Data Processing Agreement

This agreement is between the business that uses the Service (the "Controller", "you") and Прайс Екс ЕООД (Pricex Ltd), company ID (ЕИК) 206487271, Petyofi St 1, Tsentralen district, Plovdiv 4000, Bulgaria (the "Processor", the "Operator"). It is part of the Terms of Service and takes effect when you register and add a business to the Service.

The Operator processes personal data on behalf of the Controller as far as the Service needs: receiving requests from AI agents, passing them to the Controller and storing them in a journal.

• Data subjects: the Controller's customers for whom an AI agent sends a request, and the members of the Controller's team.
• Data: name, phone or other contact, email, delivery address, notes, request details (date, time, number of guests, products), and data in the request journal.
• Special categories of data are not intended to be processed. Agents and Controllers should not send them (see the Acceptable Use Policy). Notes in a request may contain such data, for example about allergies. The Controller judges this and is responsible for it.

• Processes the data only on documented instructions from the Controller. The Service, its settings and the Terms of Service are such instructions.
• Ensures that the people with access to the data are bound by confidentiality.
• Applies the security measures below.
• Uses sub-processors only on the conditions below.
• Assists the Controller with data subject requests (access, rectification, erasure and others) and with impact assessments, as far as reasonable.
• Notifies the Controller without undue delay after becoming aware of a personal data breach.
• Provides the information needed to show compliance with Art. 28 GDPR and allows audits on reasonable notice.
• Tells the Controller if it believes an instruction breaches data protection law.

The Controller gives general authorisation for the sub-processors on the list. The Operator will tell the Controller about a material change to the list and the Controller may object.

• An encrypted connection (TLS) for access to the Service.
• Passwords stored only as a hash. Email confirmation. Limits on sign-in attempts.
• Access control: a business's data is available only to its members, by role (owner, staff). A separate administrative role for the Operator, which can access a business's data, including the contents of requests, for support and security. Every administrator action is logged, and contact details (phone, email) are masked in the administration screens.
• A chain of records for every request, where each record carries the hash of the previous one so that altering an old record can be seen.
• A personal link with a random key for the phone page, which can be changed.
• Rate limits on MCP and sign-in, origin checks for browser requests, protection against access to internal networks for outgoing requests.
• The customer's phone and contact details are not returned to agents. The name, address and notes of their own request are returned.

Data is transferred outside the EEA only to Anthropic (the text of public pages) and to TypeSafe AI, Inc. (the public profile of businesses and the text of AI agents' searches), on standard contractual clauses or another ground under Chapter V of the GDPR. The Operator does not transfer customer request data (names, phones, addresses) outside the EEA.

While the Controller uses the Service, the Operator applies these periods: personal data of customers inside requests (name, phone, address, notes) is anonymised 12 months after the date of the request, and the anonymised record in the journal stays. The log of agent calls (including arguments) is kept for 90 days.

When the Controller deletes a business, the Operator removes it permanently 30 days later. Until then an administrator of the Operator can restore it. When the Service ends, or on the Controller's request, the Operator deletes the Controller's data or returns it. Copies are kept only if a law requires it.

Liability between the parties follows the Terms of Service and Art. 82 GDPR. Contact: [email protected].