Data Processing Agreement

You decide. We carry it out. The information your visitors leave with Caretta is yours to answer for. You choose whether to ask for it, which details to ask for, how long it is kept, and what you do with it afterwards. We only handle it to run the service for you, and only in the ways described here or in your written instructions.

Your settings in the dashboard are instructions. Switching contact collection on, choosing the fields, or changing the retention period all count as telling us what to do, and we act on them.

In the language of data protection law, you are the controller and WAPI Solutions LLC is the processor. That is the only pair of legal terms in this document, and it matters because every other clause follows from it.

We handle your visitors' information for one reason: to provide the assistant you installed. That means receiving what a visitor types, producing an answer, storing the conversation so it can continue, storing any contact details the visitor chooses to leave, and showing all of it back to you in your dashboard.

We do not sell it. We do not rent it. We do not use it to advertise to anyone, and we do not build profiles of your visitors for our own purposes or for other customers.

This lasts as long as you use the service. It ends when your account ends, as described in section 12.

Three kinds, and it is worth knowing the difference:

• What visitors type. Their questions and messages. This is sent to an AI model to produce an answer.
• Contact details they choose to leave. A name, an email address, a phone number, entered into the contact form inside the chat. These are never sent to an AI model. They are stored encrypted and shown only to you.
• Technical details. An identifier for the browser, the approximate country, timestamps, and records of blocked abuse. These keep the conversation working and the service safe.

If you have connected your own login system so the assistant can recognise signed-in members, whatever your system tells us about that person is also covered here.

What is actually in place today:

• Contact details are encrypted, each visitor under their own key. They sit in a separate database that the main application cannot read.
• Because each visitor has their own key, deleting one person's details is a real, separate action, not a search-and-hope through a shared store.
• Traffic to and from the assistant is encrypted in transit.
• Access to your data in the dashboard requires your login, and every time contact details are revealed on screen it is written to an audit record.
• The widget only works on the web addresses you list, so a stolen snippet does not work elsewhere.

We do not claim any certification or audit report. If that changes, this section will say so.

We use a small number of other companies to run the service. Today they are, by role:

• AI model providers: they receive what a visitor types in order to generate an answer. They do not receive contact details left through the form.
• Our hosting provider: the servers are in Germany, inside the European Union.
• A network security provider: filters abusive traffic before it reaches us.

The current list with company names is available to you on request, and we will tell you before we add or replace one, so you have time to object. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may end this agreement.

If you are in Türkiye: because the servers are in Germany, using the service involves a transfer of personal data abroad. We mention it plainly because it is true whether or not anyone asks.

You set the periods. Conversations and contact details each have their own retention setting in your dashboard, and a scheduled job deletes what has passed it. Contact details are set to a shorter period than conversations by default, because they should not accumulate.

When contact details expire, we destroy the key that unlocks them and mark the record as erased. The record that "a contact request was received on this date and erased on that date" survives. That is how you can show a deletion actually happened. Nothing readable survives with it.

You can also ask us to delete a specific person's details at any time, and we will.

One honest limitation. We take routine backups for disaster recovery. A deletion applies to the live service immediately, but a copy may persist in a backup until that backup is cycled out in the ordinary course. We do not promise a specific number of days for that, because we would not be able to guarantee it.

This is the clause most worth reading, so it is stated directly rather than buried.

To keep the assistant improving (better answers, better suggested questions, catching questions it fails at), we derive anonymous learning data from conversations across all customers, and you permit us to do so by accepting this agreement.

What that means in practice:

• What we keep is a normalised form of a question, what it was about, whether it was answered well, and the month. Not the visitor, not the conversation, not the exact wording, not the time of day.
• A question is only kept in wording form if several different visitors have asked something equivalent. A one-off, personal story never enters it.
• Contact details never enter it. Neither do conversations attached to a signed-in member's identity.
• Your business content is not shared with other customers. What is shared is the shape of common questions.

If you would rather your conversations were excluded from this entirely, write to us and we will exclude your account.

Your visitors are your visitors. If one of them writes to us directly asking to see or delete their data, we do not act on it ourselves. We pass the request to you and tell you we have. Acting alone would mean claiming a relationship with your visitor that we do not have.

What we do instead is help you answer. We can export or delete a particular visitor's data on your instruction, and we will do it promptly enough for you to meet your own deadlines.

Some things only you can do, and this agreement does not do them for you:

• Tell your visitors. Your own privacy notice should say that a chat assistant is in use and that details left in it are handled by a service provider on your behalf. You can link that notice inside the assistant, and we recommend it.
• Have a reason. Collecting contact details needs a lawful basis. Answering a request someone made is usually one. Marketing is not, which is why the marketing tick-box is separate and never pre-ticked.
• Marketing rules are yours. If you send commercial messages to the addresses or numbers you collect, the local rules for that are your responsibility. In Türkiye that includes registering the permission with the national message system within three business days.
• Ask only for what you need. The fields are yours to choose. Asking for a phone number you will never call is a cost you carry, not us.
• Keep your account secure. Anyone who can log in as you can read your visitors' details.

If we find out that your visitors' data has been exposed or lost, we will tell you without undue delay once we have confirmed it, and we will tell you what we know: what happened, which data is involved as far as we can tell, what we have done, and what we suggest you do.

We will not sit on it while we investigate. An incomplete first message is better than a late complete one, and any deadline you have towards a regulator starts from what you know.

You may ask us to demonstrate that we are doing what this agreement says. In the ordinary case we will answer in writing and show you the relevant settings and records. If a written answer genuinely is not enough, we will agree a reasonable way to verify, at a reasonable frequency, without disrupting other customers.

This agreement lasts as long as we hold your visitors' data. When your account closes, you can ask us to return the data or delete it. If you do not tell us within a reasonable period, we delete it.

Deleting your account destroys the encryption keys for your visitors' contact details, which makes them unreadable in one step rather than row by row. The backup limitation in section 6 applies here too.

Anything we are legally required to keep (invoices, for instance) we keep for that reason and no other.

You accept it in your dashboard, and we record the date, the version you saw, and the network address and browser you accepted from. That record is what lets either of us show later what was agreed and when.

Until it is accepted, features that handle your visitors' personal information stay switched off. That is enforced by the software, not by policy: without an agreement in place we have no instruction to act on.

If we change this agreement in a way that matters, we will tell you and ask you to accept the new version.

Questions: [email protected] · WAPI Solutions LLC, 30 N Gould St Ste R Sheridan, WY 82801, USA