Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms when you are a TextBind customer and we process personal data on your behalf (end-user WhatsApp content, phone numbers, transcripts, identities, and action payloads). You are the controller (or processor instructing us as a sub-processor). Xunoia is the processor.

1. Subject matter and duration

Processing lasts for the term of the Service plus the retention windows in the Privacy Policy unless you instruct earlier deletion.

2. Nature and purpose

Ingest WhatsApp webhooks, transcribe audio, run an allowlisted agent, call your HTTPS endpoints, store conversation state and audit logs, and send replies via Meta using your tokens.

3. Types of personal data and data subjects

• Data subjects: people who message or are linked to your WhatsApp number; your staff.
• Data: phone numbers, display names if present, message bodies, voice transcripts, user IDs you assign, tool arguments, and technical metadata (message ids, timestamps).

You will not submit special-category data unless you have a lawful basis and tell us in writing.

4. Our obligations

• Process only on your documented instructions (the Service configuration and these Terms).
• Ensure persons we authorize are under confidentiality.
• Implement the technical measures described on Security.
• Engage sub-processors under written terms no less protective than this DPA. Object within 14 days of notice of a material change; your sole remedy if you object is to stop using the Service.
• Assist with data-subject requests, DPIAs, and breach notices (without undue delay, and within 72 hours of confirming a breach affecting your data where feasible).
• Delete or return personal data after the Service ends, except copies we must keep by law.
• Make available information reasonably necessary to demonstrate compliance and allow audits on reasonable notice, no more than once per year, under NDA, at your cost unless we are in material breach.

5. Your obligations

• Provide a lawful basis and any required notices/consents to end users.
• Do not instruct us to process data unlawfully.
• Configure actions and authentications so only intended systems receive data.

6. International transfers

Where GDPR or similar law applies, the parties incorporate the EU Standard Contractual Clauses (processor-to-processor or controller-to-processor modules as applicable), UK Addendum, and any required Swiss adaptations, with Xunoia as data importer when we process outside the relevant region. Details will be completed on request at privacy@textbind.com.

7. Order of precedence

If this DPA conflicts with the Terms on data-protection, this DPA controls.