.
- Under the CCPA we act as your “service provider”: we do not sell or share the personal information we process for you, and we do not use it for anything other than providing the service.
3. Your instructions
Your instructions are the settings you choose in the dashboard, these terms and anything else you agree with us in writing. We will tell you if we believe an instruction breaks data protection law. We never use your customers’ data to train AI models, and we ask our AI providers not to either (see AI transparency).
4. What data and why
| People | Your website visitors and chat users, leads, customers who book appointments, people who email your support inbox, and your team members. |
|---|---|
| Data | Chat messages and attachments, names, email addresses, phone numbers, company names, booking details, answers to your lead form, technical data (browser, device, approximate location from IP, pages viewed during the visit) and anything else visitors choose to type. |
| Purpose | Answering visitors with AI and your team, capturing and organising leads, managing bookings and tickets, analytics for you, and sending the notifications you switch on. |
| Duration | For as long as you keep your account, subject to the retention period you set in the dashboard, and then deletion as described in section 11. |
| Special categories | The service is not designed for health, biometric or other special category data. If you need to handle it, configure your assistant so it does not ask for it, or talk to us first. |
5. Our people
Only staff who need access to support you or keep the service running can see customer data. They are bound by confidentiality and their access is logged.
6. Security measures
We protect data with measures that suit the risk, including encryption in transit (TLS) for every connection, encrypted storage of secrets such as API keys, access controls with optional two-factor authentication, login rate limits and automatic blocking of attackers, audit logs of admin actions, regular backups and least-privilege access for staff. Our security page describes these in more detail. We review them regularly and may improve them, but we will not make them weaker.
7. Sub-processors
You give us general permission to use the sub-processors listed on our sub-processors page. We hold each of them to data protection terms at least as protective as these. We will update that page at least 14 days before adding a new one; if you object on reasonable data protection grounds, tell us and we will work with you on a solution, and if we cannot find one you may cancel the affected part of the service with a pro-rata refund.
Channels you connect yourself, such as WhatsApp, Telegram or your CRM, act on your instructions under your own agreement with them; they are not our sub-processors.
8. International transfers
If personal data leaves the UK, the European Economic Area or Switzerland, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), plus extra safeguards where needed. These clauses are incorporated into this agreement by reference.
9. Helping you with people’s rights
The dashboard lets you find, export and delete a person’s data yourself (see Privacy & GDPR tools in the documentation). If someone contacts us directly about data we hold for you, we will pass the request to you and not answer it ourselves unless you ask us to. We will also help with data protection impact assessments where reasonable.
10. Personal data breaches
If we become aware of a breach affecting your data, we will tell you without undue delay and in any case within 48 hours, with what we know, what we are doing about it and what you may need to do. We will keep you updated as we learn more.
11. Deletion and return
You can export your data at any time. When your account closes, we delete customer personal data within 30 days, and it leaves our backups within a further 60 days, unless the law requires us to keep it.
12. Audits
We will answer reasonable security questionnaires once a year and give you the information you need to show compliance. If that is not enough and a regulator requires it, we will allow an audit by an independent auditor bound by confidentiality, with 30 days’ notice, at your cost.
13. Liability
Each party’s liability under this agreement is subject to the limits in our terms, except where the law does not allow those limits.
14. Signed copies
If your organisation needs a countersigned copy, email [email protected] with your company name and address and we will send one.