Data processing agreement

This Data Processing Agreement (“DPA”) is part of the Terms of service between Pixel Port LLC, a Florida limited liability company, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States (“Concierge”, “Processor”) and the Customer (“Controller”). It applies whenever Concierge processes Customer Personal Data on the Customer’s behalf. It takes effect when the Customer accepts the Terms; no signature is needed. If the Customer needs a countersigned copy, email legal@conciergesdk.com.

1. Definitions

• Data Protection Law: all privacy and data protection laws that apply to the processing, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada’s PIPEDA, and US state laws such as the California Consumer Privacy Act as amended (“CCPA”).
• Customer Personal Data: personal data in Customer Data (as defined in the Terms) that Concierge processes on the Customer’s behalf, mainly data about the end users of the Customer’s apps and websites. Personal data of the Customer’s own staff that Concierge uses to run the account (sign in, billing) is not Customer Personal Data: Concierge handles it as a controller under its Privacy policy.
• SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• Subprocessor: a third party Concierge engages that processes Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data breach”, “processing” and “supervisory authority” have the meanings in the GDPR. Under the CCPA, Concierge is a “service provider” and the Customer a “business”.

2. Roles and instructions

2.1 The Customer is the controller (or a processor acting for its own controller) and Concierge is the processor of Customer Personal Data.

2.2 Concierge processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, the Customer’s configuration of the Service (for example turning the AI agent on, connecting integrations, sending lifecycle emails) and requests made through the dashboard, API or MCP server are the Customer’s complete instructions. Concierge will tell the Customer if it believes an instruction breaks Data Protection Law, unless the law forbids it.

2.3 The Customer is responsible for the lawfulness of the data it sends and of its instructions, including giving its end users the notices required by law (that support chats go to Concierge, and that replies may be written by AI) and obtaining any consents. The Customer decides which personal data enters the Service, including data its end users type into a chat, and is responsible for not sending special category or other sensitive data without a lawful basis (Terms, section 4).

2.4 CCPA. Concierge will not sell or share Customer Personal Data (as those terms are defined in the CCPA); retain, use or disclose it for any purpose other than the business purposes in Annex I, or outside the direct business relationship with the Customer; or combine it with personal information it receives from other sources, except as the CCPA permits for service providers. Concierge will comply with the CCPA and tell the Customer if it can no longer do so. The Customer may take reasonable steps to stop unauthorized use.

2.5 Concierge is not responsible for processing it carries out in line with the Customer’s instructions, for the Customer’s own compliance with Data Protection Law as a controller, or for data the Customer exports, deletes or shares through the Service, including through API keys, MCP connections and coding agents it connects.

3. Confidentiality

Concierge ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality and only accesses it as needed to provide, secure or support the Service.

4. Security

Concierge implements and maintains the technical and organizational measures in Annex II. Concierge may update them as long as the overall level of protection does not decrease.

5. Subprocessors

5.1 General authorization. The Customer gives Concierge general written authorization to engage Subprocessors. The current list is on the Subprocessors page and in Annex III.

5.2 Notice of changes. Concierge will give the Customer at least 30 days’ notice before a new Subprocessor starts processing Customer Personal Data, by email to the organization owner(s) and by updating the Subprocessors page and its feed at /legal/subprocessors.xml. In an emergency (for example to replace a failing provider to keep the Service running) the notice may be shorter, and Concierge will give it as soon as possible.

5.3 Objection. The Customer may object on reasonable data protection grounds within the notice period by emailing privacy@conciergesdk.com. The parties will discuss it in good faith. If Concierge cannot offer a reasonable alternative, the Customer may terminate the affected Service by written notice before the change takes effect, and Concierge will refund prepaid fees for the unused part of the billing period. This refund is the Customer’s sole and exclusive remedy for an objection.

5.4 Concierge imposes data protection obligations on each Subprocessor that are no less protective than this DPA, and remains liable to the Customer for its Subprocessors’ performance of those obligations, subject to section 12.

6. Data subject requests

6.1 Taking into account the nature of the processing, Concierge gives the Customer tools to answer data subject requests itself: for any end user, the Customer can export their data as JSON and delete their data (including conversations, messages, photo attachments and devices) from the dashboard, the API, or the MCP server.

6.2 If Concierge receives a request directly from a data subject of the Customer, it will not answer it except to redirect them to the Customer, and will tell the Customer without undue delay if the request identifies them.

7. Personal data breaches

Concierge will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Concierge will take reasonable steps to contain and fix the breach and give the Customer the information it reasonably needs for its own notifications. Notifying a breach is not an admission of fault.

8. Assistance

Concierge will give reasonable help, using information available to it, with the Customer’s data protection impact assessments and prior consultations with supervisory authorities, to the extent the Customer cannot do them with the documentation Concierge publishes.

9. Deletion and return

9.1 Return. During the term, including any notice period before the Terms end, the Customer can export (return) and delete Customer Personal Data at any time with the tools in section 6.1. The Customer chooses return by exporting before the Terms end.

