Legal
Data processing agreement
Last updated 28 October 2026
The short version
- When your customers chat with your assistant, we process their personal data for you, on your instructions. This agreement sets the rules for that, as the GDPR, the UK GDPR and California's CCPA require.
- It's a standard, lawyer-drafted agreement: the Common Paper DPA Standard Terms, version 1.1. This page is its Cover Page, with the details of our service filled in.
- It's part of our terms of service, so you accept it when you accept them. If you'd like a copy signed by both of us, write to cdesivo92@gmail.com.
Using this DPA
This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a word defined there, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.
Provider is Cristian Desivo, of Buenos Aires, Argentina, who runs Official Reply. Customer is the business that accepted the Agreement.
Key Terms
| Agreement | This DPA supplements the Official Reply Terms of service accepted by Customer, together with anything Provider and Customer have agreed in writing under them (such as a pilot agreement). |
|---|---|
| Approved Subprocessors |
Messaging apps that Customer connects to the Service (Meta's WhatsApp, Messenger and Instagram, and Telegram) are provided to Customer under Customer's own agreements with them. They are not Provider's Subprocessors. The same applies to Customer's own systems that receive requests. |
| Provider Security Contact | cdesivo92@gmail.com |
| Security Policy | Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering, and will maintain at least the measures in Annex II. Provider holds no third-party certifications or audit reports. Section 5.2 (Security Reports) of the DPA Standard Terms therefore does not apply; Customer verifies compliance through Section 5.1 and the questionnaires in Section 5.3. |
| Changes to the Agreement | None. The Agreement's limitations of liability and its governing law and courts apply to this DPA, except as Section 8.3 of the DPA Standard Terms provides. |
| Service Provider Relationship | To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA. In addition, Provider will not combine that Personal Data with personal information it receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits; Provider will provide the same level of privacy protection the CCPA requires of businesses; and Customer may take reasonable and appropriate steps to ensure Provider uses the Personal Data consistently with Customer's CCPA obligations, and to stop and remediate any unauthorized use. |
| Restricted Transfers: Governing Member State | EEA Transfers: Ireland. UK Transfers: the laws of England and Wales. Provider is established in Argentina, which the European Commission and the United Kingdom recognize as providing adequate protection. Customer Personal Data is hosted in the United States by the Approved Subprocessors, under their own data processing terms, which provide safeguards for international transfers. |
Annex I(A): List of Parties
| Data Exporter | Name: Customer. Address and contact person: as given by Customer in its account or written agreement with Provider. Activities relevant to transfer: see Annex I(B). Role: Controller (or Processor, where Customer runs the Service for a Controller). |
|---|---|
| Data Importer | Name: Provider, Cristian Desivo (Official Reply). Address: Buenos Aires, Argentina; a full postal address is given on request. Contact person: Cristian Desivo, owner, cdesivo92@gmail.com. Activities relevant to transfer: see Annex I(B). Role: Processor. |
Annex I(B): Description of Transfer and Processing Activities
| Service | Official Reply: an assistant on Customer's website and in the chat apps Customer connects, which replies to Customer's customers only with answers Customer has approved, fills them in with live values from Customer's systems, and takes requests (such as bookings or orders) that the customer confirms. |
|---|---|
| Categories of Data Subjects |
|
| Categories of Personal Data |
|
| Special Category Data | No. The Service isn't designed to process it: Customer may not set the Service up to collect it without Provider's written agreement, and people are asked not to share health details in the chat. Where Customer is a healthcare provider, an appointment request may itself show that a person is a patient. Safeguards: the assistant answers no clinical questions; requests collect only the fields Customer sets; confirmed requests are erased after 90 days; and the measures in Annex II apply. |
| Frequency of Transfer | Continuous, while the Service is in use. |
| Nature and Purpose of Processing | Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:
|
| Duration of Processing | Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws. Within that, the Service erases data automatically: conversations 12 months after their last message; a person's chat-app number or id 30 days after their last message; contact details and confirmed requests after 90 days; backups after 14 days. The full schedule is in the privacy policy. |
Annex I(C)
Competent Supervisory Authority. The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II: Technical and Organizational Security Measures
| Encryption and pseudonymization | Logins and keys for Customer's systems are encrypted with AES-256-GCM, with a separate key for each assistant, itself encrypted by a master key kept outside the database. They're removed from documents and emails before anything is stored or shown to a model. Dashboard passwords are stored only as scrypt hashes. |
|---|---|
| In transit | All traffic to the Service uses HTTPS (TLS). Calls to the Approved Subprocessors use TLS. |
| At rest | Google Cloud encrypts the server's disks and backups at rest. |
| Access and authorization | Each Customer sees only its own assistant's data. Dashboard users sign in with a password; sessions expire after 14 days. Only Provider has access to the server, through Google Cloud's authenticated access. Connections to Customer's systems are read-only. |
| Availability and restoring data | The database is backed up every night and backups are kept for 14 days, so data can be restored after an incident. The Service is monitored by an external uptime check. |
| Events logging | The dashboard records who published or deleted what. Server logs record errors and events, without visitors' IP addresses or questions. |
| Abuse protection | Requests are rate-limited, and messages from chat apps are checked against the app's signature or secret token before they're accepted. |
| Data minimization | Each Subprocessor gets only what its task needs. The model sees the question, recent turns of the conversation and Customer's approved answers. People are asked not to share more than a question needs. |
| Limited retention | Data is erased automatically on the schedule in Annex I(B). Customer can delete contact details and requests sooner from its dashboard. |
| Testing and evaluation | The Service has an automated test suite, run on changes before they're released. Provider reviews these measures at least once a year and when the Service changes. |
| Portability and erasure | When the Agreement ends, Provider sends Customer its answers and conversations if asked within 30 days, then deletes Customer's data; backups age out within 14 more days. |
| Accountability | Provider keeps records of its compliance with this DPA, and answers security questionnaires as Section 5.3 of the DPA Standard Terms provides. |
Agreeing to this DPA
Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. Customer electronically accepts this Cover Page by accepting the Agreement, and the DPA starts then. If Provider changes this page, it will tell Customer as the Agreement and Section 2.3 and 2.6 of the DPA Standard Terms provide. Either party can ask for a copy signed by both.
The DPA Standard Terms are by Common Paper, used under the CC BY 4.0 license. This Cover Page follows Common Paper's Cover Page template, version 1.1, completed and adapted by Provider.