Data processing agreement

Draft terms for how we process personal data on our clients' behalf. Signed versions are part of each client's order form. Last updated October 2026.

Parties and scope

This agreement forms part of the contract between Conversley (the processor) and the client (the controller) and applies to personal data of the client's customers and staff that Conversley processes to provide the service.

Instructions

Conversley processes personal data only on the client's documented instructions: answering customers, handing chats to people, running the integrations and reports the client sets up, and keeping data for the period the client chooses. If an instruction appears to break the law, Conversley tells the client.

Confidentiality and staff

Only authorised staff who need access to provide or support the service can access client data, and they are bound by confidentiality.

Security measures

Encryption in transit; keys to the client's systems encrypted at rest; access limited by role; two-step login for administrators; audit log of settings changes; masking of card, bank and ID numbers in stored chats when switched on; automatic deletion after the retention period; nightly backups; monitoring and alerts.

Sub-processors

Supabase, Vercel, Anthropic, Meta, OpenAI (voice notes), Twilio (phone calls), Postmark (email), Stripe and Paymob (payments). We give at least 30 days' notice before adding or replacing a sub-processor, and the client may object.

International transfers

Where data leaves Egypt or Saudi Arabia, the transfer relies on the safeguards and permissions required by Egyptian Law No. 151 of 2020 and the Saudi Personal Data Protection Law. The storage region is named in the client's order form.

Helping the client

Conversley helps the client answer data subject requests (access, correction, deletion, export) and carry out impact assessments, using the export and deletion tools in the service.

Breaches

Conversley notifies the client without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the client's personal data, with the information the client needs to meet its own obligations.

End of service

At the end of the service the client can export its data for 30 days, after which it is deleted from live systems; backups are overwritten within 35 days.

Audits

Conversley makes available the information needed to show compliance with this agreement and allows reasonable audits with 30 days' notice, at most once a year unless a breach has occurred.

Questions: sales@conversley.com · Privacy policy · Terms of service