9.2 Deletion. When the Terms end, the Customer instructs Concierge to delete Customer Personal Data. Concierge may delete it immediately, and deletes it no later than 30 days after the Terms end, except as set out in 9.3. Deleted data rolls out of encrypted backups within 30 days of deletion.

9.3 Ending without notice. If Concierge ends the Terms without prior notice, it keeps Customer Personal Data for 7 days after the Terms end and, on the Customer’s written request to privacy@conciergesdk.com within that time, provides an export before deleting it under 9.2.

9.4 Error events in Concierge’s self-hosted error tracker are kept for at most 30 days and scrubbed of message content and contact details on capture. Concierge may keep data the law requires it to keep, protected under this DPA.

10. Audits

Concierge will make available the information reasonably needed to show compliance with this DPA, including this DPA’s annexes and answers to reasonable security questionnaires (at most once a year unless a supervisory authority requires more or after a breach). If that is not enough, the Customer may audit Concierge, at its own cost, with 30 days’ notice, during business hours, through an independent auditor bound by confidentiality, in a way that does not disrupt the Service or expose other customers’ data.

11. International transfers

11.1 Concierge’s primary servers and database are in Canada (OVHcloud, Beauharnois, Quebec), which benefits from an EU adequacy decision. Photo attachments and encrypted database backups are stored in Cloudflare R2 in North America (United States). Other Subprocessors also process data in the United States, as listed in Annex III.

11.2 EEA. To the extent processing involves a transfer of Customer Personal Data from the EEA to Concierge, or onward from Concierge to a Subprocessor, in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor; Clause 7 (docking) applies; in Clause 9, Option 2 (general written authorization) applies with the notice period in section 5.2; the optional language in Clause 11 does not apply; in Clause 13, the competent supervisory authority is the one of the member state where the Customer is established or, if it is not established in the EU, where its EU representative is; failing both, the Irish Data Protection Commission; in Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland. Annexes I, II and III of this DPA complete the SCCs’ annexes.

11.3 UK. For transfers from the UK, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) applies, with the information in Annex I completing its tables; either party may end it as set out in its Section 19.

11.4 Switzerland. For transfers from Switzerland, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as competent authority, references to the GDPR read as references to the Swiss FADP, and “member state” including Switzerland for data subjects to bring claims there.

11.5 If the SCCs conflict with this DPA, the SCCs win.

12. Liability and order of precedence

12.1 One cap, not two. Each party’s liability arising out of or related to this DPA (including the SCCs, to the extent the SCCs allow), whether in contract, tort or otherwise, is subject to the exclusions and limits in section 9 of the Terms. Claims under this DPA and under the Terms count together toward the single aggregate cap in the Terms; this DPA does not create a separate, additional or unlimited liability.

12.2 What is not limited. Nothing in this DPA limits either party’s liability to data subjects under the third party beneficiary rights in the SCCs, or any liability that Data Protection Law does not allow to be limited.

12.3 Fines. A fine or penalty imposed by a supervisory authority or regulator is borne by the party it is imposed on and cannot be recovered from the other party, except to the extent it results from the other party’s breach of this DPA, and then only within the limits in 12.1. Costs the Customer incurs because of its own role as controller (for example notifying its end users or regulators) are its own.

12.4 Precedence. If this DPA conflicts with the Terms, this DPA wins for matters about personal data, except that section 9 (liability cap) and section 11 (disputes) of the Terms always apply. If the SCCs conflict with either, the SCCs win.

Annex I: Description of the processing

Parties. Data exporter: the Customer, as identified in its account, contact via the organization owner’s email; role controller (or processor). Data importer: Pixel Port LLC, a Florida limited liability company, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States, contact privacy@conciergesdk.com; role processor.

Categories of data subjects. End users of the Customer’s apps and websites who open the support chat or receive messages through it; the Customer’s staff to the extent they appear in conversations.

Categories of personal data.

• Identity: the user id the Customer passes to identify, and name and email if the Customer provides them.
• Device data: a random install id generated by the SDK, platform, OS version, app version, SDK version, device model, language and locale, push token.
• Content: chat messages, photos the end user chooses to attach, card interactions (review, offer, paywall cards), satisfaction scores.
• Context the Customer chooses to send: metadata, breadcrumbs, current screen, custom attributes.
• Purchase and subscription status, only if the Customer connects the App Store, Google Play or RevenueCat.
• Product interaction events (chat opened, message sent and similar; never message text), unless the Customer turns analytics off.
• Network data: IP address, used transiently for security, abuse prevention and rate limiting.
• Results of in app tools the Customer defines and the end user allows.

Special categories. None are intended. The Customer should not send special category data unless needed and lawful (Terms, section 4).

Frequency. Continuous, for as long as the Customer uses the Service.

