Data Processing Agreement

01Definitions

• Data Protection Laws means all laws that apply to the processing of Personal Data under the Agreement, including, where they apply, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).
• Personal Data, Processing, Data Subject, Controller and Processor have the meanings given in the GDPR, whichever Data Protection Law applies to a given Data Subject.
• Customer Personal Data means Personal Data that Skavelo processes on Customer’s behalf to provide the service, as described in sections 4 to 6.
• Sub-processor means a third party Skavelo engages to process Customer Personal Data on its behalf.
• Users means the people who use Customer’s product and interact with Skavelo there.

02Roles of the parties

Customer is the Controller of Customer Personal Data, and Skavelo is a Processor acting only on Customer’s documented instructions. Those instructions are this DPA, the Agreement, and how Customer sets up Skavelo: the websites and product it learns, the test account it uses, the user details Customer sends, and the lookups, actions and other settings Customer switches on.

For its own customers’ account and billing information, Skavelo is a Controller, and its Privacy Policy applies instead of this DPA.

03Subject matter and duration

Skavelo processes Customer Personal Data for the duration of the Agreement, and afterwards only as described in section 12 or as the law requires.

04Nature and purpose of processing

Skavelo processes Customer Personal Data only to provide the service to Customer, which means:

• learning Customer’s product and documentation from the websites and test account Customer provides;
• answering Users’ questions, showing walkthroughs, and filling in forms when a User asks;
• running the lookups and actions Customer sets up, from the User’s browser with the User’s own session;
• passing a conversation to Customer’s team when a User asks for a person;
• showing Customer its conversations, and summarising them in reports and emails to Customer;
• keeping the service secure and preventing abuse.

To write answers, Skavelo sends the relevant Customer Personal Data to AI model Sub-processors, which process it only to return a response. Skavelo doesn’t use Customer Personal Data to train AI models.

05Categories of data subjects

• Users of Customer’s product who interact with Skavelo.
• People whose data appears in the content Skavelo learns from, such as Customer’s documentation or test account.
• Customer’s own team members who use the Skavelo dashboard.

06Categories of personal data

Depending on how Customer sets up Skavelo, Customer Personal Data may include:

• Conversations: Users’ questions, Skavelo’s answers, ratings, walkthrough progress, and the actions Users approved and their outcome.
• Page context: the address and title of the page a User is on, and the labels of buttons and fields on it. Skavelo doesn’t read what Users type into fields, passwords, or anything Customer marks with data-sk-sensitive.
• User details Customer chooses to send: such as a user ID, name, email address, plan, role or other attributes.
• Lookup responses: data Customer’s product returns about a User for a lookup Customer set up. These are used to write the answer and are not stored, except for what appears in the answer.
• Handoff details: the email address and note a User gives when asking to reach Customer’s team.
• Learned content: any Personal Data visible in Customer’s documentation or test account when Skavelo learns them.
• Technical data: IP address, used transiently to work out a User’s approximate country for Customer’s targeting rules and kept in security logs, and browser details.

Skavelo doesn’t intend to process special categories of Personal Data (GDPR Article 9) or full payment card numbers, and Customer agrees not to send them to Skavelo or set up lookups that return them.

07Skavelo’s obligations

Skavelo will:

• Follow instructions. Process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise, in which case Skavelo will tell Customer first unless the law forbids it.
• Keep it confidential. Make sure everyone authorised to process Customer Personal Data is bound by confidentiality.
• Keep it secure. Maintain the security measures described below.
• Use Sub-processors only as allowed in section 8.
• Help with Data Subject requests. Taking into account the nature of the processing, help Customer respond to requests from Users to exercise their rights. Customer can delete an agent, and with it every conversation and everything that agent learned, at any time from the dashboard. Customer can find, download or delete one User’s conversations at any time in the dashboard, under Settings, User data requests, by the user ID it sends to Skavelo or by email. If Customer can’t identify the User that way, it can email hello@skavelo.com, and Skavelo will help within 30 days.
• Help with assessments. Give reasonably requested information for Customer’s data protection impact assessments and consultations with supervisory authorities, as far as they concern Skavelo’s processing.
• Report breaches. Tell Customer without undue delay, and in any case within 72 hours of becoming aware of a confirmed Personal Data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations.
• Delete or return it. When the Agreement ends, delete or, at Customer’s choice, return Customer Personal Data, except where the law requires Skavelo to keep it.
• Allow audits. Make available the information reasonably needed to show compliance with this DPA, and allow and contribute to audits by Customer or an auditor it appoints, on reasonable notice, under confidentiality, and no more than once in any 12 months unless Customer reasonably believes Skavelo isn’t complying.

