Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (“Customer”) and CanWeChat (“Processor”) when Customer Content includes personal data of end users (“Visitor Data”) processed through the widget, inbox, integrations, or webhooks.

Customer is the controller (or “business”). CanWeChat is the processor (or “service provider”) for Visitor Data. For account and billing data, CanWeChat acts as an independent controller as described in the Privacy Policy.

Processor will process Visitor Data to provide the Service for the duration of Customer’s subscription/trial and any post-termination retention required by the Terms or law.

Nature of processing: hosting, transmission, storage, display, routing to Customer-selected destinations, and security monitoring. Types of data: message content, optional identity traits, page metadata, and related technical metadata. Data subjects: Customer’s website visitors and other individuals Customer chooses to include in conversations.

Processor will process Visitor Data only on documented instructions from Customer, including configuration in the dashboard (domains, reply channels, webhooks) and these Terms/DPA, unless required by law. Customer is responsible for the lawfulness of instructions and for notices/consents to visitors.

Processor ensures personnel authorized to process Visitor Data are bound by confidentiality obligations.

Processor implements appropriate technical and organizational measures described on the Security page, including encryption in transit, encryption of integration secrets at rest, hashed visitor tokens, workspace isolation, HMAC-signed webhooks, and rate limiting.

Customer authorizes Processor to engage the subprocessors listed at /subprocessors. Processor will impose data-protection obligations no less protective than this DPA. Material additions will be reflected on that page; Customers who need advance email notice may request it at hello@canwechat.dev.

Taking into account the nature of processing, Processor will assist Customer with data subject requests, security, and DPIA-related information reasonably available to Processor. Customer remains primarily responsible for responding to visitor requests about Customer’s site.

Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Visitor Data, and will provide information reasonably available to help Customer meet legal obligations.

Customer may export and delete conversations in the dashboard. Upon termination, Customer should export needed data. Processor will delete or anonymize Visitor Data from primary systems within a commercially reasonable period, except where retention is required by law or for secure backups that expire on a rolling schedule.

Upon written request no more than once per year (unless a breach or regulatory inquiry requires more), Processor will provide reasonable information to demonstrate compliance with this DPA, such as security summaries and subprocessors. On-site audits are not offered by default for a small SaaS; alternative assurance may be arranged in good faith for enterprise Customers.

Where Visitor Data is transferred internationally, Processor relies on subprocessors’ applicable transfer mechanisms. Additional SCCs may be executed upon request for Customers that require them.

If there is a conflict between this DPA and the Terms regarding Visitor Data processing, this DPA controls.