Data Processing Addendum
Last updated: 3 October 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Karinda AI ("Processor") and the Customer ("Controller") and applies where Karinda processes personal data on the Customer's behalf.
1. Scope
| Subject matter | Operating an AI website assistant, storing conversations and leads, and sending lead notifications. |
|---|---|
| Duration | For the term of the Customer's account, until deletion. |
| Data subjects | Visitors to the Customer's website who use the assistant. |
| Personal data | Chat messages; name, phone, email and message submitted in the lead form; IP address and technical data. |
| Sensitive data | Not intended. The Customer must not configure the assistant to collect special-category data. |
2. Processor obligations
- Process personal data only on the Controller's documented instructions (configured through the Service).
- Ensure people authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures (see Security).
- Help the Controller respond to data subject requests and meet its security, breach-notification and impact-assessment obligations.
- Notify the Controller without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach.
- Delete personal data at the end of the service or on account deletion, unless the law requires retention.
- Make available information needed to demonstrate compliance.
3. Sub-processors
The Controller authorises the sub-processors below. We will give notice of new sub-processors by updating this page and emailing account owners, and the Controller may object on reasonable grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1), vector search, AI inference (Workers AI), security | Global edge network |
| Resend, Inc. | Transactional email (verification codes, lead notifications) | United States |
4. International transfers
Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3) and the UK International Data Transfer Addendum, which are incorporated by reference.
5. US state privacy laws
For the CCPA/CPRA and similar laws, Karinda acts as a "service provider" or "processor": it will not sell or share personal data, will not retain, use or disclose it outside the direct business relationship, and will not combine it with data from other sources except as permitted.
Contact
privacy@karinda.in. To request a countersigned copy, email us from your account address.