Data Processing Addendum.

When you use FunnelConvo to deploy chatbots on your sites, you are the data controller for the personal data of your visitors. MEGAFLOW LLC, trading as FunnelConvo (registered in Wyoming, USA), acts as your data processor.

This DPA is incorporated into our Terms of Service and is accepted automatically when you accept the Terms. No separate signature is required.

If you need a signed copy for your records, email legal@funnelconvo.com and we'll send you one countersigned by MEGAFLOW LLC.

The subject matter is the processing of visitor personal data through FunnelConvo's chatbot platform. The duration is the time you have access to FunnelConvo, plus any retention period required to support deletion or data return.

Data subjects are the visitors to your websites who interact with your chatbots.

FunnelConvo processes contact details (name, email, phone), conversation transcripts, technical identifiers (IP, device, browser), and any custom fields you collect through your chatbots.

We process personal data only on your documented instructions. Those instructions are these Terms, this DPA, and your configuration and use of FunnelConvo. If the law requires us to process personal data in any other way, we'll tell you before doing so, unless the law prohibits it.

We'll let you know promptly if we believe an instruction from you breaks applicable data protection law.

Everyone at MEGAFLOW LLC who is authorized to process personal data is bound by contractual or statutory confidentiality obligations.

You authorize us to engage the sub-processors listed on our Sub-processors page: currently AWS, Stripe, OpenAI, and PostHog. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.

We'll notify you by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds by emailing legal@funnelconvo.com within that period. We'll work with you in good faith to find a solution. If we can't, you may terminate the affected service and receive a refund of any fees you prepaid for the period after termination.

We maintain technical and organizational measures appropriate to the risks of the processing, as described in the Annex at the end of this DPA.

We'll notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf.

We'll give you the information you reasonably need to meet your own notification obligations, and we'll take reasonable steps to contain and remediate the breach.

Taking into account the nature of the processing, we'll help you respond to requests from data subjects exercising their rights, such as access, rectification, erasure, restriction, portability, and objection. If we receive such a request directly, we'll forward it to you and won't respond ourselves unless you instruct us to.

We'll also give you reasonable assistance with data protection impact assessments and with any prior consultation with a supervisory authority.

Where personal data is transferred outside the EEA or UK, we rely on the Standard Contractual Clauses (SCCs) and the UK IDTA, with supplementary measures as needed.

You may audit our compliance with this DPA once per year, with reasonable notice. On request, we will provide information reasonably necessary to demonstrate our compliance with this DPA.

Upon termination, FunnelConvo will delete or return all personal data processed on your behalf within 30 days, unless retention is required by law.

Encryption: personal data is encrypted in transit (TLS 1.3) and at rest (AES-256).

Access control: access to personal data is limited to authorized personnel who need it to operate the service, on a least-privilege basis.

Logging: access to production systems is logged.

Confidentiality: personnel with access to personal data are bound by confidentiality obligations.

Sub-processors: we use established providers, listed on our Sub-processors page, and review their security and data protection commitments before engaging them.

Incident response: we investigate suspected security incidents and notify affected customers as described in the 'Personal data breaches' section above.

Deletion: personal data is deleted within 30 days of account termination, unless retention is required by law.