Data Processing Addendum
Last updated: September 14, 2026
This addendum explains how FluentChat processes personal data on a customer’s documented instructions.
1. Scope and roles
This Data Processing Addendum (“DPA”) supplements the FluentChat Terms of Service. When FluentChat processes personal data contained in Customer Content for a customer, the customer acts as controller (or processor acting for its controller) and FluentChat acts as processor (or subprocessor). This DPA applies for as long as FluentChat processes that data.
2. Processing instructions
FluentChat will process Customer Personal Data only to provide, secure, support, and maintain the Services; to prevent abuse; and on the customer’s documented instructions, including the customer’s use of the Services. We may process data differently only where required by applicable law, and will notify the customer where legally permitted. If an instruction appears to conflict with data-protection law, we will say so rather than carry it out quietly.
3. Details of processing
| Data subjects | Customer-authorized users, website visitors, contacts, agents, and other people whose data the customer submits. |
|---|---|
| Data categories | Account and contact identifiers, chat messages, attachments, knowledge sources and documents, bot configuration, session identifiers, visitor telemetry, and other data submitted by the customer. |
| Purpose | To provide the chatbot, knowledge-base, live-chat, integration, analytics, security, and support functions selected by the customer. |
| Operations | Collection, storage, retrieval, transmission, AI-assisted processing, organization, deletion, and other operations necessary to provide the Services. |
| Duration | For as long as the customer’s account is active, plus the wind-down period described in Section 10. |
4. Confidentiality and security
FluentChat limits access to authorized personnel and providers with a need to know who are subject to confidentiality obligations. We maintain technical and organizational safeguards appropriate to the processing, including access controls, authentication, scoped permissions, logging, deletion workflows, and encryption of data in transit and at rest. Customers remain responsible for their account permissions, host-site disclosures, and the content they choose to process.
5. Subprocessors
FluentChat may use carefully selected subprocessors to provide infrastructure, storage, AI processing, payments, communications, monitoring, and support. The categories and named providers are described in our Privacy Policy. We require subprocessors to protect Customer Personal Data with obligations appropriate to their role, and we remain responsible for their performance.
Before a new subprocessor starts handling Customer Personal Data, we will update the list in the Privacy Policy and give notice through the channels available to the customer. If a customer has a reasonable data-protection objection to a new subprocessor, they can raise it with us within 30 days of that notice and we will work with them on an alternative. If we cannot find one, the customer may stop using the affected part of the Services and terminate the relevant subscription.
6. AI processing and model training
Providing the Services means sending parts of Customer Content — prompts, retrieved passages, chat messages — to the AI providers listed in the Privacy Policy, so a bot can answer. That is processing on the customer’s instructions, and nothing more.
We do not train our own models on Customer Content, and we do not permit our AI subprocessors to train their models on it. AI output can be wrong, so customers should treat it as assistance rather than as a verified answer, particularly in regulated settings.
7. Requests and incidents
If FluentChat receives a data-subject request concerning Customer Personal Data, we will direct the requester to the customer where appropriate and assist the customer where required by applicable law. If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify the customer without undue delay and provide information reasonably available to support the customer’s legal obligations. We will also give reasonable help with security reviews, data-protection impact assessments, and prior consultations with a supervisory authority, where the customer needs them and the information is ours to give.
8. International transfers
Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country without an applicable adequacy decision, the parties will rely on a valid transfer mechanism, including the European Commission’s Standard Contractual Clauses and the UK Addendum where applicable. Our Privacy Policy describes where data is stored and which subprocessors may handle it outside that region. A customer may contact us for a copy of the clauses that apply to its use of the Services, or for transfer information it needs for its own records.
9. Audit assistance
On reasonable written request, FluentChat will make information reasonably necessary to demonstrate compliance with this DPA available to the customer, taking into account confidentiality, security, and operational safeguards. Any audit request must be proportionate, protect other customers’ confidential information, and be coordinated in advance.
10. Return and deletion
While an account is open, a customer can export its data from the dashboard or ask us for help getting it out. Requests for export assistance go to the contact address below, and we will not hold data hostage at the end of a subscription.
When a customer deletes its account, FluentChat begins deletion of associated teams, bots, and related data through secure deletion workflows. Deletion completes within 30 days, except where law requires us to keep something longer — billing records being the usual example. Customer Personal Data may persist in encrypted backups after that, until those backups expire on their normal rolling schedule or are replaced.
11. Contact
Questions about this DPA or requests for assistance may be sent to contact@fluentchat.ai.