Roles
You are the controller. ChatBrace is the processor. We process personal data only on your documented instructions, which for most customers means: run the chatbot, keep the transcripts, show the analytics.
Legal
Data processing agreement
The Article 28 terms under which we process your visitors' personal data on your behalf. This forms part of your contract with us automatically when you hold an account.
Last updated 22 September 2026 · This is a plain-language draft and not yet reviewed by a lawyer. It will be before launch.
Subject matter and duration
Subject matter: operating a chat assistant on your website. Duration: for as long as your account is open. Categories of data subject: visitors to your website. Categories of personal data: whatever your visitors type, plus a pseudonymised identifier for rate limiting.
Visitors can type anything into a chat box, including data you did not ask for. Tell them not to share sensitive information, and set a retention window accordingly.
Sub-processors
You give general authorisation for us to engage sub-processors, listed at chatbrace.com/legal/sub-processors. We give you notice before adding or replacing one, and you may object. Every sub-processor is bound by obligations no weaker than these, and we remain liable to you for their performance.
Security
Encryption in transit and at rest, access on a least-privilege basis, pseudonymised visitor identifiers, EU-hosted infrastructure, and nightly encrypted off-site backups with a documented restore test.
We notify you without undue delay, and within 72 hours, of any personal data breach affecting your data.
Deletion and audit
On termination we delete your data, or return it first if you ask before the account closes. We make available the information you reasonably need to demonstrate compliance, and accept audits at reasonable intervals with reasonable notice.