Data Processing Addendum

1. When this applies and how it fits together

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Calvyn and the Customer. It applies where Calvyn processes personal data on the Customer’s behalf and that processing is subject to data protection law, including the EU General Data Protection Regulation, the UK GDPR, and the California Consumer Privacy Act as amended.

It is pre-agreed. No signature is required, and it takes effect from the date the Customer accepted the Terms of Service. If your procurement process needs a countersigned copy, email legal@calvyn.io and we will sign this document as published; we do not negotiate bespoke terms at our current size, and we would rather say so plainly than waste your legal team’s week.

If this DPA conflicts with the Terms of Service on the handling of personal data, this DPA governs.

2. Roles

The Customer is the controller (or, where the Customer is itself processing on someone else’s behalf, the processor) of Customer Personal Data. Calvyn is the processor (or sub-processor).

Under California law, Calvyn is a "service provider". Calvyn does not sell or share Customer Personal Data, does not retain, use, or disclose it for any purpose other than performing the service, and does not combine it with personal information from other sources except as permitted for a service provider. Calvyn certifies that it understands these restrictions and will comply with them.

Separately, Calvyn is a controller of the account information of the individual who administers the Customer’s account — their name, email, and login credentials. That is covered by the Privacy Policy, not by this DPA.

3. What is processed

Subject matter: provision of the Calvyn conversational AI platform.

Duration: for as long as the Customer’s account is open, plus the deletion window in section 10.

Nature and purpose: hosting and storing knowledge sources the Customer uploads; generating embeddings so passages can be retrieved; transmitting prompts and retrieved passages to the model provider to generate replies; storing conversations; supporting handoff to the Customer’s human agents; and providing usage analytics to the Customer.

Categories of data subjects: the Customer’s end users who interact with an agent, and the Customer’s own personnel who use the dashboard.

Categories of personal data: message content submitted by end users, which may contain any personal data the end user chooses to type; session identifiers; timestamps; the content of knowledge sources the Customer uploads, which may contain personal data; and the names and email addresses of the Customer’s team members.

Special categories: not requested and not required by the service. The Customer must not configure agents to solicit special-category or sensitive personal data, and Calvyn’s systems are not designed or certified to handle it.

4. Calvyn’s obligations

Calvyn processes Customer Personal Data only on the Customer’s documented instructions, which include the Terms of Service, this DPA, and the Customer’s use of the product’s features. If Calvyn is required by law to process it otherwise, Calvyn will tell the Customer first unless the law prohibits that.

Calvyn will immediately inform the Customer if, in its opinion, an instruction infringes data protection law.

Calvyn will not use Customer Personal Data to train foundation models, and will not sell it or disclose it for advertising.

Personnel with access to Customer Personal Data are bound by confidentiality obligations. Access is limited to those who need it to operate or support the service.

Calvyn will provide the Customer with reasonable assistance, taking into account the nature of the processing, with data protection impact assessments and prior consultations with supervisory authorities.

5. Security measures

Calvyn maintains the following technical and organisational measures:

• encryption of all data in transit using TLS
• encryption at rest for the production database
• passwords stored only as bcrypt hashes, never in readable form and never in logs
• authenticated, rate-limited API access, with tenant isolation enforced at the query layer so one customer cannot read another’s data
• access to production systems restricted to the operator, protected by multi-factor authentication
• a separate credential for each third-party service, revocable independently
• logging of administrative and security-relevant events
• regular dependency updates and automated security review of code changes

Calvyn does not currently hold a SOC 2 report or ISO 27001 certification, has not undergone an independent penetration test, and is not HIPAA-eligible. We state this plainly so no one relies on a certification we do not have. If your risk assessment requires one, Calvyn is not yet an appropriate vendor for that workload.

6. Personal data breaches

Calvyn will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not yet available, Calvyn will provide information in phases as it is established rather than delaying the first notification.

Calvyn will cooperate with the Customer and take reasonable steps to assist in investigating, mitigating, and remediating the breach.

7. Sub-processors

The Customer gives general authorisation for Calvyn to engage the sub-processors listed below.

OpenAI, L.L.C. — generation of agent replies and computation of embeddings. Processes prompts, retrieved passages, and conversation content. United States. Data submitted via the API is not used to train OpenAI’s models.

MongoDB, Inc. (MongoDB Atlas) — primary database and storage of all customer content. United States.

Zeabur — application and API hosting. Processes data in transit and in application memory.

Stripe, Inc. — payment processing and billing portal. Processes the account holder’s billing details. Does not receive end-user conversation content.

Transactional email provider — delivery of support replies and account notices. Processes recipient email addresses and message content. Does not receive end-user conversation content.

Calvyn will give the Customer at least 30 days’ notice by email before a new sub-processor begins processing Customer Personal Data. If the Customer reasonably objects on data protection grounds within that period, the parties will discuss it in good faith; if it cannot be resolved, the Customer may terminate the affected subscription and receive a pro-rata refund of the unused prepaid term. This is a deliberate exception to our otherwise all-sales-final refund policy.

Calvyn imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable to the Customer for its sub-processors’ performance.

8. Data subject requests

The service gives the Customer direct control over the data it holds: conversations, agents, and knowledge sources can be viewed, exported, and deleted from the dashboard without involving Calvyn. In most cases the Customer can satisfy a data subject request itself, immediately.

Where a data subject contacts Calvyn directly about data the Customer controls, Calvyn will not respond substantively, and will refer the request to the Customer without undue delay.

Where the Customer needs help that the product’s own features cannot provide, Calvyn will give reasonable assistance, taking into account the nature of the processing.

9. International transfers

Calvyn and its sub-processors process Customer Personal Data in the United States.

Where the Customer transfers personal data subject to EU or UK data protection law to Calvyn, the parties agree that the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference and apply to that transfer.

For those clauses: the Customer is the data exporter and Calvyn the data importer; the optional docking clause applies; for Clause 9, option 2 (general written authorisation) applies with the 30-day notice period in section 7; for Clause 17, the governing law is that of Ireland; for Clause 18(b), disputes are resolved in the courts of Ireland. Annexes I, II, and III are populated by sections 3, 5, and 7 of this DPA respectively.

For transfers subject to UK law, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with Tables 1 to 4 completed by reference to the same sections.

10. Deletion and return

The Customer may export its data at any time from the dashboard, in a machine-readable format, without asking Calvyn.

On termination or account deletion, Calvyn will delete Customer Personal Data within 30 days, except for billing and transaction records retained for tax and accounting compliance, and support correspondence retained for dispute resolution, both as described in the Privacy Policy.

Backups are cycled on a rolling basis. Deleted data may persist in a backup for a short period before being overwritten, remains subject to this DPA while it does, and is not restored into live systems.

11. Audits

On reasonable written request, and no more than once in any twelve-month period unless a regulator requires otherwise or a breach has occurred, Calvyn will provide the information reasonably necessary to demonstrate compliance with this DPA by answering a written security questionnaire.

Calvyn is a one-person business without the capacity to host on-site audits. Where the Customer’s regulator or applicable law requires an inspection right beyond a questionnaire, the parties will agree a proportionate alternative in good faith.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where applicable data protection law does not permit that — in particular, nothing in this DPA limits a data subject’s rights under the Standard Contractual Clauses.

13. Contact

Data protection enquiries, signature requests, and security questionnaires: legal@calvyn.io.

Calvyn’s address for formal notices under this DPA is Calvyn, PO Box 47615, Los Angeles, CA 90047, United States.