Data Processing Agreement

Clarly processes personal data only to provide the service described in the Terms. The parties, people, data, purposes and duration are set out in Annex 1, the security measures in Annex 2, and the sub-processors in Annex 3.

Clarly processes personal data only on your documented instructions, which are these terms and the settings you choose in the console, unless the law requires otherwise; in that case Clarly tells you first unless the law forbids it. Clarly tells you if it believes an instruction breaks the law. Clarly does not use your customers' data for its own purposes, for advertising or to train AI models.

• Have a legal basis for the processing, and the opt-ins Meta and the law require before you message customers.
• Tell your customers, in your privacy notice, how their messages are processed, that you use Clarly as your processor, and that they can ask for a person.
• Do not use Clarly for data the law requires you to keep in Saudi Arabia. No personal data is hosted in Saudi Arabia today.

Everyone at Clarly who can access your customers' data is bound by confidentiality and has access only as far as their work requires.

Clarly keeps in place at least the technical and organisational measures in Annex 2, and may improve them over time but will not reduce the overall level of protection.

You authorise Clarly to use the sub-processors in Annex 3. Clarly binds each one to data-protection terms at least as protective as this DPA and remains responsible to you for their work.

Clarly will notify the account owner by email at least 14 days before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot resolve it, you may close your workspace before the change takes effect.

The sub-processors process data outside the Kingdom, including in Japan (database and files), Singapore (application servers) and the United States (AI models, email and monitoring). No personal data is hosted in Saudi Arabia today. Clarly makes these transfers only under the conditions set by the PDPL and its Regulation on Personal Data Transfer outside the Kingdom. Where that Regulation requires an appropriate safeguard, Clarly relies on the standard contractual clauses issued by the Saudi Data & AI Authority (SDAIA), or another safeguard the Regulation allows, with the sub-processor concerned, and limits each transfer to the data needed for the purpose.

Clarly will tell you within 48 hours of confirming a breach that affects your customers' data, with what is known: what happened, the data and people affected, likely consequences, and what Clarly has done and recommends. Clarly will update you as it learns more and help you meet your duty to notify SDAIA within 72 hours and to notify affected people.

Clarly will help you answer your customers' requests to access, correct, destroy or obtain a copy of their data, and will pass on to you, without answering it, any such request it receives directly. Clarly will give you the information you reasonably need for a data-protection impact assessment or a consultation with SDAIA.

Return: at any time before closing your workspace, an admin can download a full copy of its data from the console's data-export settings. Each export file stays downloadable for 7 days.

Deletion: when you close your workspace, all of its data, including conversations, customers and uploaded files, is permanently erased 30 days later; until then the closure can be undone. During the subscription, conversation transcripts are deleted automatically 90 days after the customer's last message. Copies in our database provider's encrypted backups expire on its rolling schedule. Clarly keeps only what the law requires it to keep, and protects it under this DPA for as long as it does.

On request, once a year or after a breach, Clarly will answer a reasonable written security questionnaire and give you the information needed to show it meets this DPA. Any on-site audit needs 30 days' notice, is at your cost, is subject to confidentiality, and is limited to what the questionnaire could not answer. Clarly will also cooperate with SDAIA when it exercises its powers.

Each party is liable for its own breach of this DPA and of the PDPL. Liability under this DPA is subject to the exclusions and the cap in the Liability section of the Terms, which apply to this DPA and the Terms together and not separately, except where the law does not allow liability to be limited.

This DPA lasts as long as Clarly processes personal data for you, including during the deletion period after your workspace closes. Sections 4, 8, 10 and 12 continue to apply after that for any data Clarly still holds.

If this DPA and the Terms conflict on personal data, this DPA wins. It is governed by the laws of the Kingdom of Saudi Arabia, and disputes are settled as set out in the Terms. If the Arabic and English versions differ, the Arabic version prevails. Contact: privacy@clarly.esap.ai, 7384 King Abdul Aziz Road, Al Murooj District, 4349, Riyadh 12282, Saudi Arabia.

• Controller: you, the business that uses Clarly. Processor: Clarly.
• People concerned: your customers and prospects who message you, use the chat on your website or comment on your posts, and your team members.
• Personal data: names, phone numbers, Meta page-scoped IDs and website-chat visitor IDs; message text, images, voice notes and other media; order, booking and delivery details including addresses; comments on your posts; marketing opt-in and opt-out status.
• Nature of the processing: receiving, storing, transcribing and analysing messages with AI models; drafting and sending replies; searching your knowledge and product information; handing conversations to your team; creating orders and bookings; tracking deliveries.
• Purpose: providing the service to you under the Terms.
• Duration: the term of your subscription, then deletion as set out in section 10. Transcripts are deleted 90 days after the customer's last message.

• Encryption in transit (TLS) for all traffic; the database and file storage are encrypted at rest by our provider, and access tokens and other credentials are additionally encrypted by Clarly.
• Each business's data separated from every other business's by database row-level security, enforced on every request.
• Role-based access in the console, optional two-factor authentication, and an audit log of actions.
• Production access limited to staff who need it to run the service.
• Message bodies never written to application logs; personal data redacted from logs and kept out of error reports.
• Incoming notifications from Meta, stores and couriers verified by signature and rejected if verification fails.
• Automatic deletion of transcripts and other data on the schedules in the Privacy Policy, and full erasure of closed workspaces.
• Backups kept by our database provider, encrypted, and expiring on its rolling schedule.
• A written incident-response procedure with the notice times in section 8.
• Replies instructed never to diagnose or give medical, medication or treatment advice, and to hand those questions to your team.

Each sub-processor, what it does and where it processes data:

• Meta Platforms: WhatsApp Business Platform, Messenger and Instagram: sending and receiving messages, United States and global.
• Google (Gemini API): AI models that read messages, images and voice notes and draft replies; search indexing of knowledge documents and product photos, United States and global.
• Cohere: Ranking knowledge search results, United States and Canada.
• Supabase: Database, authentication and file storage, Japan (Amazon Web Services, Tokyo).
• Render: Application servers and job queues, Singapore.
• Vercel: Website and console hosting, United States and global edge network.
• Polar (with Stripe as card processor): Subscription billing and payments as merchant of record, United States and European Union.
• Resend: Service emails, United States.
• Sentry: Error monitoring (personal data scrubbed before sending), United States.
• Web3Forms: Website waitlist form, United States.