Data Processing Addendum

Last updated October 14, 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service between you (the “Customer”) and Davos Dev LLC (“tufu”). It applies whenever tufu processes personal data on the Customer's behalf in providing the Service, and it takes precedence over the Terms where they conflict. Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in the GDPR. “Data Protection Laws” means all data protection laws that apply to that processing, including the GDPR, the UK GDPR, the Swiss FADP and US state privacy laws such as the CCPA.

1. Roles and instructions

• The Customer is the controller (or, where it acts for its own customers, a processor) of the personal data in Your Content, and tufu is its processor (or subprocessor).
• tufu processes that personal data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's configuration and use of the Service are those instructions. tufu will tell the Customer if it believes an instruction breaks Data Protection Laws.
• The Customer is responsible for the lawfulness of its instructions and of the data it provides, including giving its Visitors notice and obtaining any consent they require.
• Under the CCPA, tufu acts as a service provider. It will not sell or share the personal data, or retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service.

2. Details of the processing

• Subject matter and purpose: providing the Service: answering Visitors with AI from the Customer's knowledge (on the website, in Slack and Discord, and by email when the Customer forwards its support address to tufu), handing conversations to the Customer's team, notifications and replies by email, and the related security, abuse prevention and support.
• Duration: the term of the Terms, plus the deletion periods in section 8.
• Data subjects: the Customer's Visitors, and the Customer's users and any people mentioned in Your Content.
• Categories of data: conversation content, names and email addresses Visitors provide, the content and headers of support emails forwarded to tufu (sender, subject, message identifiers, sender-authentication results and attachment names), whether the emails tufu sends were delivered, the Discord user IDs and usernames of people who write to a bot in Discord or vote on its answers, with the IDs of the servers, channels, threads and messages involved, IP addresses and browser identifiers, and personal data contained in knowledge sources.
• Sensitive data: none intended. The Customer must not use the Service to collect special categories of data or other sensitive data (see the Acceptable Use Policy).

3. Confidentiality

tufu makes sure that everyone it authorizes to process the personal data is bound by confidentiality, and gives access only to those who need it to provide, secure or support the Service.

4. Security

tufu maintains appropriate technical and organizational measures, including: encryption in transit (TLS); encryption at rest by its hosting providers; logical separation of each customer's data by team; access to production limited to authorized personnel; two-factor authentication available to all users and a confirmed email address required to sign in; rate limiting and usage limits on public endpoints; signature checks on the webhooks that bring in email and payment events; private storage for uploaded files, served through expiring links; error monitoring; backups; and keeping software dependencies up to date. tufu may update these measures as long as the overall level of protection is not reduced.

5. Subprocessors

• The Customer gives general authorization for tufu to use the subprocessors listed on our Subprocessors page.
• tufu will update that page, and email team admins, at least 30 days before adding or replacing a subprocessor, except in an emergency affecting the Service, when it will notify as soon as possible. The Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
• tufu imposes data protection terms on each subprocessor that protect the data at least as much as this DPA, and remains responsible for its subprocessors' performance.

6. Assistance

• Data subject requests: if tufu receives a request from a Visitor or other data subject about the Customer's data, it will pass it to the Customer and not respond itself except to say so. Taking into account the nature of the processing, tufu will help the Customer respond to requests to access, correct, delete or export data. Where a platform the Customer connects requires it (such as Discord), the Customer instructs tufu to delete a member's data from that platform when the member or the platform asks, and tufu will tell the Customer when it does.
• Impact assessments: tufu will give reasonable help with data protection impact assessments and consultations with authorities, as far as they relate to the Service.

7. Personal data breaches

tufu will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice will include what tufu knows about the nature of the breach, its likely consequences, and the measures taken. tufu will update the Customer as it learns more and will take reasonable steps to contain the breach and reduce its effects.

8. Return and deletion

While the Service is active, the Customer can export conversation data (from Reports on the Team plan) or ask tufu for an export at any time. When the Customer deletes its team, or the Terms end, tufu deletes the personal data from live systems within 30 days and from backups as they expire, within 90 days, unless the law requires tufu to keep it.

9. Audits

tufu will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering security questionnaires. If the Customer reasonably needs more, or a supervisory authority requires it, the parties will agree on the scope, timing and cost of an audit, which must avoid disrupting the Service and access to other customers' data.

10. International transfers

tufu and its subprocessors process personal data in the United States and other countries. Where Data Protection Laws require a transfer mechanism for personal data from the EEA, the UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or, where the Customer is a processor, Module Three (processor to processor), which are incorporated by reference, with these choices:

• clause 7 (docking) applies;
• clause 9 option 2 (general authorization), with the notice period in section 5;
• the clause 11 optional language does not apply;
• clauses 17 and 18: the law and courts of Ireland; and
• the Annexes are completed by sections 2 and 4 of this DPA and the Subprocessors page.

For UK transfers, the UK International Data Transfer Addendum applies, with the information above. For Swiss transfers, the Clauses apply with references to the GDPR read as references to the FADP, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

11. Liability and contact

Each party's liability under this DPA is subject to the limits in the Terms, to the extent Data Protection Laws allow. Questions about this DPA: support@tufu.aiCopied.