Skip to content
RegenticFlow

Data Processing Agreement

Last updated

1. Scope

This agreement covers personal data of people who use your public assistants, pages, embedded widgets and booking forms (“Visitor Data”): conversations, contact details, leads, tickets, bookings and the technical data needed to run and protect them. Your own account data is covered by our Privacy Notice instead.

2. Your obligations as Data Fiduciary

  • Decide the purpose of collecting Visitor Data and collect only what that purpose needs.
  • Give visitors a notice that meets section 5 of the DPDP Act — set your privacy policy link on the assistant so we can show it — and obtain consent where it is required, including a consent line on lead forms.
  • Not direct your assistant at children or collect children's data without verifiable parental consent.
  • Answer visitors' requests to access, correct or erase their data, and their grievances.
  • Set retention periods no longer than your purpose needs.

3. Our obligations as Data Processor

  • Process Visitor Data only to provide the service to you, on your instructions as set in your account.
  • Never sell it, never use it to train AI models, never use it for our own marketing.
  • Keep it isolated to your account and protected by reasonable security safeguards, including encryption.
  • Delete it at the end of the retention period you set, when you erase it, and when your account is erased.
  • Ensure everyone who can access it is bound by confidentiality.

4. Sub-processors

You authorise us to use the sub-processors below, each bound by terms protecting the data at least as well as these. We will update this list before adding one, and you may stop using public assistants if you object.

  • MongoDB Atlas — Database hosting. Region chosen at deployment (AWS).
  • Vercel — Application hosting and delivery. Global edge; functions in the deployment region.
  • OpenAI — AI answers, document reading, embeddings and transcription — not used to train their models. United States.
  • Amazon Web Services S3 / Cloudflare R2 — File storage. Region chosen at deployment.
  • Resend — Sending and receiving email. United States.
  • Razorpay — Payments and subscriptions. India.
  • Google (Firebase Auth, Drive, Calendar) — Google sign-in and the integrations you connect. United States / global.
  • Inngest — Background job processing. United States.
  • Cloudflare Turnstile — Bot protection on public assistants. Global.
  • Sentry — Error monitoring (no names, emails, cookies or content). United States.
  • Groq — Voice transcription, when enabled. United States.
  • Microsoft Edge text-to-speech — Reading answers aloud, when enabled. Global.

5. Helping you with visitors' rights

Your Inbox lets you find everything held about a visitor by email address, export it, and erase it across all your assistants. If a visitor contacts us directly we forward the request to you and record that we did.

6. Personal data breaches

If we become aware of a breach affecting Visitor Data we will tell you without undue delay, with what we know about its nature, extent and likely impact, and give you the help you reasonably need to notify affected visitors and the Data Protection Board of India.

7. When it ends

When your account is erased, all Visitor Data is deleted with it. Export it first if you need to keep it — it's yours.

8. Contact

Grievance Officer, RegenticFlow · privacy@regenticflow.com