Data Processing Terms

Version: 2026-09-28

These terms apply to personal data processed for a business client under an agreed order, to the extent relevant data protection law applies. The order must identify the actual parties and complete the processing schedule before live data is processed. Electronic agreement may be used where valid under applicable law; publication of this page or an employee's use of a workspace alone is not proof of an authorised agreement.

1. Roles and processing schedule

The client acts as controller, or as a processor with authority from its controller, and the identified KeyScale operator acts as processor or sub-processor. KeyScale acts separately as controller for its own business and account records described in the Privacy Policy.

The subject matter is delivery of the agreed managed website, AI, CRM and messaging services for the engagement's duration and the return/deletion period below. Processing includes receipt, storage, retrieval, display, AI inference and indexing, replies, notifications, export and deletion. Data may include contact details, message and knowledge content, online identifiers and associated technical records. Data subjects are the client's contacts, visitors, prospective customers, customers and relevant personnel. The schedule must narrow this description to the services actually enabled.

Medical, child-directed and other specially regulated use cases, special-category or criminal-offence data, payment-card data and identity documents are outside the standard service. Do not supply them. Any proposed expansion requires a separate written assessment and agreement before processing. If such data is received unexpectedly, notify us and cooperate on restriction, deletion and any legal duties.

2. Instructions and confidentiality

We process on documented lawful instructions in the order, this DPA and authorised workspace settings, including instructions about transfers. We inform the client if an instruction appears to infringe applicable data protection law and may suspend it pending resolution. If law requires other processing, we inform the client beforehand unless legally prohibited. People authorised to handle client data must be subject to confidentiality obligations and appropriate access restrictions.

3. Security

We maintain appropriate technical and organisational measures taking account of the processing risks and do not materially reduce the agreed overall level of protection during the engagement. The processing schedule records verified deployment measures. The application supports salted password hashes, optional TOTP authentication, scoped workspace access, protected session cookies and encrypted storage of integration credentials. Public production access must use HTTPS. Encrypted backups, restore testing, access controls and monitoring must be verified for the actual deployment. This is not a claim of certification, universal endpoint coverage or complete security.

4. Sub-processors and other platforms

The client authorises only the sub-processors identified in the completed schedule. Each entry must state the legal provider name, service, data involved, location and applicable protection arrangements. The platform's available integrations are not a substitute for this list. A customer-selected platform's legal role must also be recorded.

With general authorisation, we give at least 30 days' prior notice of an addition or replacement by email to the nominated client contact, allowing reasonable data protection objections before new processing starts. If an objection cannot be resolved, the client may terminate the affected service and obtain a refund for its unused prepaid recurring portion; accepted project work is unaffected. We impose the data protection obligations required by applicable law and remain responsible for our sub-processors as that law requires, subject to lawful contractual limitations.

5. AI services

Model providers may receive messages, documents and relevant knowledge passages. Embedding providers may separately receive knowledge material and questions. The schedule must identify actual services, retention and training settings, including downstream providers where a routing service is used. A new endpoint must not receive live data before that review and any required authorisation. No blanket promise is made about every compatible API.

We do not train our own general-purpose models on client content. Diagnostic review and adjustments to the client's knowledge base are performed to deliver the service on its instructions. The client chooses automatic or human-review reply modes and reviews suitability. We provide AI disclosure in our widget; the client must also ensure appropriate disclosure on its own channels. Each party remains responsible for its own legal duties and conduct.

Draft for review (Suggest) prepares reply text for a person to review and send. During draft generation, AI tools cannot change contact details, tags or lead stages, or show the widget contact form. A draft may be flagged for human review; messages, drafts and diagnostic records are still stored. Sending a draft sends its text only, without applying deferred AI actions. Autopilot can execute enabled actions. Business-hours schedules restrict automatic replies, not draft generation.

