Data Processing Agreement (DPA)
Last updated: 13 September 2026
This agreement supplements our Terms of Use and applies to customers processing personal data of EU users (GDPR) or similar data protection laws.
1. Roles
Customer = Data Controller. ArabyBot = Data Processor.
2. Scope of processing
ArabyBot processes data only on your documented instructions, for specified purposes: managing customer conversations, sending messages, analytics.
3. Security measures
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Strict per-tenant data isolation.
- Strong authentication, 2FA, access logging.
- Daily backups + disaster recovery.
- Annual third-party penetration testing.
4. Sub-processors
- Meta Platforms (WhatsApp / Facebook / Instagram delivery)
- Amazon Web Services / Cloudflare (hosting & CDN)
- Stripe / PayPal / Paymob (payment processing)
- OpenAI / Anthropic / Google (AI inference — only when AI features are enabled by customer)
We notify you in advance of any new sub-processor. You have the right to object.
5. International transfers
Cross-border data transfers are protected by Standard Contractual Clauses (SCCs) and certified sub-processors.
6. Data subject rights
We assist you in responding to: access, rectification, erasure, restriction, portability, and objection requests. Response time: 30 days.
7. Data breach
In case of a suspected breach, we notify you within 72 hours with impact details and remediation actions.
8. Signing the agreement
Enterprise customers requiring a counter-signed DPA, please contact [email protected].