08Sub-processors

Customer authorises Skavelo to engage Sub-processors to provide the service. Skavelo will:

• have a written agreement with each Sub-processor that imposes data protection obligations materially equivalent to this DPA, and stay responsible for each Sub-processor’s compliance;
• give Customer the current list of Sub-processors, what each one does and where it processes data, on written request to hello@skavelo.com;
• give Customer at least 14 days’ notice by email before adding or replacing a Sub-processor, so Customer can object on reasonable data protection grounds. If Customer objects, the parties will work in good faith to resolve it; if they can’t, Customer may end the Agreement for the affected part of Skavelo and receive a refund of prepaid fees for it.

Skavelo’s Sub-processors fall into these categories: cloud hosting, database and file storage; AI model providers; email delivery; and payment processing.

09International transfers

Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, including the United States, the transfer is made under the European Commission’s Standard Contractual Clauses (Module Two, Controller to Processor), and for UK data the UK Addendum to those clauses, which are incorporated into this DPA by reference, or under another valid transfer mechanism. Skavelo requires the same of its Sub-processors.

10CCPA

For Personal Information of California residents, Skavelo acts as a “service provider” under the CCPA. Skavelo will not sell or share Customer Personal Data, or retain, use or disclose it for any purpose other than providing the service to Customer, or outside its direct business relationship with Customer, except as the CCPA permits.

11Liability

Each party’s liability under this DPA is subject to the limitation of liability in the Agreement. Nothing here limits the rights of Data Subjects under Data Protection Laws.

12Retention and deletion

Customer Personal Data is kept until Customer deletes it or the Agreement ends. Deleting an agent deletes its conversations and what it learned; deleting a workspace or account deletes all of its agents and their data. Lookup responses aren’t stored. When Customer deletes its workspace or account, its data is deleted straight away. If the Agreement ends any other way, Skavelo deletes the remaining Customer Personal Data within 30 days. Copies in backups are removed as those backups expire.

13Term, governing law and order of precedence

This DPA lasts as long as Skavelo processes Customer Personal Data under the Agreement. It is governed by the laws of the State of Wyoming, except where Data Protection Laws or the Standard Contractual Clauses require otherwise. If this DPA conflicts with the Agreement, this DPA applies; if it conflicts with the Standard Contractual Clauses, the clauses apply.

14Contact

For Data Subject requests, questions from a regulator, the Sub-processor list, or anything about this DPA, email hello@skavelo.com, or write to Peleka LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.

15Security measures

• Encryption in transit: all connections to Skavelo, from browsers and the widget, use TLS (HTTPS).
• Credentials: passwords are hashed with bcrypt. Test account passwords Customer gives Skavelo are encrypted with AES-256-GCM before they’re stored.
• Sessions: sign in cookies are httpOnly, secure and SameSite=strict. Changing or resetting a password signs out every other session.
• Access control: roles within each workspace (owner, admin, member), checked on the server for every request.
• Workspace isolation: every query is scoped to the workspace or agent it belongs to, so one customer can’t reach another’s data.
• Widget controls: each agent answers only on the sites Customer allows. The widget never reads field values, passwords or content marked sensitive.
• Learning safeguards: while Skavelo explores Customer’s product, it blocks every request that would change data. Private network addresses are refused.
• Lookups and actions: they run only from the User’s browser with the User’s own session, only to paths on Customer’s own site; lookups only read, and actions wait for the User’s approval.
• Rate limiting: the widget’s endpoints are rate limited per visitor, and sign in and other sensitive endpoints are rate limited to slow down abuse.
• Webhooks: incoming payment webhooks are verified by signature before they’re trusted.
• Sub-processor oversight: Sub-processors are bound by data protection terms at least as protective as this DPA.