Nature and purpose of the processing (business purposes). Hosting, storing and transmitting support conversations; delivering push notifications and, if turned on, lifecycle emails; generating AI replies and other AI features the Customer turns on; spam and abuse screening; analytics shown to the Customer; security, troubleshooting and support of the Service.

Duration and retention. For the term of the Terms, then as in section 9. Raw product interaction events are kept at most 90 days, then only as aggregates.

Subprocessor transfers. As listed in Annex III, for the purposes stated there.

Competent supervisory authority. As set out in section 11.2.

Annex II: Security measures

Infrastructure and network

• The application server has no public inbound ports. All traffic reaches it through an outbound Cloudflare tunnel, behind Cloudflare’s firewall, DDoS protection and rate limiting.
• TLS for all traffic in transit, between clients, Cloudflare and our server.
• Administrative access only over a private Tailscale network, with individual accounts. The deployment panel is not reachable from the internet.
• Separate Postgres instance for Concierge, not shared with other applications. Container CPU and memory limits isolate Concierge from other workloads.

Data protection

• Database backups and write ahead logs are encrypted (AES-256) before they leave the server and stored in Cloudflare R2. Restores are tested with a documented drill.
• Push credentials (APNs keys, FCM service accounts) are encrypted at rest with a key kept outside the database.
• API keys are stored only as SHA-256 hashes and shown once on creation.
• Error reports are scrubbed of message text, email addresses, tokens and auth headers before they leave the client or server, and again on ingestion, and go only to our self-hosted error tracker. IP addresses are anonymized. Retention is 30 days.
• Product analytics events never contain message text, names or emails.

Access control and tenant isolation

• Every record carries its organization id, and every query is scoped to the caller’s organization through a shared helper covered by automated tests.
• Role based access in the dashboard (owner, admin, member). Destructive actions (deleting end user data, organizations) need owner or admin rights and an explicit confirmation.
• MCP and API keys are scoped (read or write), revocable and rate limited. OAuth 2.1 for MCP clients.
• SDK requests are tied to an app key, with optional end user identity verification (a token signed on the Customer’s server) so one user cannot read another’s history, and device attestation (Apple App Attest, Google Play Integrity) to block forged clients. Web requests are only accepted from origins the Customer lists.
• Staff access to production data is limited to what is needed to operate and support the Service, and is logged.

Application security

• Input validation on every endpoint, CSRF protection on the dashboard, signed and expiring links, rate limits per IP, key and device.
• Untrusted content (end user messages, webpages read by the knowledge autopilot) is isolated from instructions given to AI models, and AI tools that act in the app require the end user’s consent.
• Dependency updates, code review and automated tests before every deploy. Images are built in CI and pulled by the server; nothing is built on the server.

Monitoring and incident response

• Metrics, logs and alerts (Prometheus, Loki, Grafana) for availability, latency, error rates and abnormal volumes, with on call alerts.
• A documented incident process with customer notification as in section 7.

Availability

• An offline queue in every SDK, so messages typed during an outage are delivered once the Service is back.
• Point in time recovery from the encrypted write ahead log archive.

Annex III: Subprocessors

The Subprocessors below process Customer Personal Data. Stripe, which only handles the Customer’s own billing data, is listed on the Subprocessors page for completeness but is not a Subprocessor under this DPA. GlitchTip is not a Subprocessor: Concierge runs it itself on its own server.

OVHcloud

Purpose

Dedicated server that runs the Concierge API, worker, MCP server, the Postgres database and our self-hosted error tracking (GlitchTip).

Data

All service data: account data, conversations, end user profiles, device data, knowledge docs, logs.

Location

Beauharnois, Quebec, Canada

End user data

Yes

Transfer safeguard

EU adequacy decision for Canada (commercial organisations under PIPEDA); UK and Swiss equivalents.

Cloudflare

Purpose

DNS, TLS, CDN, firewall and the tunnel in front of our server; hosting for this website and the dashboard (Pages); R2 object storage for photo attachments and encrypted database backups.

Data

All traffic in transit (including IP addresses and request contents), attachments, encrypted backups.

Location

Global edge network; Cloudflare, Inc. is based in the United States. R2 buckets: Western North America (United States).

End user data

Yes

Transfer safeguard

EU-US Data Privacy Framework certification and Standard Contractual Clauses in the Cloudflare DPA.

Anthropic

Purpose

Claude models that write AI replies when the AI agent is on, and power the knowledge autopilot, spam filter, translation and review reply drafts.

Data

Conversation text and photos sent to the AI, the knowledge docs and app context needed for the reply.

Location

United States

End user data

Yes

Transfer safeguard

Standard Contractual Clauses in the Anthropic commercial terms and DPA. Under those terms Anthropic does not train models on API data.

Resend

Purpose

Sending transactional email: sign in codes and links, team invites, new message notifications and digests to your staff, and (only if you turn them on) renewal heads up emails to your end users.

Data

Recipient email address, name, email content, delivery metadata.

Location

United States

End user data

Yes

Transfer safeguard

Standard Contractual Clauses in the Resend DPA.