Data Processing Terms

1. Who is who

You are the controller and KeyScale is the processor for the personal data in your workspace: the conversations your own customers have with you through website chat or a connected messaging app, the contacts built from those conversations, and the material you supply for the AI agent's knowledge base.

We are a separate, independent controller for our own business records - your account and billing details, and enquiries submitted through our website. Those are covered by our Privacy Policy, not by these terms.

2. What we process, and why

• Subject matter: operating the AI agent, the CRM workspace, the webchat widget, and any managed website we provide to you.
• Duration: the term of your agreement, plus the deletion period in section 8.
• Nature and purpose: receiving, storing, displaying, and replying to messages; maintaining contact records; generating AI replies from your own material; notifying you.
• Types of personal data: names, email addresses, phone numbers and other contact details a person supplies; the content of messages they send; technical data such as IP address and user agent; anything else you or your customers put into a conversation.
• Categories of data subjects: your customers and prospective customers, and your own staff who use the workspace.

You must not put special category data - health, biometric, racial or ethnic origin, religious or political beliefs, sex life or sexual orientation - or criminal offence data into a workspace unless we have first agreed in writing what additional protections that needs.

3. Our instructions come from you

We process personal data only on your documented instructions. Your agreement, these terms, and the settings you choose in your workspace - reply mode per channel, the agent's schedule, what goes into the knowledge base - are those instructions.

We will tell you if an instruction appears to infringe data protection law, and may pause the affected processing until it is resolved. Everyone we authorise to handle your data is under a duty of confidentiality, and access is limited to those who need it.

4. Security

We maintain appropriate technical and organisational measures, and will not materially reduce them during your term. In outline: passwords stored as salted hashes and compared in constant time; optional two-factor authentication; session cookies that are HttpOnly, SameSite=Strict, and Secure; per-workspace isolation; TLS on all traffic; channel credentials and API keys encrypted at rest with AES-256-GCM; encrypted off-site backups with verified restores; rate limiting on every public endpoint; and login throttling with recorded security events.

A full description of these measures is available on request.

5. Sub-processors

You give general authorisation for the sub-processors below. We will give you at least 30 days' notice before adding or replacing one, by updating this page and notifying you at your account email. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may terminate the affected recurring service without penalty for the unused part of the period. Project work already delivered and accepted is unaffected. Each is engaged under a contract imposing obligations no less protective than these terms, and we remain fully liable to you for their performance.

Which model provider runs your workspace is chosen when it is set up, and we will tell you which one on request or before we change it.

6. The AI agent

Where the agent is enabled, the text of a conversation and the relevant passages of your knowledge base are sent to the model provider so a reply can be generated. Separately, the material you supply for the knowledge base and the text of each incoming question are sent to the embedding provider so the search index can be built and queried. Neither provider uses that data to train its models.

You decide, per channel, whether the agent replies itself or only drafts for a person to approve, and you remain responsible for what is sent to your customers under your name. Where it replies automatically, the people messaging you must be able to tell an automated system is answering; our webchat widget shows that notice by default and it must not be removed.

7. International transfers

Some sub-processors process data outside the UK and the EEA, including in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum where applicable, or on an adequacy decision covering the destination, including the EU-US Data Privacy Framework where the provider is certified under it.

8. Retention, deletion, and getting your data back

• Conversations, contacts, and knowledge base material are kept for the term of your agreement.
• Records of AI answers - the question, the reply, and the passages it drew on - are deleted automatically after 90 days, or after 365 days if someone on your team rated the answer.
• Operational error diagnostics are deleted automatically after 30 days, or 7 days once the error is resolved.

You can export your contacts to CSV from the workspace at any time. On termination we will, on your request made within 30 days, provide your conversation history. After that we delete the workspace and everything attached to it, unless law requires us to keep a copy, in which case these terms keep applying to that copy.

9. Helping you meet your own obligations

• Requests from individuals. The workspace lets you access, correct, export, and delete a person's data yourself; we assist with anything it cannot do. If a request reaches us directly we will not answer it - we pass it to you, because the decision is yours.
• Breaches. We notify you without undue delay and, where feasible, in any event no later than 48 hours after becoming aware, with what is known about the nature of the breach, the categories and approximate number of people affected, the likely consequences, and the measures taken. Where the full picture is not available in that time we send what we have and follow up.
• Assessments and audits. We provide the information you reasonably need for a data protection impact assessment, and to demonstrate our compliance with Article 28. That obligation is met in the first instance by giving you our documentation on request. Where documentation is genuinely not enough, we will allow an audit by you or an auditor you mandate: no more than once in any 12 months unless a breach or a regulator requires otherwise, with the date, scope, and duration agreed between us in advance, restricted to data relevant to you, and subject to confidentiality. You bear your own audit costs.

10. Precedence and term

Where these terms and your service agreement conflict on data protection, these terms prevail. Liability under them is subject to the limits in your agreement and in our Terms of Service. They run for as long as we process personal data for you, and sections 3, 8, and 10 survive their end.

11. Contact Us

Questions about these terms, or a request for a countersigned copy:

Email: [email protected]
Brand: KeyScale