Data Processing Agreement

Processing covers storing the Customer's business and inventory data; receiving messages, comments, reviews, and leads from connected channels; generating draft replies, posts, and website content with an AI model; and carrying out approved or automated actions on the Customer's connected accounts. Processing lasts while the Customer's account is active and for the deletion period in Section 11.

Data subjects are the Customer's owner (name, email, phone) and the Customer's own customers and leads who interact with the business on connected channels (name or profile name, phone number, platform user ID, message and comment content, review text and rating, and consent records).

Trackye does not intentionally process special categories of personal data. The Customer should not ask agents to collect them.

We will: (a) process personal data only on the Customer's documented instructions; (b) ensure authorized personnel are bound by confidentiality; (c) maintain the security measures in Section 7; (d) help the Customer respond to data subject requests; (e) notify the Customer of a personal data breach as set out in Section 9; and (f) provide information reasonably needed to demonstrate compliance with this DPA.

The Customer authorizes the sub-processors in the table below. We will notify Customers by email or in-app notice before adding or replacing a sub-processor, with the chance to object on reasonable data-protection grounds.

Customer data sent to our AI model provider is used only to generate a response for the Customer's request. Neither we nor the provider use Customer data to train AI models.

We maintain the measures on our Trust & Security page, including encryption in transit and at rest, AES-256-GCM encryption of platform access tokens, row-level security isolation between businesses, restricted agent identities, redacted logging, and rate limiting.

Some sub-processors process data outside India, including in the United States. For those transfers we rely on the sub-processor's safeguards and will put Standard Contractual Clauses or an equivalent mechanism in place with the Customer on request.

We will notify the Customer without undue delay, and within 72 hours of becoming aware, of a confirmed breach affecting the Customer's personal data. The notice will describe what happened, the data and people affected, and the steps taken.

If a data subject contacts us directly about Customer data, we will pass the request to the Customer and help the Customer respond, including deleting the person's contact record and conversations.

When the Customer deletes its account, or on written request, data enters a 30-day grace period and is then permanently deleted from production systems, as described on our Data Deletion page, unless the law requires us to keep it. Backups are overwritten on our standard cycle.

Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the laws of India, with exclusive jurisdiction in the courts of Dehradun, Uttarakhand, without prejudice to any mandatory data-protection law that gives the Customer rights in another forum.