1. Overview
When your business uses TellerCat, you decide why and how your customers' personal data is processed, so you are the controller. TellerCat processes that data only to provide the service, so we are your processor.
This page summarises our data processing agreement (DPA), which meets Article 28 of the UK GDPR and the EU GDPR. You accept the DPA when you sign up, and it forms part of our terms of service. The full signed text will be available in your account before the platform opens.
2. What we process
| Data subjects | Your customers and contacts who message or call you, and your team members. |
|---|---|
| Types of data | Names, contact details and channel identifiers, message contents, call transcripts, summaries and recordings if you turn them on, contact fields you define, and conversation metadata. |
| Purpose | Receiving and answering conversations, handing over to your team, running the workflows you set up, and reporting on them. |
| Duration | For as long as you use TellerCat, and then until deletion as described below. |
3. Our commitments
- We process your data only on your documented instructions, including these terms and your settings.
- We don't use your data to train AI models, and we don't sell it.
- Everyone who can access your data is bound by confidentiality.
- We keep appropriate security measures in place, described on our security page.
- We help you respond to requests from your customers to access, correct, export or delete their data.
- We help you with data protection impact assessments and with questions from regulators.
- We make available the information needed to show we meet these commitments.
4. Sub-processors
You give us general authorisation to use sub-processors. Each one is bound by a written agreement with data protection obligations equivalent to ours, and we remain responsible for them. Our current list is on the sub-processors page. We'll tell you before adding or replacing one, so you have the chance to object.
5. International transfers
Production data and backups are hosted in a UK region. If any processing happens outside the UK, we put a lawful transfer mechanism in place first, such as an adequacy decision or the UK International Data Transfer Agreement or Addendum.
6. Data breaches
We follow a written breach procedure. If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, with the information you need to meet your own obligations.
7. Retention, export and deletion
- By default, messages and transcripts are kept while your account is active, and recordings for 90 days. You can shorten both.
- You can export your data, or one customer's data, at any time.
- You can delete one customer's data across messages, recordings, transcripts, traces and derived copies. We complete export and deletion requests within 30 days.
- When you close your account, we delete your data, unless the law requires us to keep part of it.
8. Your responsibilities
As controller, you need a lawful basis for the conversations you run through TellerCat, and you need to tell your customers how you use their data, including that they may be talking to an AI agent. Don't send us data that TellerCat isn't designed for, such as data requiring HIPAA compliance or stored payment card data (PCI). Neither is supported at launch.
9. Questions
For questions about this agreement, send us a message through our contact page and choose "Security and privacy".