Data Processing Agreement

Who this is between.

This agreement is between Breezy Chat Ltd, registered in England and Wales, company 16815096, of 61 Habgood Road, Loughton, IG10 1HE ("we"), and the business that uses Breezy to talk to its customers ("you"). It is part of your use of Breezy and applies from the date at the top of this page. Creating an account accepts it.

It covers the data protection laws that apply to you: the UK GDPR and the Data Protection Act 2018, the EU GDPR, and the Swiss Federal Act on Data Protection. For a signed copy, write to [email protected].

Who decides.

You decide how your customers' data is used. You are the controller of the conversations your customers have with Breezy, and of what Breezy reads from, or changes in, the systems you connect, such as your booking platform. We are your processor: we handle that data only to run Breezy for you.

For your staff's accounts, your billing and our own marketing, we are the controller. Our Privacy Policy covers those.

What we handle for you.

The people are anyone who chats with Breezy on your website or phones your Breezy number, and the bookers, guests and patients in the systems you connect. The data is:

their messages, and anything they share in them, such as a name, email address, phone number, booking reference or voucher code
the page they opened the chat on
for phone calls, the caller's number and a written record of the call. We do not keep the audio.
the short summary, topic and ratings Breezy writes when a conversation ends
contact details they leave when Breezy hands the conversation to your team, or while your chat is paused
what Breezy reads from the systems you connect to answer them, or enters there for them: booking details such as names, contact details, dates, activities, guests and payment status, and for clinics, patient and appointment details
links to session photos Breezy shares, when you connect Dropbox

We use a visitor's IP address for a few minutes to stop abuse, and do not keep it with the conversation. We never see card numbers.

If you run a clinic, or any business where a booking can reveal someone's health, some of this is special category data. You need your own condition for it under Article 9 of the GDPR.

We handle it to answer your customers, look things up for them in the systems you connect, make the changes they ask for there, such as moving or cancelling a booking, hand conversations to your team, and show you what happened. That means storing it, sending it to the companies below to write replies, find answers and run calls, and emailing it to your staff. We do this while you use Breezy, and then as set out under when it ends.

What we promise.

We act only on your instructions. They are this agreement, your settings and workflows, and the systems you choose to connect. If we think an instruction breaks data protection law, we tell you.
Everyone at Breezy who can see your data is bound to keep it confidential.
We protect it as set out under how we keep it safe.
We use other companies only as set out under who else handles it.
If someone asks to see, correct or delete their data, we help you answer. If they ask us directly, we pass the request to you.
If we become aware of a breach affecting your data, we tell you without undue delay, and within 48 hours. We say what happened, what it affects and what we are doing about it, and help with any report you have to make.
We help with your data protection impact assessments, and with any consultation with a regulator, where they concern Breezy.
When you stop using Breezy, we delete your data as set out under when it ends.
We give you the information you need to show you comply, and answer reasonable security questionnaires. You, or an auditor bound by confidentiality, may audit us once a year on 30 days' notice and at your cost, and again after a breach or when a regulator requires it.

What you promise.

You have a lawful basis for the data you have Breezy handle, and for connecting the systems Breezy uses.
Your privacy notice tells your customers about Breezy: that their messages are handled by Breezy and the companies below.
Your customers can tell they are talking to an AI assistant.
You connect only systems whose data you are allowed to share with us, and your instructions to us follow the law.

How we keep it safe.

The app and its database run on Render in Frankfurt. Render encrypts the database and its backups at rest, and keeps backups for up to 7 days.
Every connection to Breezy uses HTTPS. Passwords are stored scrambled, never readable.
Your staff see only your business's conversations and settings.
A small number of people at Breezy can read conversations, to support you and fix problems. They sign in with separate staff accounts, which lock after repeated failed attempts.
Breezy reads and changes the systems you connect only with the access you give it, and you can withdraw that access at any time.
Phone call audio passes through as the call happens. We do not record it.
Our host's server logs, which can include the text of a message, are kept about 7 days. Records of finished background work are cleared after 3 days. Errors are reported to Sentry.

Who else handles it.

You agree that we may use these companies to run Breezy. Each is bound by written data protection terms with us that cover the same ground as this agreement.

Render hosts the app, the database and its backups. Germany (Frankfurt).
Cloudflare carries every request to the chat and protects it from attacks. Worldwide.
Anthropic writes Breezy's replies, and the summary and ratings at the end of a conversation. United States.
OpenAI indexes messages so Breezy can find the right answer, and runs and transcribes phone calls. United States.
Twilio connects phone calls and sends text messages. United States.
Postmark emails conversations handed to your team, and your daily summaries. United States.
Google serves the chat's fonts, so it sees a visitor's IP address and browser, and runs our team's email, which receives a copy of each conversation handed to your team. United States.
Sentry receives error reports, which can include part of a conversation. United States.
Cloudinary stores logos and files attached to your notes. United States.

The booking platform, Dropbox account or other system you connect is your own provider, not ours. Breezy reads and changes it with the access you give, and your agreement with that provider covers what it holds. OpenWeather answers weather questions and gets only a place. Stripe, Google Ads, Hotjar and Cloudflare Turnstile handle our own accounts and marketing, and are covered by our Privacy Policy.

Before we add or replace a company that handles your customers' data, we email your account owners at least 30 days ahead and update this page. If you object on reasonable data protection grounds and we cannot resolve it, you can stop using Breezy and we delete your data as below.

Where it goes.

We are based in the United Kingdom. The EU recognises UK data protection as adequate until 27 December 2031, and Switzerland recognises it too. Your data is stored in Frankfurt.

Where one of the companies above handles it in the United States, the transfer relies on that company's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, or on the Standard Contractual Clauses, with the UK Addendum and the Swiss amendments, in our agreement with it.

When it ends.

We keep your conversations while your account is open. When you close it, we send you a copy of your conversations first if you ask. We then delete your customers' data within 30 days, and it leaves our host's backups within 7 days after that. Copies in server logs clear within about 7 days, and in error reports within 90 days.

Changes.

If we change this agreement in a way that matters, we email your account owners at least 30 days before the change takes effect. The date at the top changes with the page.

The law of England and Wales governs this agreement, and its courts decide disputes about it. Nothing here limits either side's rights or duties under data protection law. Write to [email protected] with any question about it.