Data processing addendum
Effective 7 October 2026
This addendum is part of our terms of service. It applies automatically to every customer; you don't need to sign anything separately.
1.Scope and roles
This addendum forms part of the terms of service between ReeBot (“processor”) and the customer (“controller”). It applies when we process personal data in customer data on the customer's behalf, and meets Article 28 of the UK GDPR and the EU GDPR. If anything in the terms conflicts with this addendum on data protection, this addendum wins.
The customer is responsible for having a lawful basis for the processing, for the notices and consents its end users need, and for the instructions it gives through its settings.
2.Processing on documented instructions
We process customer personal data only to provide the service under the terms, as configured by the customer in the dashboard and API, and on other documented instructions. If the law requires other processing, we will tell the customer first unless the law forbids it. We will tell the customer if we think an instruction breaks data protection law.
3.Confidentiality
Everyone we authorise to process customer personal data is bound by confidentiality and has access only to what their role needs.
4.Security
We maintain the technical and organisational measures in annex 2, appropriate to the risk. We may improve them over time, but won't reduce the overall level of protection.
5.Sub-processors
The customer authorises us to use the sub-processors listed on our sub-processors page. We bind each one to data protection terms at least as protective as this addendum and remain responsible for them.
We will give at least 30 days' notice of a new sub-processor by updating that page and emailing workspace owners. The customer may object on reasonable data protection grounds within that period; if we can't resolve the objection, the customer may cancel the affected service and receive a refund of prepaid fees for the remaining period.
Services the customer connects with its own accounts, such as Meta (WhatsApp and Instagram), Telegram and Twilio, are the customer's own providers, not our sub-processors.
6.International transfers
Where customer personal data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (module 2, or module 3 for transfers to sub-processors) and the UK International Data Transfer Addendum, which are incorporated by reference, together with any additional safeguards needed.
7.Helping the customer meet its obligations
Taking into account the nature of the processing, we help the customer to:
- answer data subject requests. The dashboard lets the customer find, export and delete everything held about a person by email address or phone number, delete single conversations and leads, and set retention periods. We forward any request we receive directly to the customer;
- keep personal data secure, notify personal data breaches, and carry out data protection impact assessments and prior consultations where required.
8.Personal data breaches
We will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice will describe the breach, its likely consequences, the measures taken or proposed, and a contact for more information, with further details as they become available.
9.Deletion and return
The customer can export leads and orders as CSV, conversations through the REST API, and a person's data as JSON at any time. When the customer deletes a workspace or its account, we delete the customer personal data in it, including uploaded files, straight away from live systems, and from backups as they expire on their rolling cycle, unless the law requires us to keep it. Retention settings the customer chooses are applied automatically.
10.Information and audits
We will make available the information needed to show compliance with this addendum, and allow for and contribute to audits by the customer or an auditor it appoints, on reasonable notice, at most once a year (unless required by a regulator or after a breach), during business hours and subject to confidentiality. We may meet this first with documentation and existing certifications.
11.US state privacy laws
Where the CCPA or similar US state laws apply, we act as the customer's service provider or processor. We won't sell or share customer personal information, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, or combine it with personal information from other sources except as the law allows.
12.Annex 1: details of the processing
| Item | Details |
|---|---|
| Subject matter and duration | Providing the ReeBot service, for as long as the customer uses it and until deletion under section 9 |
| Nature and purpose | Hosting, storing, indexing and retrieving knowledge; generating AI answers and back-office AI features; routing conversations to the customer's team; sending notification, booking and follow-up emails |
| Data subjects | The customer's end users (website visitors, messaging app users, callers, leads, booking and order customers, reviewers) and team members |
| Categories of data | Contact details, conversation content, page addresses, browser language and type, messaging IDs, phone numbers and call transcripts, booking and order details, reviews, and anything the customer puts in its knowledge content |
| Special category data | Not intended. The customer must not collect it through the service unless it has a lawful basis and appropriate safeguards |
| Frequency | Continuous |
| Retention | As set by the customer (retention settings and deletions), and as described in section 9 |
13.Annex 2: technical and organisational measures
- Access control: every request is checked against the user's workspace and role (owner, admin, agent, viewer); other workspaces' data looks like it doesn't exist. Operator staff access is limited by platform roles and recorded.
- Authentication: Argon2id password hashing, a password policy, sign-in rate limits and lockout, HTTP-only secure session cookies stored only as keyed hashes, session review and revocation.
- Encryption: TLS in transit; AES-256-GCM with versioned, rotatable keys for AI provider and messaging channel credentials; server-side encryption for uploaded files in object storage; tokens and API keys stored only as HMAC-SHA256 hashes.
- Application security: CSRF protection, strict content security policies, an isolated widget frame with per-assistant allowed origins, output escaping, prompt-injection guards, SSRF protection for website import, request size and rate limits.
- Logging and accountability: an append-only audit log of privileged actions; logs that exclude passwords, tokens, keys and conversation content.
- Minimisation and retention: page addresses stored without query strings; email addresses and phone numbers kept out of chat and copilot prompts and redacted from transcripts used for lead scoring, follow-up drafts and insight reports; automatic deletion of expired sessions, tokens, empty chats and records past their retention period.
- Availability: health checks, a retried job queue and regular database backups.
14.Annex 3: sub-processors
The current list is on our sub-processors page.
15.Contact
Questions about this addendum.
- ReeBot