Data Processing Addendum
This addendum is between the agency that accepts the Terms of Service (the "Agency", controller) and LanaChat legal entity name, address, registration number, a Wyoming (USA) limited liability company ("LanaChat", processor). Contact: [email protected].
1. Scope and precedence
This Data Processing Addendum ("DPA") applies whenever LanaChat processes personal data on behalf of the Agency to provide the Service, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and equivalent laws, and as a service provider contract under the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws: LanaChat does not sell or share the Agency's personal information, retain, use or disclose it outside the direct business relationship, or combine it with data from other sources except as the law permits. It is part of the Terms of Service and is accepted with them. In case of conflict on data protection matters, this DPA prevails over the Terms; the Standard Contractual Clauses, where they apply, prevail over this DPA.
2. Details of the processing
| Subject matter | Running AI and human conversations with Fans on the Agency's Telegram accounts, delivering paid media, recording sales, and operating the console, API and MCP server. |
|---|---|
| Duration | The life of the Agency's workspace, plus the 30-day export window and the roll-off of backups (90 days) described in section 9. |
| Nature | Collection from Telegram, storage, encryption, generation of replies by language models, analysis for sales and safety signals, display to the Agency's team, export and deletion. |
| Purpose | Providing the Service to the Agency as described in the Terms. No other purpose. |
| Data subjects | Fans who chat with the connected accounts; Creators whose accounts are connected. The Agency's team members are not in scope: LanaChat is the controller of their account data and activity log, as described in the Privacy Policy. |
| Categories of personal data | Telegram identifiers, names, handles, profile data, language; message content (text, voice, media) and timestamps; purchases, refunds and reversals; notes, tags, lists, tracking sources; derived signals (spending, preferences, safety flags); Creators' personas, media and bot tokens. |
| Special categories | Conversations may reveal data about sex life or sexual orientation (Art. 9 GDPR). The Agency is responsible for having a lawful basis for that processing and for its instructions. No health, biometric, genetic, political, religious or criminal data is to be stored in the Service. |
3. Instructions
- LanaChat processes personal data only on the Agency's documented instructions. The Terms, this DPA, the configuration the Agency sets in the console (accounts connected, persona, scripts, limits, lists, retention) and the actions of its team, API keys and MCP clients are those instructions.
- LanaChat informs the Agency if, in its opinion, an instruction infringes data protection law, and may suspend the instruction until it is clarified.
- Where the law of the EU or of a member state requires LanaChat to process data otherwise, it informs the Agency before processing, unless the law prohibits it.
4. The Agency's obligations
The Agency warrants that it has a lawful basis for the processing, that it gives Fans and Creators the information required by Articles 13 and 14 GDPR, that it holds the age and consent records required by the Terms, that its instructions are lawful, and that it will not instruct LanaChat to process data of minors or data outside the categories above.
5. Confidentiality
LanaChat ensures that every person authorised to process the data (employees, contractors) is bound by a confidentiality obligation by contract or by law, has received appropriate training, and accesses personal data only to the extent needed to perform the Service.
6. Security
LanaChat implements the technical and organisational measures of Article 32 GDPR, including: encryption in transit (TLS) and at rest; separate encryption of Vault media, bot tokens and API keys; workspace and role-based access control; logged administrative access to production; rate limits and anomaly detection; encrypted, separately stored and restore-tested backups; vulnerability management and secure development practices; incident response procedures. A description of the current measures is provided to the Agency on request and may be updated, without lowering the overall level of protection.
7. Sub-processors
- The Agency gives general authorisation to LanaChat to use sub-processors in the following categories: cloud hosting and storage; database and backup services; AI model providers; transactional email; error and performance monitoring; support chat infrastructure; payment and crypto on-ramp providers for top-ups.
- The current list of sub-processors with their names, roles and locations is provided to the Agency on request at [email protected] and is updated when a sub-processor changes.
- LanaChat gives the Agency at least 14 days' notice before adding or replacing a sub-processor, in the console or by email to the workspace owner. The Agency may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Agency may terminate the Terms before the change takes effect, with a refund of its unused balance under section 8.7 of the Terms regardless of the 30-day window there, as its sole remedy.
- LanaChat imposes on each sub-processor, by written contract, data protection obligations equivalent to this DPA, and remains liable to the Agency for the sub-processor's performance. AI model providers are contractually prohibited from training on the data.
8. Assistance to the Agency
- Data subject requests. LanaChat forwards to the Agency, within 5 working days, any request it receives from a Fan, Creator or team member concerning the Agency's data, and does not answer it except as instructed or as required by law. The console and the API let the Agency export, correct and delete a Fan's or Creator's data itself; where that is not enough, LanaChat helps within a reasonable time.
- Security and impact assessments. Taking into account the nature of the processing and the information available, LanaChat assists the Agency with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation).
- Personal data breach. LanaChat notifies the Agency without undue delay, and within 48 hours of confirming a breach affecting its data, with the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken, and a contact point. Further information is provided as it becomes available.
- Assistance that goes beyond what the Service includes, or that is caused by the Agency's own breach, may be charged at a reasonable rate agreed in advance.
9. Return and deletion
During the contract, the Agency can export and delete its data at any time from the console and the API. When the Terms end, LanaChat keeps the Agency's data available for export for 30 days, then deletes it from live systems. Encrypted backups are deleted on their normal schedule, within 90 days, and are not restored except to recover from a disaster. LanaChat keeps only what the law requires it to keep (billing records, abuse reports) and certifies deletion in writing on request. Team members' account data and activity log are outside this DPA: LanaChat holds them as controller and keeps the activity log 12 months for security and billing, as stated in the Privacy Policy.
10. International transfers
Where the processing involves a transfer of data of people in the EEA, the UK or Switzerland to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (Module Two, controller to processor, and Module Three, processor to processor, for sub-processors), with the UK International Data Transfer Addendum where UK data is concerned. The Agency is the data exporter and LanaChat the data importer; the details of sections 2 and 7 of this DPA fill the annexes. The clauses are deemed signed on acceptance of the Terms, and copies are available at [email protected].
11. Audits
- LanaChat makes available to the Agency the information necessary to demonstrate compliance with Article 28 GDPR: this DPA, the description of security measures, the sub-processor list, the results of security assessments, and written answers to reasonable questions.
- Where that information is not sufficient to satisfy a legal requirement, the Agency may conduct an audit, at most once per 12 months unless a supervisory authority requires more or a breach has occurred, with 30 days' written notice, during business hours, through an independent auditor bound by confidentiality, without access to other customers' data, and at the Agency's cost. Findings are shared with LanaChat first and are confidential.
12. Liability and term
The limitation of liability in the Terms applies to this DPA as a whole. This DPA lasts as long as LanaChat processes personal data for the Agency. Sections 5, 9 and 12 survive its end.
13. Contact
LanaChat legal entity name, address, registration number
Data protection contact: [email protected]