LEGAL
Data processing agreement.
Version 1.1-draft · 25 October 2026
Draft for review. This data processing agreement is not final and is not yet in effect. Bracketed items need the owner’s decision and professional legal review. Kevara AI is not taking live payments.
This Data Processing Agreement (“DPA”) forms part of the Client Services Agreement between the Client and Kevara AI (KEVARA LLC, an Indiana limited liability company, Indiana Secretary of State record 202508061915034) (“Kevara”). It applies when Kevara processes personal information on the Client’s behalf.
1. Roles and scope
- The Client decides why and how its customers’ personal information is processed (the Client is the business / controller). Kevara processes it only to provide the services, on the Client’s documented instructions (Kevara is the service provider / processor).
- Data subjects: the Client’s website visitors, callers, leads, customers and staff contacts.
- Data: contact details (name, email, phone), enquiry and conversation content, support and appointment requests, call recordings and transcripts, text message content, CRM records the Client connects, and technical identifiers (chat session ids, website origin, timestamps).
- Purpose and duration: operating the Client’s chatbot, AI receptionist and automations for the term of the Client Services Agreement and the post-termination period in section 7.
2. Kevara’s obligations
- Process the information only on the Client’s instructions and not sell it, share it for cross-context advertising, or use it to train general AI models.
- Keep each Client’s data logically separated from other clients’ data (separate tenant records, keys and webhook secrets).
- Ensure people with access are bound by confidentiality.
- Apply the security measures in section 4.
- Help the Client respond to individuals’ requests (access, correction, deletion, export) and with security incidents and assessments, where reasonable.
3. Subprocessors
The Client authorises Kevara to use the following subprocessors. Kevara will give at least 30 days’ notice of new subprocessors; the Client may object on reasonable data-protection grounds.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, website database (D1), request routing | Cloudflare data centres worldwide |
| Hostinger | Server hosting Kevara’s automation platform (n8n) and its data tables | Frankfurt, Germany (EU) |
| OpenAI | AI language models for chatbots, classification and drafting | United States |
| Vapi | AI voice calls (speech recognition, call handling, recordings, transcripts) | United States |
| ElevenLabs | Synthetic voice for AI calls | United States |
| Twilio | Phone numbers, calls and text messages | United States |
| Google (Workspace, Gmail, Calendar) | Email, calendars and documents | United States |
| Stripe | Payments, subscriptions, invoices, receipts and the billing portal | United States |
| GitHub | Website source code hosting (not intended for personal data) | United States |
AI providers receive conversation content to generate replies under their API terms. OpenAI does not use API data to train its models by default and keeps abuse-monitoring logs for up to 30 days. Vapi keeps call history for 14 days by default. ElevenLabs stores data in the United States by default.
4. Security measures
- Encryption in transit (HTTPS) for websites, APIs and provider connections.
- Signed requests between Kevara’s website and automation platform; per-client API keys and webhook-signing secrets derived from a protected secret and revocable.
- Per-client data separation enforced by the platform; allowed-website lists for each chatbot; rate limits.
- Access limited to authorised personnel; owner sign-in protected and rate-limited.
- Logging of significant actions (provisioning, configuration, exports, offboarding) in an audit record.
- A nightly backup of Kevara’s automation data, including client configuration and records, encrypted (AES-256-GCM) before it leaves the automation platform and kept in Kevara’s business email account; the key is held separately by Kevara. Backups are kept until Kevara deletes them.
5. Personal data breaches
Kevara will notify the Client without undue delay, and within [number] hours, after becoming aware of a breach affecting the Client’s personal information, with the information reasonably available, and will help the Client meet its notification obligations.
6. International transfers
Information is processed in the United States, except that Kevara’s automation platform and its data tables are hosted by Hostinger in Frankfurt, Germany (European Union), and Cloudflare serves the website from data centres worldwide (see section 3). Where the law requires transfer safeguards, the parties will put them in place.
7. Return and deletion
- During the term, the Client may request an export of its data at any time.
- After termination, the Client may request an export for 30 days, which Kevara delivers within 10 business days of a verified request. Kevara then deletes the data (and asks subprocessors to delete it) unless the law requires retention. Deletion rules are pending approval; until then Kevara does not delete client data automatically.
- Chat transcripts can be switched off or limited per client; the Client chooses the retention period for transcripts.
8. Audits and records
Kevara will make available information reasonably necessary to demonstrate compliance with this DPA [audit frequency and cost terms].
9. Excluded data
The services are not designed for protected health information under HIPAA, payment card data or government identification numbers. The Client must not send such data unless agreed in writing.
10. Liability and order of precedence
[Liability under this DPA follows the Client Services Agreement once its liability terms are approved.] If this DPA conflicts with the Client Services Agreement regarding personal information, this DPA applies.
Contact for data-protection matters: t.thomas@kevarallc.com.