Data Processing Agreement

1. Subject matter & duration

This Data Processing Agreement ("DPA") forms part of the agreement under which Zybo AI, operated by Zyfolks Technologies LLP (a limited liability partnership registered in Kerala, India), provides the customer-support platform described at zybo.ai ("the Service") to its customer ("Customer").

The Customer is the data controller for personal data processed through the Service ("Customer Personal Data"). Zybo AI acts as the data processor and processes Customer Personal Data only on the documented instructions of the Customer.

This DPA applies for as long as Zybo AI processes Customer Personal Data on behalf of the Customer, and survives termination for any post-termination obligations (e.g. data return or deletion).

tl;dr — Customer is the controller, Zybo AI is the processor. We process only what you tell us to, only as long as you tell us to.

2. Categories of data subjects & data

Categories of data subjects:

• Customer's employees, contractors, and agents (dashboard users — owners, admins, operators, viewers).
• Customer's end users who interact with the AI agents or human agents deployed by Customer.
• Visitors to Customer's website, where Customer has enabled the optional visitor-map feature for an AI agent.

Categories of personal data:

• Identifiers: name, email, phone (if provided via the pre-chat form), user ID, opaque visitor token, IP address (for chatted visitors), user agent.
• Account & profile data: organization, role, permissions, billing currency.
• Conversation content: messages exchanged with AI agents and human agents, attachments accepted in conversation.
• Knowledge base content: documents the Customer chooses to ingest (uploads, pasted text, crawled website content).
• Visitor-map metadata (when enabled by Customer): country / region / city derived server-side from IP via a local MaxMind GeoLite2 database, device type, referrer URL, current page URL, UTM parameters, session pages. The raw IP and full user-agent are not stored in the visitor-events table.
• Usage metadata: timestamps, request counts, model token counts, latency samples.

Zybo AI does not require special-category data (health, biometric, etc.) to operate the Service. Customers should avoid including special-category data in conversations and knowledge bases unless they have a lawful basis to do so.

3. Sub-processors

Zybo AI engages the sub-processors listed in our Privacy Policy § 4 to deliver the Service. The list there is the authoritative version and is reproduced here by reference.

Zybo AI commits to:

• Imposing data-protection obligations on each sub-processor that are no less protective than those in this DPA.
• Remaining liable to the Customer for sub-processor performance.
• Notifying the Customer of any new sub-processor before that sub-processor begins processing Customer Personal Data, giving the Customer a reasonable opportunity to object.

4. Security measures

Zybo AI implements technical and organizational measures appropriate to the risks of processing, including:

• Tenant isolation. Every row of chat and knowledge-base data carries a tenant_id. Every query that reads from those tables includes a WHERE tenant_id = $1 clause derived from the authenticated request context. Vector and keyword searches pre-filter by tenant_id before scoring, so cross-tenant retrieval is mathematically impossible at the query layer.
• Encryption in transit. TLS 1.2+ for all customer traffic, terminated at the Cloudflare edge.
• Encryption at rest. AES-256-GCM at the application layer for secrets we must be able to re-display (AI-agent API keys, OAuth refresh tokens). Object storage (Cloudflare R2) encrypts all stored attachments and documents at rest with AES-256 by default. Passwords use bcrypt (cost 12); refresh / magic-link / reset / verification tokens are one-way SHA-256 hashed.
• Access control. Role-based access control inside each workspace (owner, admin, operator, viewer); principle of least privilege; append-only audit log of every authentication event and state-changing API call (see Security § 5).
• Application hardening. Prompt-injection detection, output filtering, per-tier rate limiting (see Security § 6), per-organization quota and budget enforcement.
• Operational controls. Production access restricted to a small set of identified personnel; access credentials rotated on offboarding; mandatory dependency patching as a release-gate. Two-factor authentication for dashboard sign-in is on the roadmap.

For a deeper dive, see our Security page.

5. International transfer mechanisms

Zybo AI is operated from India. Some sub-processors used to deliver the Service (OpenAI, Cohere, Resend, Google, Cloudflare) are headquartered in the United States, so Customer Personal Data may be transferred to and processed in the US in the course of providing the Service.

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the parties rely on the Standard Contractual Clauses (SCCs) approved by the European Commission, with the UK Addendum and Swiss Addendum as applicable, incorporated by reference into this DPA.

USD billing through Razorpay International Payments. USD subscriptions are routed through Razorpay's International Payments product. The payment instrument and billing details for USD subscriptions are processed by Razorpay in India under RBI regulation; this is part of the Service's billing flow rather than the Customer Personal Data processing pipeline.

Zybo AI will assist the Customer in carrying out any transfer-impact assessment the Customer reasonably requires.

6. Sub-processor changes

Zybo AI will give Customers at least 14 days' notice before authorizing a new sub-processor to process Customer Personal Data. Notice will be given by email to the address(es) on file or via an in-product notification.

If the Customer reasonably objects to a proposed sub-processor on data-protection grounds within the notice period, the parties will work in good faith to resolve the objection. If no resolution is found, the Customer may terminate the affected portion of the Service for cause.

7. Data subject rights & assistance

To the extent the Customer is unable, using the functionality of the Service, to respond to a data-subject request (access, rectification, erasure, restriction, portability, or objection), Zybo AI will, on Customer request and at Customer cost, provide reasonable assistance in fulfilling that request. We aim to respond to assistance requests within 30 days of receipt.

If Zybo AI receives a data-subject request directly from a data subject, it will promptly forward the request to the Customer and not respond to the data subject except to confirm receipt and direct them to the Customer.

8. Audits & breach notification

Audits. Zybo AI will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including third-party audit reports (e.g. SOC 2) once available. The Customer may also conduct an on-site audit on reasonable advance notice, at the Customer's cost, no more than once per year, except where required by a competent supervisory authority.

Breach notification. Zybo AI will notify the Customer without undue delay (and in any event within 72 hours of becoming aware) of a personal-data breach affecting Customer Personal Data. The notice will include, to the extent known, the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address it.

9. Term & deletion

On termination of the underlying agreement, Zybo AI will, at the Customer's choice, return or delete all Customer Personal Data, except where retention is required by applicable law (notably billing records retained for tax and accounting purposes).

Workspace deletion follows a 30-day grace period during which any workspace owner can cancel the scheduled deletion. After the grace period elapses, a daily lifecycle worker hard-purges the workspace and cascades to all conversations, messages, documents, document chunks, API keys, widget settings, AI agents, and tenants belonging to that workspace. Account (user) deletion follows the same 30-day grace pattern.

For a full breakdown of retention windows by data category, see Privacy Policy § 7.

Customers can request a signed copy of this DPA, including the SCCs, by emailing support@zybo.ai.