Data Processing Agreement

1. Scope and roles

This agreement covers the personal data we process for you when your websites send data to Glai through the tracking script, the identify call, events, the API or a connected payment provider ("customer personal data"). For it, you are the controller and we are the processor. Words such as "controller", "processor", "personal data breach" and "data subject" have the meaning given in the GDPR.

If this agreement and the Terms conflict about customer personal data, this agreement wins.

2. Details of the processing

3. Our obligations as processor

We will:

• process customer personal data only on your documented instructions, which are the Terms, this agreement and your use of the service's settings, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it), and tell you if we believe an instruction breaks data protection law;
• make sure everyone allowed to process it is bound by confidentiality;
• take the security measures in section 6;
• use sub-processors only as section 7 allows;
• help you, taking into account the nature of the processing, to answer data subjects' requests (section 8), and with security, breach notification, data protection impact assessments and consultation with a regulator;
• delete or return the data when the service ends (section 9);
• make available the information needed to show we comply, and allow audits (section 10);
• never sell customer personal data, use it for our own purposes or for advertising, or combine it with data from other customers or sources (including as a "service provider" under the CCPA/CPRA).

4. Your obligations as controller

You confirm that you have a lawful basis for the processing, have given your visitors the information the law requires, have obtained any consent required (including for storing the visitor id on their device in standard mode where the ePrivacy rules or similar laws require it), and that your instructions comply with the law.

5. International transfers

Customer personal data is stored in Australia and may be accessed by the sub-processors in section 7 in the countries listed there. Where a transfer from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) and, for onward transfers, Module 3, are incorporated into this agreement, with the UK International Data Transfer Addendum and the Swiss amendments where those apply. [Annex details and clause options (docking clause, Clause 9 option, Clause 17 governing law, Clause 18 courts) to be completed by the lawyer.]

6. Security measures

• IP addresses are never stored; positions are rounded to about 10 km; privacy mode stores nothing on the visitor's device.
• Encryption in transit (HTTPS, HSTS) and at rest (database and storage providers); third-party secrets encrypted with AES-256-GCM; passwords, API keys and session tokens stored only as hashes.
• Every request is checked for the workspace it may see; roles inside workspaces; staff access limited by role, re-checked on every request and audited.
• Rate limits on the collector, sign-in and API; collection accepted only from your website's own domain.
• Data minimisation in AI features: only aggregated statistics are sent to the AI provider, never visitor ids, names, emails or IP addresses.
• Backups and point-in-time recovery by the database provider.

7. Sub-processors

You give general authorisation for us to use sub-processors. The current ones that can process customer personal data are:

We impose data protection terms on each sub-processor that are no less protective than this agreement and remain responsible for them. We will announce a new or replaced sub-processor on this page and by email to account owners at least 30 days before it starts; you may object on reasonable data protection grounds by emailing hello@glai.io within that period, and if we cannot resolve it, you may end the affected service and receive a refund of prepaid fees for the remaining period.

8. Data subject requests

If a visitor contacts us directly, we will pass the request to you without undue delay and not answer it ourselves unless you ask us to. You can delete a website and all of its data in the app; for a request about one visitor (for example a person you identified by email), email us and we will help you find and delete that visitor's data.

9. Deletion and return

Raw events are deleted when they pass your plan's retention. When you delete a website, its data is deleted. When your account closes, we delete customer personal data within 30 days, unless the law requires us to keep it; data in backups is overwritten on the backup provider's normal cycle. Before closing, you can export your data through the API.

10. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data, with what we know about its nature, the data and people affected, likely consequences and the measures taken, and update you as we learn more. Notifying a regulator or data subjects is your decision as controller; we will help.

11. Audits

We will answer reasonable written questions about our compliance and share relevant documentation. If that is not enough to show compliance, or a regulator requires it, you may audit us, at your cost, no more than once a year, on 30 days' notice, during business hours, by an auditor bound by confidentiality, without access to other customers' data.

12. Liability and term

Each party's liability under this agreement is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses do not allow a limit. This agreement lasts as long as we process customer personal data for you.