This Data Processing Addendum ("DPA") supplements the Terms of Service between Trailops LLC ("Stylchat," "Data Processor," or "Processor") and the customer agreeing to these terms ("Customer" or "Data Controller"). This DPA governs the processing of personal data in connection with the Service to the extent subject to the EU General Data Protection Regulation (GDPR), UK GDPR, or applicable data protection laws.
1. Scope and Roles
- Controller and Processor Roles: The Customer is the Data Controller of visitor and customer personal data processed through embedded chat widgets, Service Desk tickets, and customer communications. Stylchat acts as the Data Processor processing such data on behalf of the Customer in accordance with Customer instructions and the Terms.
- Base BYOI Model (Zero Stored Visitor Data): Under base Bring Your Own Infrastructure (BYOI), Stylchat provides widget configuration and transient message transit only. No visitor chat text, contact entries, support tickets, or uploaded media are stored on Stylchat servers. The Customer is responsible for its own webhook endpoints and infrastructure.
- Addon Packs & Managed Model: Where the Customer enables optional BYOI Addon Packs (Data Pack or Desk Pack) or uses Stylchat Managed Infrastructure, Stylchat stores and processes hosted data strictly as specified in the accepted pack declaration and plan terms. Optional live draft preview processes unsent text transiently for authorized support agents after visitor opt-in. Consent and withdrawal receipts contain a hashed session reference and the notice/version, are kept for up to 180 days, and contain no draft text.
Connected Channel Processing
For Managed widgets with an authorized messaging connection, data subjects include customers contacting the Customer through Telegram, Facebook Messenger, Instagram Direct or WhatsApp Business. Personal data includes platform identifiers, phone numbers where supplied, display names/usernames, support messages and attachments, delivery/read events, consent/opt-out records and approved utility-template data. Processing is limited to connecting the selected business assets, receiving and routing support messages, delivering authorized replies and maintaining delivery/security records. Channel account credentials are encrypted.
2. Processor Obligations
- Processing Instructions: Stylchat shall process Customer Personal Data only on documented instructions from the Customer, including with respect to transfers of personal data outside the European Economic Area (EEA) or UK, unless required to do so by applicable law.
- Confidentiality: Stylchat ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Security Measures (Article 32): Stylchat implements appropriate technical and organizational security measures to protect personal data, including TLS encryption in transit, AES-256-GCM encryption for stored credentials, access controls, and strict logical tenant separation.
- Data Subject Rights Assistance: Taking into account the nature of processing, Stylchat assists the Controller by appropriate technical and organizational measures to enable Controller to respond to requests from data subjects exercising their statutory rights.
- Security Incident Notification: Stylchat shall notify the Customer without undue delay upon becoming aware of a confirmed personal data breach affecting Customer Personal Data.
3. Subprocessors
Customer provides general authorization for Stylchat to engage subprocessors to provide infrastructure, hosting, and platform services. Current subprocessors include:
- Railway (USA, California): Application backend, API hosting, background task execution, and PostgreSQL database with vector search.
- Cloudflare (USA): CDN edge caching (Cloudflare Pages) and encrypted file object storage (Cloudflare R2).
- Clerk (USA): Authentication, identity verification, and team session tokens.
- Stripe (USA): Payment transaction processing and subscription billing.
- OpenRouter, OpenAI & Google (USA): AI inference models and vector embedding generation for Managed Infrastructure users.
- Resend (USA): Transactional email delivery when custom SMTP is unconfigured.
Stylchat enters into written agreements with all subprocessors imposing data protection terms no less protective than those set forth in this DPA.
4. International Transfers & Transfer Mechanisms
Customer personal data is processed on Stylchat infrastructure located in the United States (California, Railway US West; Cloudflare R2).
- EU Standard Contractual Clauses (SCCs): For transfers of personal data from the EEA to the United States, the parties hereby incorporate the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor), adopted under Decision (EU) 2021/914.
- UK International Data Transfer Addendum: For transfers subject to the UK GDPR, the UK Information Commissioner's Office (ICO) International Data Transfer Addendum to the EU Commission Standard Contractual Clauses is incorporated by reference.
5. Data Deletion and Return
Upon termination of the Services or cancellation of a subscription or pack, Stylchat retains Customer Personal Data during the 30-day freeze window before executing permanent and irreversible purge, as described in the Terms of Service and Privacy Policy. The Customer may export all customer records prior to purge via dashboard export and privacy tools.
Channel Retention and Return
Messages and their attachments follow a 180-day rolling retention period. Encrypted inbound replay payloads are scheduled for removal after seven days once processing has completed or failed; events still awaiting processing may be retained longer. Processed delivery and deduplication records are eligible for removal after 30 days when no processing job remains pending. Connection activity records are kept for one year. Unsent uploaded reply drafts expire after 60 minutes. Cleanup runs in background jobs; file deletion and provider-access revocation may be delayed by retries or provider outages.
Disconnection stops new channel processing while existing records remain subject to retention and eligible deletion instructions. Account/widget deletion queues stored-file cleanup and provider revocation; provider-side copies are governed by the relevant platform’s own terms. Workspace exports contain channel identities, message content/metadata and consent records, but exclude credentials, attachment file contents and internal delivery/replay records. Contact privacy@stylchat.com for assistance with data-subject requests.
6. Contact & Execution
This DPA is automatically incorporated into the agreement between the Customer and Trailops LLC upon Customer's creation of an account or use of the Service. Inquiries regarding this DPA can be directed to privacy@stylchat.com.