Data processing agreement

The agreement that sits under the privacy notice. It says what we may do with your customers' messages, and more usefully what we may not.

Last updated 13 November 2026.

This agreement forms part of the terms. It applies from the moment you install the chat box and for as long as you have an account. You do not need to sign anything or send it back.

The processor under this agreement is SDAN LTD, registered in England and Wales, company number 17147199, at 128 City Road, London, EC1V 2NX, registered with the Information Commissioner's Office under reference ZC214549. The controller is you, the business named on the account.

1Who is who

You are the controller. They are your customers, enquiring about your business. You decide that the chat box is on your website, where the messages go, and how long they are kept.

We are the processor. We move the message from your website to the destination you picked, carry your answer back, and hold it in between. We do not decide anything about it.

Where a destination is involved, that provider is a processor of yours as well as ours. Choosing Telegram means Telegram handles the message, under Telegram's terms, on Telegram's servers. That is the point of the product and it is why you get to pick.

2What we process, and why

• What your customer types, through whichever of the ways in you have switched on: your chat box, your contact form, and your email, Facebook page or Instagram where you connect them. So it can reach you and you can answer it.
• A name, email address or phone number, but only where your customer volunteers one.
• The page they were on when they got in touch, because an enquiry with no context wastes your time and theirs.
• A short-lived identifier so that a customer who reloads the page is still in the same conversation. It is gone within a day.
• What we work out for you: a one line summary and a suggested reply, the questions your saved answers did not cover, and, where you turn them on, earlier conversations with the same person and the company behind a work address.

Nothing else. We do not profile your customers, we do not build an audience from them, and we do not use anything they wrote to train anything.

3What we will not do

These are the ones worth reading, because most of them are enforced by the software rather than promised by us.

• We never subscribe to a message stream. The bot in your Telegram, the app in your Slack, the integration in your Discord, the app in your Microsoft Teams: none of them can read the channel they sit in. Telegram privacy mode is on, we hold no Slack history permission, Discord reaches us over HTTP interactions rather than a socket, and the Teams app has no permission to read a channel and only receives what is typed into its own cards or a message that mentions it by name. We do not receive your unrelated messages, so we could not hand them over if we were asked.
• No model writes anything that reaches your customer, unless you let your assistant answer. Apart from your own words, your customer only ever gets fixed lines of ours: the greeting until you change it, your opening hours note, and one email if nobody has answered them. Where you have set up saved answers, the words sent are the words you typed, reproduced exactly. Nothing composes, rewrites or improvises anything that reaches your customer, with one exception you control: letting your assistant answer, which you can only do once your saved answers cover most of what your customers ask. It sends your saved answers on your website chat, word for word: the model only picks which one fits, and never writes anything to your customer. Each one is labelled to your customer as automatic, and it stops in a conversation the moment you say anything in it. /drafts off stops it as well. A model does write three things, and all of them are addressed to you and only you: a one line summary at the top of a long conversation, a suggested reply underneath an enquiry, and, if you ask for an interview, a few questions your customers might ask, which you answer in your own words. Those are drafts sitting in your own message app, or in our app. Sending is yours, always, and you can turn the whole thing off with /drafts off.
• We do not sell anything, ever, and there is no advertising in this product to sell it to.
• We do not read your conversations except where you ask us to look at something specific, or where the law requires it. There is no screen inside our company that lists them.
• We store your data in the UK and the EU for the parts we run. On the way to us it passes through Cloudflare's worldwide network, and section 6 says which suppliers handle it elsewhere and under what.

4How long we keep it

You choose: 30, 90 or 365 days. It applies to the message itself, and the clock runs from the last thing said rather than the first, so a conversation still going is not deleted mid sentence.

This is enforced by where the data lives, not by a job that tidies up. Messages are held in a store where every single key carries an expiry and backups are switched off. There is no second copy in a system with backups on, so nothing can outlive the window by sitting in an archive. That is a structural property rather than a policy, which is the only kind of deletion promise worth making.

The copy that reached your Telegram, your Slack or your inbox is yours. It sits in your account under your control, and we cannot reach into it to delete it. If somebody asks you to erase their details, that part is yours to do.

5When one of your customers exercises a right

Access, correction, erasure, objection: those requests come to you, because you are the controller. Send /forget with their email address or phone number and our copy is cleared straight away, or tell us and we will do it without undue delay, normally the same working day, and confirm it in writing.

If a request reaches us directly we will not act on it ourselves. We will pass it to you, because we have no way of knowing whether the person asking is who they say they are, and you usually do.

6Who else is involved

The full list, and what each one does, is in the privacy notice and kept current there rather than in two places. In summary: the destination you chose, our network, our hosting, our message store, our mail sender, our mail receiver, our mailbox, our AI drafting supplier where you leave it on, the services that carry notifications to our app, Meta and Companies House where you turn on what uses them, and our payment processor.

What we run stores data in the UK and the EU. Several suppliers are American, and where any of them handles personal data outside the UK or the EU it does so under the UK addendum to the standard contractual clauses in that supplier's own data terms, or under the UK's data bridge with the United States for a supplier certified to it.

We will tell you before we add anyone to that list, and you can object. If you object and we cannot work around it, you can leave and we will refund the part of your billing period you have not used.

One of them you can remove yourself without asking us and without leaving. Send /drafts off wherever you receive your enquiries and no message from any of your customers is sent to a model, at all, from that moment. Everything else about the account carries on exactly as it was. We have built that switch rather than only offered you the objection above, because an objection you can only exercise by closing your account is not really an objection.

7Security

• Everything travels over TLS, and the chat box refuses to load on a page that is not secure.
• Session tokens are stored hashed, so a copy of our database does not hand anybody a working session.
• Where we match a returning customer, the identifier is a keyed hash rather than a plain one, because a plain hash of an email address can be reversed.
• Access to production is limited to the people who run the service, which today is a very small number of people.
• A contact form is refused outright rather than filtered if it looks like a sign-in, a checkout or anything carrying a card number, so those never enter the system at all.

8If something goes wrong

If we become aware of a breach affecting your customers' data we will tell you without undue delay, with what we know, what we are doing, and what we do not yet know. We aim to be inside 24 hours and we will not sit on it, but the commitment is the one the law sets rather than a clock we invented. You are the one who has to decide about notifying the Information Commissioner's Office, so you get the facts rather than a summary.

We will not wait until we have a complete picture before telling you, because a complete picture usually takes longer than the deadline you are working to.

9Audit

Ask and we will answer questions about how this works, in writing. For a small business that is normally enough. If you are required to do more than that, tell us what you need and we will agree something reasonable rather than send you a form.

10When it ends

Close your account and the chat box stops. Thirty days later your conversations, settings and figures are deleted, unless you have come back by then. Only the billing record is kept, for six years, because HMRC requires it. Ask us to clear the messages sooner and we will, normally the same working day.

We keep no backups of conversations (clause 4). When we back up settings and figures, each backup deletes itself within three days, so any copy of them is gone within three days of the rest. If we ever have to restore a backup after a fault, we delete again whatever had been deleted since. After that, the billing record is the only copy we keep.

11Changes

If we change this in a way that matters we will email you at least 30 days beforehand. If you do not like it, leave, and we will refund the part of your billing period you have not used.