This Data Processing Agreement ("DPA") forms part of the HoverBot Terms of Servicebetween HoverBot ("we") and the business using HoverBot ("you"). It applies when we process personal data of your customers, prospective customers and website visitors ("Customer Personal Data") to provide the HoverBot service.
1. Roles
You are the controller of Customer Personal Data. We process it as your processor, only to provide the service you configure: answering your visitors' questions, capturing leads, looking up orders, sending the alerts and reports you turn on, and showing you analytics.
2. Instructions
We process Customer Personal Data only on your documented instructions, which are the Terms of Service, this DPA and the settings you choose in your dashboard. We do not sell it, use it for advertising, or use it to train or fine-tune language models.
3. Confidentiality
Everyone at HoverBot who can access Customer Personal Data is bound to keep it confidential and accesses it only when needed to run or support the service.
4. Security
We protect Customer Personal Data with the measures described in our Trust Center, including encryption in transit, encryption of stored access tokens and secrets, per-account access scoping, audit logging of staff access to a workspace, and separation of test and production data. We keep these measures under review and do not reduce their overall protection.
5. Subprocessors
You authorise the subprocessors listed in our Trust Center(currently Amazon Web Services for hosting in Singapore, and OpenAI for language model inference). We bind each one to data protection terms at least as protective as this DPA, and we give at least 30 days' notice on the Trust Center before adding or replacing one, during which you may object and end the service.
6. Data subjects' requests
We help you answer requests from your customers to access, correct or delete their data, including through the Shopify data request and redaction webhooks, and through deletion on request.
7. Personal data breaches
We notify you without undue delay, and in any case within 72 hours of becoming aware, of a breach affecting Customer Personal Data, with the information we have about what happened, what data, and what we are doing about it.
8. Retention and deletion
We keep Customer Personal Data for the retention period you set, or until you delete it or close your account. When the service ends, we delete Customer Personal Data within 30 days unless the law requires us to keep it.
9. Transfers
Customer Personal Data is stored in Singapore. Text sent to our language model provider may be processed in other countries under that provider's API terms, which exclude it from training. Where the law requires a transfer mechanism, we rely on the provider's standard contractual clauses.
10. Audits
On reasonable request, we give you the information needed to show compliance with this DPA, including our security policies and answers to security questionnaires.
11. Order of precedence
If this DPA and the Terms of Service conflict about Customer Personal Data, this DPA applies. It is governed by the same law as the Terms of Service.
Questions about this DPA: hi@hoverbot.ai