Accordo sul trattamento dei dati

This addendum (“DPA”) is part of the Terms of Service between Nexuscore, LLC (“Processor”, “we”) and the customer using IsTyping (“Controller”, “you”). It applies whenever we process personal data on your behalf through the service.

1. Roles

You are the controller of the personal data in your workspace — your visitors’, contacts’ and team members’ data (“Customer Personal Data”). We are your processor. Each of us complies with the data protection law that applies to it.

2. Instructions

We process Customer Personal Data only on your documented instructions: these terms, this DPA, and how you configure and use the service (for example, turning on a channel or AI assist is an instruction to send the data that feature needs to its provider). If we believe an instruction breaks the law, we will tell you. If the law requires us to process data otherwise, we will tell you first unless the law forbids it.

3. Confidentiality

Everyone at Nexuscore, LLC who can access Customer Personal Data is bound by confidentiality and only accesses it when needed to provide or support the service, to keep it secure, or when you ask us to (for example, when you allow a platform administrator to open your workspace to help you — such access is recorded in an audit log).

4. Security

We implement the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may improve them over time but will not reduce the overall level of protection.

5. Sub-processors

You authorise us to use the sub-processors listed in Annex 3. Most of them only receive data when you turn on the feature they serve. We will give you at least 30 days’ notice of a new sub-processor, by email or in the app, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may cancel the affected service. We impose data protection terms on each sub-processor that are no less protective than this DPA and remain responsible for them.

Systems that are yours and that you point the service at — your own mail server for the email channel, your WHMCS installation, your single sign-on provider, your webhook endpoints, the sites your status monitors check, or another tool you import from — are not our sub-processors: you choose them and your agreement with them applies. Messaging providers are listed in Annex 3 even when you connect them with your own account, because the service exchanges your customers’ messages with them.

6. Helping you with requests

The service includes tools to answer data-subject requests yourself: export everything about a person, erase (delete or anonymise) it with a signed certificate, set retention periods, place legal holds, and export the whole workspace. Where you cannot do something with these tools, we will help you within a reasonable time. If we receive a request directly from one of your data subjects, we will pass it on to you and not answer it ourselves unless you ask us to.

We will also give you reasonable information you need for data protection impact assessments and consultations with authorities, as far as it concerns our processing.

7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have at the time (what happened, the data and people likely affected, likely consequences, and what we are doing about it), and keep you updated.

8. Deletion and return

During the subscription you can export or delete Customer Personal Data at any time. When the subscription ends, you have 30 days to export it; we then delete it, except where the law requires us to keep it. Backups are overwritten in their normal cycle.

9. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA. If that is not enough, you may audit our compliance once a year with at least 30 days’ notice, at your cost, in a way that does not disrupt the service or expose other customers’ data.

10. Transfers

Customer Personal Data is stored in United States. Where a sub-processor processes it in another country, we rely on a valid transfer mechanism required by the law that applies.

11. Liability and term

The liability limits of the Terms of Service apply to this DPA. This DPA lasts as long as we process Customer Personal Data for you.

Annex 1 — Details of the processing

• Subject matter and duration: providing the IsTyping service for the term of the subscription.
• Nature and purpose: hosting, storing, transmitting and displaying conversations and contact data so your team can communicate with your customers; the optional features you turn on (co-browsing, channels, email, AI assist, automations, analytics).
• Data subjects: your website visitors and customers who contact you; your contacts; your team members.
• Categories of data: names, email addresses, phone numbers, messaging-app identifiers; message content and files; technical data of visitors (IP address unless you turn storing it off, approximate location, browser and device, pages visited); custom data you send about visitors; co-browsing recordings while a session runs (streamed to your agent, not stored); ratings and notes.
• Special categories: none intended. Do not ask visitors for special category data unless you have a lawful basis and have configured retention accordingly.

Annex 2 — Technical and organisational measures

• Separation of customers: every query is scoped to one workspace; data of other workspaces is not reachable.
• Access control: roles (owner, admin, agent); optional and enforceable two-factor authentication; single sign-on; re-authentication for sensitive actions; rate limiting of sign-in and public endpoints.
• Passwords stored as scrypt hashes; API tokens and recovery codes stored as hashes.
• Stored credentials for integrations encrypted with AES-256-GCM.
• Encryption in transit (HTTPS) for the app, the widget and its API.
• Session cookies that are HttpOnly, SameSite=Lax and Secure; origin checks on state-changing requests; a strict Content-Security-Policy on the app.
• Co-browsing only with the visitor’s consent (by default), always-masked password fields and optional masking of all inputs; remote control off by default and always asked.
• Audit logs of security- and privacy-relevant actions.
• Tools for export, erasure, retention and legal holds (section 6).
• Backups of the database and uploaded files.

Annex 3 — Sub-processors

Each row marked “when enabled” only receives data after you turn that feature on.