Data Processing Addendum

1. Roles of the parties

For personal data contained in your customer conversations, contacts, and business content, you act as the data controller and OmniInbox AI acts as the data processor.

For data we process to operate our own business — such as your account and billing information — OmniInbox AI acts as a controller, and our Privacy Policy applies.

2. Subject matter and duration of processing

We process personal data only to provide and support the platform for you, for as long as your account is active and for the limited period afterwards described in the retention section below.

3. Nature and purpose of processing

Processing activities may include:

• Receiving, storing, and displaying messages from channels you connect.
• Sending replies you compose or approve through those channels.
• Resolving identities so conversations from different channels can be linked to one customer profile.
• Storing business knowledge you provide so it can be used to answer questions and draft replies.
• Generating AI suggestions, summaries, and insights for review by your team.
• Running automations and workflows you configure.
• Providing support to you when you ask for help.

4. Categories of data and data subjects

Data subjects may include your customers, prospects, contacts, and team members.

Categories of personal data may include:

• Identifiers such as name, email address, phone number, and channel handles.
• Message content, attachments, and conversation metadata such as timestamps and channel.
• Customer relationship information such as notes, tags, lifecycle stage, and opportunity records.
• Team member account details needed for assignment and collaboration.

You should not use the platform to process special category data, payment card numbers, or health records, as it is not designed for those categories.

5. Customer instructions

We process personal data only on your documented instructions, which include your use of the platform's features and settings, unless we are required by law to do otherwise.

We will inform you if, in our view, an instruction infringes applicable data protection law.

6. Confidentiality and personnel

Access to your data by our personnel is limited to those who need it to operate the platform or provide support to you, and is subject to confidentiality obligations.

7. Security measures

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit using TLS and encryption of data at rest.
• Application-layer encryption of third-party channel credentials.
• Workspace-level data isolation enforced by database row-level security policies.
• Role-based access control within each workspace, enforced server-side.
• Verification of inbound provider requests and sanitisation of message content before display.
• Automated security scanning of database policies and dependencies, with remediation of findings.
• Secret management for application credentials, kept out of source code and out of the browser.

Our Security page describes these measures in more detail.

8. Sub-processors

You authorise us to engage sub-processors to provide the platform. We impose data protection obligations on each sub-processor that are no less protective than this DPA. Categories of sub-processor include:

• Cloud hosting and application runtime providers.
• Managed database, storage, and authentication providers.
• AI model providers used to generate suggestions, summaries, and insights.
• Communication channel providers you choose to connect, such as email and messaging platforms.
• Payment providers used for billing.
• Operational tooling such as logging and error reporting.

Contact us for the current list of named sub-processors. We will give you notice of a new sub-processor so you have an opportunity to object on reasonable data protection grounds.

9. AI processing

Where you use AI features, relevant conversation content and the business information you have provided may be sent to an AI model provider in order to generate a response.

• AI output is presented for review by your team; the platform does not send AI-generated messages to your customers automatically.
• We instruct model providers to process content only to return a response for your request.
• You can choose not to use AI features, in which case conversation content is not sent for AI processing.

10. International transfers

Our providers may process data in countries outside your own, including outside the European Economic Area and the United Kingdom. Where required, transfers rely on an appropriate transfer mechanism such as the European Commission's Standard Contractual Clauses or an adequacy decision.

11. Assistance with data subject rights

The platform provides features that let you access, correct, export, and delete data in your workspace so you can respond to data subject requests yourself.

If we receive a request directly from one of your data subjects, we will refer them to you rather than responding on your behalf, unless legally required to respond. We will provide reasonable assistance where you cannot fulfil a request through the platform.

12. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and will provide the information reasonably available to us so you can meet your own notification obligations.

13. Information and audits

On reasonable written request, we will provide information necessary to demonstrate compliance with this DPA. We do not currently hold third-party audit certifications such as SOC 2 or ISO 27001, and we will not represent otherwise.

14. Return and deletion of data

You can delete data within the platform at any time. On termination of your account, we will delete or return personal data processed on your behalf within a reasonable period, except where we are required to retain it by law.

Backups are retained for a limited period by our infrastructure providers and expire on their normal cycle.

15. Relationship to the main agreement

This DPA supplements our Terms and Conditions. Where there is a conflict on the subject of data processing, this DPA prevails. Liability remains subject to the limitations in the Terms and Conditions.

16. Contact us

For DPA requests, sub-processor lists, or privacy questions:

OmniInbox AI

Email: privacy@omniinbox.ai

Website: https://omniinbox.ai