This Data Processing Agreement (DPA) governs how Companin processes personal data on behalf of customers who use the Companin platform.
This DPA is entered into between Companin (the Data Processor) and the organization that has accepted Companin's Terms of Service (the Data Controller). It supplements the Terms of Service and Privacy Policy.
Companin processes personal data solely to provide the customer support AI widget service as described in the Terms of Service. Processing occurs only on documented instructions from the Controller.
Companin may process the following categories of personal data on behalf of the Controller: visitor names and email addresses (where provided to the widget), IP addresses, conversation content and chat transcripts, usage metadata and session identifiers, and any other data explicitly configured by the Controller.
Personal data is processed exclusively to operate, maintain, and improve the AI-powered customer support widget, including generating responses, maintaining session continuity, and producing analytics for the Controller.
Conversation logs and associated personal data are retained for the period configured by the Controller in their account settings, subject to a default maximum of 12 months. Upon account termination, all personal data is deleted or anonymized within 30 days unless a longer period is required by applicable law.
Companin uses the following categories of sub-processors to deliver the service. Customers will be notified of material changes at least 30 days in advance.
Companin implements and maintains technical and organizational security measures as described in the Security page. These include encryption in transit (TLS 1.2+), encryption at rest (AES-256), hashed credentials, access controls, and audit logging. For the full security overview visit companin.tech/security.
The Controller is responsible for responding to data subject requests. Companin will assist the Controller in fulfilling access, correction, deletion, portability, restriction, and objection requests within the timeframes required by applicable data protection law. Requests can be initiated via account settings or by contacting post@companin.tech.
Where Companin or its sub-processors transfer personal data outside the European Economic Area or United Kingdom, such transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, or an equivalent transfer mechanism recognized under applicable law. Details of the current hosting region are available on the Security page.
For DPA-related queries, to request a signed DPA, or to exercise data subject rights, contact us at post@companin.tech.