Data Processing Addendum
When your business brings its records into Kentora, your business decides how that data is used and Kentora processes it for you. This addendum sets out how. It forms part of the Terms of Service.
1. Roles
Your business is the controller of the personal information in its records (for example, contact details of its customers and suppliers). Kentora Inc. is your processor and acts only on your documented instructions: the Terms, this addendum, and the settings you choose in the app.
2. What is processed
| Item | Details |
|---|---|
| Purpose | Running Kentora Cockpit for you: syncing your systems, analysis, the agents you subscribe to, WhatsApp messages you approve |
| People | Your staff, your customers and suppliers and their contacts |
| Data | Names, business names, phone numbers, emails, addresses, invoices, payments, orders, WhatsApp conversations, images and documents you add |
| Duration | While your account is open, plus the 60-day export window after you close it |
3. Our commitments
- Process your data only for you, never for our own purposes, and never sell it or use it to train AI models.
- Keep it confidential: everyone with access is bound by confidentiality, and access is limited to what their role needs.
- Keep each business in its own database with its own encryption key; encrypt data in transit and at rest; log security events and record changes.
- Help you answer requests from people exercising their privacy rights, using the export, correction and deletion tools in the app.
- Tell you without undue delay, and within 72 hours of becoming aware, if a personal data breach affects your data, with what we know and what we are doing.
- Delete or return your data when the Service ends: you can download everything at any time, and data is deleted 60 days after you close your account (backups expire within [backup retention period]).
- Give you the information you reasonably need to check these commitments, including our security documentation, and cooperate with audits on reasonable notice at [audit terms].
4. Sub-processors
You authorise these sub-processors. We will give at least 30 days’ notice of a new one; if you object on reasonable grounds and we cannot address it, you may close your account. We hold each sub-processor to data protection terms at least as protective as these.
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud (Google LLC) | Hosting: application servers, databases, file storage, encryption keys | Sydney, Australia (australia-southeast1) |
| Anthropic, PBC | AI models behind the agents and the Assistant | United States |
| Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages you or your agents send and receive | Global |
| Stripe, Inc. | Card payments for subscriptions and AI credit | United States and global |
| [Email provider] | Account emails: confirmation, password reset, invites, account notices | [Region] |
| Tropical AI (Private) Limited | Engineering and support for Kentora, under contract and confidentiality obligations | Sri Lanka |
5. International transfers
Your records are stored in Sydney, Australia. Some processing happens elsewhere, as listed above (AI in the United States, engineering access from Sri Lanka). Transfers rely on contractual safeguards such as standard contractual clauses where the law requires them.
6. Your responsibilities
You make sure you have a lawful basis for the data you bring in, including consent from people before your agents message them on WhatsApp, and you keep your instructions lawful.
7. Contact
Data protection questions: [privacy contact email]. A signed copy of the full addendum is available on request.