Last updated: November 10, 2026
In short
- This addendum is part of our Terms of Service. It applies automatically, with nothing to sign.
- We process your visitors’ data only on your instructions, keep it confidential and protect it.
- Need a signed copy for your records? Email us and we will send one.
This Data Processing Addendum (“DPA”) is between you (the “Customer”) and LiveChatBot (“we”) and forms part of the Terms of Service. It applies when we process personal information on your behalf while providing LiveChatBot, under laws such as the CCPA and other US state privacy laws, the GDPR, the UK GDPR and India’s DPDP Act.
1. Scope and roles
- Subject matter: providing the live chat widget, inbox, AI Agent, flows, help desk, CRM, visitor insights and reports.
- Duration: while you have an account, plus the deletion period in section 8.
- People concerned: visitors to your websites and people who chat with you.
- Personal information: chat messages; names, emails and phone numbers visitors give; form answers; IP address and approximate location; device and browser details; pages viewed and activity on your website.
- Roles: you are the business (or controller); we are your service provider (or processor).
2. Your instructions and our promises
We process personal information only to provide the Service and as you set it up in the product (for example turning on the AI Agent, webhooks or form leads), or as the law requires. As your service provider we will not sell or share it, keep or use it for any other purpose, or combine it with personal information from other sources, except as the CCPA allows. We will tell you if we can no longer meet these duties or if we think an instruction breaks the law.
3. Confidentiality
Everyone at LiveChatBot who can access personal information is bound to keep it confidential and only accesses it when needed to run or support the Service.
4. Security
We use technical and organizational measures suitable for the risk, described on our Security page, including encryption in transit, hashed passwords and API keys, separation between accounts, and keeping card details out of our systems.
5. Sub-processors
You authorize the sub-processors listed on our Sub-processors page. We have written terms with each of them that protect personal information at least as well as this DPA. We update that page before adding a new sub-processor. If you object on reasonable data-protection grounds, tell us within 14 days; we will try to find a solution, and if we cannot, you may close your account.
6. Helping you
We help you, as far as we reasonably can, to answer requests from the people concerned, carry out data protection assessments and talk to regulators. Visitor profiles in the product show what we hold about each visitor.
7. Security breaches
If we become aware of a breach affecting your personal information, we tell you without undue delay with what we know about what happened, the likely effects and what we are doing about it, so you can meet your own notification duties.
8. Deleting data
When you delete a website or close your account, we delete its personal information from our live systems within 30 days, and from backups when they are next replaced, unless the law requires us to keep it.
9. International transfers
LiveChatBot is operated from India, and some providers are in the United States. Where personal information from the EEA or UK is transferred to a country without an adequacy decision, the transfer relies on Standard Contractual Clauses or another lawful safeguard.
10. Information and audits
On request, we give you the information you reasonably need to show you meet your obligations, such as answers to security questionnaires. Requests: support@livechatbot.in.