Data Processing Agreement

01Parties and scope

This Data Processing Agreement (DPA) is between the customer who uses HiAgent (the controller) and HiAgent, an individual activity (individuali veikla) registered in Lithuania (the processor).

It applies when HiAgent processes personal data of the customer's website visitors through the widget. It forms part of the Terms of Service and applies automatically when the customer uses the service.

HiAgent's own processing of account and billing data is covered by the Privacy Policy, not by this DPA.

02Details of the processing

Subject matter and purpose: answering website visitors' questions from the customer's approved sources, capturing leads, and handing conversations to the customer's team.

Data subjects: visitors who use the widget on the customer's website.

Personal data: questions and conversation content, optional email addresses and other lead fields the customer enables, page URLs, timestamps, and technical request data.

Duration: while the customer's workspace exists. Processing ends when the workspace or account is deleted.

The customer must not collect special categories of personal data through the widget.

03HiAgent's obligations

HiAgent processes personal data only on the customer's documented instructions. The customer's settings in the dashboard and use of the service are those instructions.

HiAgent tells the customer if it believes an instruction breaks data protection law.

Everyone who works on HiAgent and can access personal data is bound by confidentiality.

HiAgent helps the customer, as far as it reasonably can, to answer data subject requests and to meet its obligations under GDPR Articles 32 to 36.

04Security

Encrypted connections (HTTPS with HSTS) for the dashboard, API, and widget.

Access to workspace data is limited to the workspace owner and the team members the owner invites, and is checked on the server for every request.

Passwords are stored as hashes. API keys and model credentials stay on the server.

Rate limits, CSRF protection, and signed payment webhooks protect the service against abuse.

Regular backups to restore data after an incident.

05Subprocessors

The customer gives general authorization for HiAgent to use these subprocessors: Hostinger (hosting, database, and email), Cloudflare (network and security), OpenRouter and the AI model provider it routes to, such as OpenAI (AI answers), and Google (service monitoring).

HiAgent puts data protection terms in place with each subprocessor that are no less protective than this DPA.

HiAgent updates this page before it adds or replaces a subprocessor. The customer can object by writing to [email protected]. If the objection cannot be resolved, the customer can cancel the service.

Where a subprocessor processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

06Personal data breaches

HiAgent notifies the customer without undue delay after it becomes aware of a personal data breach that affects the customer's data.

The notice describes what happened, the data affected, the likely consequences, and the measures taken, as far as HiAgent knows them.

07Deletion and audits

When the customer deletes a workspace or account, HiAgent deletes the personal data in it. Copies in backups are removed when those backups expire.

The customer can export leads and conversations from the dashboard before deletion, where the plan includes export.

HiAgent gives the customer the information needed to show compliance with this DPA. The customer can ask questions or request an audit by writing to [email protected].