Data processing addendum

You (the customer organization) are the controller of the personal data of your own customers and contacts. [Legal entity name] acts as processor and only processes that data to provide the service, following your documented instructions.

Processing covers conversations, phone numbers, names, catalog interactions, leads and appointments handled through the service, for as long as your account is active.

• Process data only for the service and on your instructions.
• Keep it confidential and limit access to staff who need it.
• Apply technical and organizational security measures, including encryption of secrets and per-organization isolation.
• Help you respond to requests from data subjects (access, rectification, deletion).
• Notify you without undue delay after we confirm a security incident affecting your data.

You authorize the providers needed to run the service (hosting, AI models, messaging infrastructure, email, payments). We will keep a list available on request and notify you of material changes. [List to be attached.]

Data may be processed outside Mexico by sub-processors that provide equivalent protection through contract.

You can export your data and schedule the deletion of your organization from the product. We delete or return data when the contract ends, except where the law requires us to keep it.

We will provide the information reasonably necessary to show compliance with this addendum. [Audit procedure to be defined by legal.]