Data Processing Addendum

This Addendum forms part of the Terms of Service and applies whenever we process personal data on your behalf — in practice, whenever an assistant we operate for you handles conversations involving your customers, staff, or other individuals.

⚠ Clients with a regulated compliance programme (GDPR, CCPA/CPRA, HIPAA, or sector-specific regimes) should have counsel review this against their own obligations. We are glad to sign a client's own DPA where it reflects the same facts.

You are the controller. You decide what data your assistant can reach, what it is used for, and who may interact with it. You are responsible for the lawful basis for that processing and for any notices or consents your own users require.

Green Package Pro LLC is the processor. We process that data only to provide the service, and only on your documented instructions — which include your configuration of the assistant and your use of the service. If we believe an instruction violates applicable data protection law, we will tell you rather than silently proceed.

Categories of data: the content of conversations with your assistant, including anything your users type and anything your assistant retrieves from sources you connected; account and contact details for your administrators; and technical measurements about each request.

Categories of individuals: your end users and website visitors, your staff, and — where your assistant answers over your business records — the individuals appearing in those records, such as your own customers and contacts.

• Purpose limitation. We process your data only to provide and support the service, and to produce the anonymous measurements described in the Data Retention Policy. We do not use it to train AI models, and we do not sell it.
• Confidentiality. Our personnel with access to client data are bound by confidentiality obligations and access is limited to what their role requires.
• Security. Encryption in transit; storage in databases where access is denied by default and reachable only by our service credentials; no public route to client conversation records.
• Subprocessors. We use the subprocessors listed publicly, under written terms requiring protections consistent with this Addendum. We remain responsible for their performance.
• Deletion. Conversation content is erased after 30 days automatically, and sooner on your instruction. On termination we cease processing and delete or return your data.
• Assistance. We will assist you, at your expense where the effort is substantial, in responding to individuals exercising their rights, and in your own impact assessments and regulator consultations.
• Breach notification. We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.
• Audit. We will make available the information reasonably needed to demonstrate compliance with this Addendum, and accommodate a reasonable audit on reasonable notice, subject to confidentiality.

If an individual contacts us directly about data that reached us through your assistant, we will not respond substantively on your behalf. We will tell them to contact you, and forward the request so you can act on it. If you instruct us to delete or correct specific records in our systems, we will do so.

Our subprocessors may process data in the United States and other countries. Where a transfer requires a specific legal mechanism for your jurisdiction, contact [email protected] and we will put appropriate terms in place, including standard contractual clauses where applicable.

If your compliance programme requires processing restricted to particular jurisdictions or providers, tell us — routing can be pinned to an approved subset of providers.

Where this Addendum conflicts with the Terms of Service on the handling of personal data, this Addendum governs.