Data Processing Addendum

1. Roles

This DPA applies when Ariflogs Services LLC, which runs Opskeet(“processor”), processes personal data for a customer (“controller”) through Opskeet. If the customer is itself a processor, for example an agency working for clients, Opskeet is its subprocessor.

The customer instructs us to process personal data to provide, secure and support Opskeet. The Terms, this DPA and how the customer sets up its projects are its documented instructions.

2. Processing details

• Purpose: live chat, the shared inbox, email and tickets, the AI agent and the team’s writing help, the help center, contact records, analytics, and the support and security that go with them.
• People: visitors to the customer’s websites, people who chat with or email the customer, and the customer’s teammates.
• Data: messages, emails and files; names, emails and other details people share or the customer’s site sends; fields, tags and notes the team adds; rough location, time zone, language, browser, device, referrer and pages viewed; analytics events; help center votes, notes and searches.
• Duration: while the agreement runs, then until deletion under section 7.

Opskeet isn’t meant for special-category data (such as health, religion or sexual life), data about criminal offences, or data about children. The customer won’t ask for it through Opskeet.

3. Our duties

We will:

• process personal data only on documented instructions, unless the law requires otherwise, and tell the customer if we think an instruction breaks the law;
• make sure authorized personnel are bound by confidentiality;
• keep appropriate technical and organizational security measures;
• help the customer answer requests from people exercising their rights, and with security, breach notification, impact assessments and regulator consultations, as far as the processing allows;
• notify the customer without undue delay after becoming aware of a personal data breach affecting its data;
• give the information reasonably needed to show compliance, and allow proportionate audits under confidentiality.

We don’t sell personal data or use it to train AI models.

4. Security

Measures include encryption in transit, encrypted AI keys, hashed sign-in codes, not storing visitors’ IP addresses, signed checks for the signed-in users a customer’s site identifies, roles for teammates, encrypted push notifications, rate limits, limited staff access, and retention cleanup and deletion jobs.

The customer is responsible for who it invites, the roles it gives, and what its widget, forms and AI agent ask people for.

5. Subprocessors

The customer authorizes Cloudflare (global) for hosting, the database, file storage, AI models, search, website crawling and email. We bind each subprocessor to data protection terms at least as protective as this DPA and remain responsible for it.

If the customer adds its own Anthropic key, we send AI requests to Anthropic under the customer’s own agreement with Anthropic. Anthropic is then the customer’s provider, not our subprocessor.

We update this page before adding a subprocessor. The customer can object on reasonable data protection grounds within 15 days by emailing hello@opskeet.com. We’ll look for a reasonable solution in good faith; if there isn’t one, either party can end the affected service.

6. International transfers

Data may be processed in the United States and wherever our subprocessors operate. Our team works from Bangladesh and may access customer data from there, only as needed to provide and support the service. Where the law requires, the EU Standard Contractual Clauses apply: module two when the customer is a controller, module three when it is a processor, with the customer as exporter and Ariflogs Services LLC as importer, the optional docking clause included, and the law and courts of the customer’s EU member state. For the UK, the UK Addendum to the clauses applies. This DPA completes the annexes.

7. Deletion and return

During the agreement the customer can delete contacts, with their chats and visits, and whole projects in the app. When the agreement ends, or on request, we delete the customer’s personal data unless the law requires us to keep it. Backups are kept for up to 30 days and are then gone. See our Privacy Policy for how long each kind of data is kept.

8. Customer duties

The customer is responsible for having a lawful basis for the data it collects, telling its visitors how it uses their data, getting consent where the law requires it (for example for analytics or remembering returning visitors), and answering people’s requests.

9. Priority

This DPA is part of the Terms and wins over them on personal data processing. The Terms’ liability limits apply except where the law or the Standard Contractual Clauses say otherwise.

Contact

Ariflogs Services LLC. hello@opskeet.com