About this agreement
This Data Processing Agreement (“DPA”) forms part of our Terms of Service and applies when xRepAI, Inc. (“xRepAI”) processes personal data about your website visitors on your behalf. For that visitor data you are the controller (or business) and xRepAI is the processor (or service provider). How xRepAI handles data on its own account is described in our Privacy Notice.
Definitions
“Personal data”, “processing”, “controller”, “processor”, and “data subject” have the meanings given in applicable data protection law, including the EU and UK GDPR and US state privacy laws such as the CCPA/CPRA. “Customer personal data” means personal data xRepAI processes on your behalf through the Service.
Scope and roles
You determine the purposes and means of processing Customer personal data; xRepAI processes it only to provide and support the Service. The subject matter is the operation of the AI SDR; the duration is the term of your subscription; the data subjects are your website visitors and leads; and the data includes conversation content, contact details they share, and the identification and analytics signals described in our Cookie Policy.
Our processing
xRepAI processes Customer personal data only on your documented instructions, including those given through your configuration of the Service, unless the law requires otherwise, in which case we will tell you unless the law prohibits it. We will not sell Customer personal data or use it for our own independent purposes.
Confidentiality
We ensure that personnel authorized to process Customer personal data are bound by appropriate confidentiality obligations and access it only as needed to perform their role.
Security
We maintain technical and organizational measures appropriate to the risk, including encryption of data in transit, access controls and least-privilege access, logging, and secure development practices. We review these measures and may update them, provided the level of protection is not reduced.
Subprocessors
You authorize xRepAI to engage subprocessors to help provide the Service. Each is bound by data protection terms consistent with this DPA. Our current subprocessors are:
- Vercel — application hosting and content delivery (USA).
- Anthropic — the AI models that generate Lina’s responses (USA).
- OpenReplay — consent-based session replay (as configured).
- FingerprintJS — consent-based device identification.
- Mailgun — transactional email delivery (USA).
We will give notice before adding or replacing a subprocessor so you can object on reasonable data-protection grounds. To receive updates to this list, contact [email protected].
International transfers
Where Customer personal data is transferred across borders, including to the United States, we rely on a lawful transfer mechanism such as the European Commission’s Standard Contractual Clauses and the UK addendum, together with any supplementary measures required.
Data-subject requests
Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests from data subjects to exercise their rights, such as access, correction, and deletion. If a data subject contacts us directly about Customer personal data, we will refer them to you unless the law requires otherwise.
Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide the information you reasonably need to meet your own notification obligations.
Return and deletion
On termination of the Service, we will delete or, at your choice, return Customer personal data within a reasonable period, and delete existing copies except where retention is required by law.
Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to reasonable audits, subject to confidentiality and reasonable notice, scope, and frequency.
US state privacy (CCPA/CPRA)
For personal data subject to the CCPA/CPRA, xRepAI acts as a service provider. We will not sell or share such data, will not retain, use, or disclose it except to provide the Service or as permitted by law, and will not combine it with data from other sources except as the CCPA allows. We certify that we understand and will comply with these restrictions.
Contact
For data protection questions or to request a signed copy of this DPA, contact [email protected]. This DPA is offered by xRepAI, Inc..