6. International transfers

The schedule must cover access by the KeyScale operator in Armenia as well as onward provider transfers. Where required, the parties complete the appropriate transfer instrument, annexes, assessment and supplementary measures before processing begins. These terms do not themselves incorporate uncompleted SCCs or a UK Addendum. Mandatory transfer clauses, when validly agreed, prevail over conflicting terms and cannot be restricted by the service liability cap.

7. Retention, return and deletion

• Workspace conversations, contacts and knowledge material are kept during the engagement. On termination, the customer may request return or earlier deletion within 30 days. We then arrange deletion from the active workspace, unless applicable law requires retention. Termination and deletion are an operator-managed process, not an automatic billing event.
• AI diagnostic records are scheduled for deletion 90 days after creation, or 365 days after creation if rated by a user or if they record an unresolved handoff with no retrieved knowledge passages. These limits concern diagnostic records, not the underlying conversation history.
• Operational errors are grouped by recurrence. The default cleanup removes unresolved groups 30 days after their last occurrence and resolved groups 7 days after their last occurrence. A recurrence restarts that clock and reopens the group. Any different deployment retention must be documented before processing begins.
• Active-workspace deletion is not immediate deletion of every copy. Restricted security and operational records, delivery queues, provider-held records and backups may remain under their applicable retention schedules. Removing a user reference does not anonymise the remaining record. Retention of these copies must be limited to a documented purpose or legal requirement.
• Encrypted backups rotate separately from the active database. The configured default keeps 14 daily, 8 weekly and 12 monthly snapshots; these are snapshot counts, not a guaranteed maximum age. The engagement's processing schedule must specify the actual backup retention and purge process. Backups are restricted to recovery; outstanding erasures must be reapplied before restored data returns to normal use.

During authorised access, contacts can be exported to CSV. At the client's choice we return or delete personal data at the end of processing, subject to applicable retention law. Requests for an export should be made within the 30-day termination window; we assist with conversation and knowledge-data exports not supported by the interface. The agreed backup and residual-record schedule applies to copies not immediately removed. Backups are kept to recover the service after a failure, not as a per-client archive or record-level restore service; the client keeps its own copies of data it needs, using the available exports or an export request. Confidentiality and protection obligations continue for retained data, which must not be reused for unrelated purposes.

8. Assistance, incidents and audits

Taking account of the nature of processing and available information, we assist the client with rights requests, security duties, breach assessment, impact assessments and prior consultations. We forward requests received for client-controlled data unless law requires another response. Reasonable assistance charges may be agreed in advance where lawful; no charge or negotiation delays a mandatory duty or remediation of our own breach.

We notify the client without undue delay after becoming aware of a personal data breach, providing available facts and subsequent updates: nature, affected data and people, likely consequences, measures taken and a contact point. We do not wait for a complete investigation. The client's notification deadline depends on its own awareness and applicable law, not simply the date of our email.

We provide information needed to demonstrate compliance and allow and contribute to audits by the client or its mandated auditor. Documentation review is the first step where sufficient. Routine audits are normally limited to once in 12 months on reasonable notice, with confidentiality and protection of other clients; those arrangements do not prevent additional audits or assistance required by law, a regulator, a breach or reasonable evidence of non-compliance. Each party bears its own costs unless otherwise lawfully agreed.

Where applicable US privacy law requires service-provider or contractor restrictions, we use the data only for the specified business purposes and permitted legal purposes; do not sell or share it for cross-context advertising; and do not retain, use, disclose or combine it outside the permitted relationship except as law permits. We provide the legally required level of protection, notify the client if we cannot meet those obligations, and permit reasonable compliance checks and steps to stop and remediate unauthorised use. Any additional state-specific contract requirements must be completed in the schedule.

9. Precedence and duration

Mandatory law and applicable transfer instruments prevail. For data protection, these terms and any expressly agreed data-protection amendment prevail over conflicting commercial terms. Lawful limits in the service agreement apply only between the contracting parties; they do not limit individuals' or regulators' statutory rights. These obligations continue while we retain client personal data. Ask for a countersigned version if required.

Contact

Email: hello@keyscale.co
Brand: KeyScale