Back to home

Data Processing Addendum

Version 1.0 (draft) - Last updated: 16 August 2026

This Data Processing Addendum (DPA) forms part of the agreement between AGENTIC LLC, trading as Carima (the processor, we), and the business customer using our services (the controller, you). It describes how we handle the personal data you entrust to us, who our sub-processors are, how long data is kept, and how it is deleted. A countersigned copy for your records is available on request from support@carima.ai; customers in Turkey receive it together with the KVKK standard contract described in section 5.

1. Roles and scope

You are the data controller: you decide why your customers' data is collected and what happens to it. We are the data processor: we act on your instructions. The providers we use to deliver the service are sub-processors, listed in section 4. This addendum governs only the personal data we process on your behalf - your customers' identities, conversations, orders and similar records, together called customer personal data. Data about you that we process for our own purposes - your account, billing details, security logs and business contacts, together with the minimal compliance log described in section 6 - is processed by AGENTIC LLC as an independent controller under our privacy policy and sits outside this addendum. This addendum assumes you use the platform as the controller of your customers' data; if you use it as a processor for clients of your own, contact us before onboarding so that processor-to-subprocessor terms can be put in place.

Two consequences are worth stating plainly. First, the duty to inform your customers about their data, and to obtain any consent your business needs, is yours. The platform provides the mechanism, a stored notice delivered before any message reaches an AI model and a record of what each person answered, but configuring it and naming yourself as the data controller in it remain your decisions. Second, we do not use your data to improve our own product: your customers' messages are not used to train models, are not pooled across customers, and are not analysed for any purpose other than serving your account.

2. Our commitments

We process customer personal data only to provide the service described in your agreement, on your documented instructions, including the instructions you give through the platform's own configuration, and where a law binding on us requires it - which, for data subject to the GDPR, means Union or Member State law - in which case we will inform you before processing unless that law prohibits it. The specific business purposes of the processing are enumerated in section 13. If we believe an instruction of yours breaks data protection law, we will tell you.

  • We do not sell personal data or share it for cross-context behavioural advertising
  • We do not retain or use personal data outside the direct business relationship with you
  • We do not combine your data with data from another source, except as you direct through the service's features and as permitted by law
  • Everyone we allow near personal data is bound by written confidentiality obligations that survive the end of their engagement, and gets access only to what their role requires

These are the service provider commitments US privacy law requires, and we give them to every customer regardless of where they are.

3. Security measures

The following measures are implemented today, not planned. We may change a measure, but not in a way that materially reduces the overall level of security. Section 14 is the complete schedule of technical and organisational measures; this section highlights the ones specific to what we build.

3.1 Separation between customers

Each customer's data is logically separated from every other customer's. The separation is enforced at the database layer through row-level access policies rather than by application code, so a query missing its customer scope returns nothing rather than another customer's data, and database connections use least-privilege roles that cannot bypass those policies.

3.2 Encryption

  • TLS for all external connections and all internal service-to-service calls
  • Storage-level encryption on the database and on object storage
  • Third-party credentials held under envelope encryption, with data keys wrapped by a managed key service, decrypted only at the moment of the call and never written to logs

3.3 Access control

  • Role-based access within each account (owner, admin, member), enforced on the server
  • Internal service-to-service calls require a shared key and are not reachable from the public internet
  • Provider credentials never leave the backend and are never sent to a browser

3.4 Safeguards specific to an AI platform

  • Where you configure consent or another pre-processing gate, it is enforced in the backend before data is passed to an AI model - a rule living in an AI prompt would run after the processing it is meant to govern
  • Output arriving from external tools is treated as untrusted and blocks high-risk actions for the rest of that run, so text from outside cannot instruct an assistant to act
  • An assistant may only reply to the person it is talking to; it cannot choose a different recipient
  • Per-assistant and per-run spending limits pause an assistant instead of letting a malfunction run unbounded

4. Sub-processors

You give general authorisation for us to engage the sub-processors below, and to add or replace one. We will publish and notify you of a change at least 30 days before the new provider starts processing your data, and you may object on reasonable data protection grounds within those 30 days; if we cannot find an alternative together, you may terminate the affected part of your agreement without penalty. Every sub-processor is bound by data protection obligations no less protective than these, and we remain fully liable to you for their performance. For customers under the Turkish standard contract, a sub-processor change also updates the executed contract's annexes and is re-notified to the Board. This page is the published list.

4.1 Infrastructure

Our primary persistent storage of customer personal data is here; the sub-processors below may temporarily process or retain data as part of providing their service.

  • Amazon Web Services (compute, database, file storage, key management, outbound email) - United States, us-east-1

4.2 AI model providers

Conversation content is sent to these providers to generate replies. Which one receives your data depends on the model your assistants are configured to use, and that setting is yours to change: changing the model changes which sub-processor sees the conversation. All are listed so the choice is never invisible to you. None of them are permitted to train on your data under our agreements with them.

  • OpenAI - replies, and text embeddings for search and memory - United States
  • Anthropic - replies - United States
  • Google - replies and image generation - United States
  • Amazon Bedrock, hosting Anthropic, Amazon, DeepSeek and Qwen models - replies - United States, within AWS

4.3 Channel and feature providers we engage

Providers we engage to power specific features; each sees your data only when you use that feature.

  • Telnyx - the telephone numbers we provision for you, calls and SMS - United States
  • ElevenLabs - speech-to-text and text-to-speech for calls - United States
  • Composio - integration infrastructure through which the third-party services you connect exchange data - United States

4.4 Customer-directed third parties are not sub-processors

Beyond the providers above, the platform can connect to a large catalogue of third-party services at your direction - both our own integrations and more than a thousand services reachable through our integration partner. When you connect such a service and your assistants exchange data with it, that exchange happens on your instruction, under your own agreement with that service: you hold the account there, and you decide what the connection is used for. Enabling an integration is your instruction to us to disclose to that customer-directed third party the data the integration requires. A payment provider you connect to collect your own customers' payments - PayTR, for example - is exactly such a service: the merchant account is yours, and we hold only its connection credentials. Those services therefore act under your relationship with them - as your own processor or as an independent controller, depending on that provider's terms - and not as our sub-processors; the 30-day notice above does not apply to them. Our role is limited to transmitting what the configured task requires and holding the connection credentials securely. The messaging channels themselves work the same way: your WhatsApp Business and Instagram accounts are your own and you accept Meta's terms when you connect them, and a Telegram bot is created by you, with a token that belongs to you. These platforms carry the conversations as the communication service you and your customers both chose; they act under your relationship with them, not as our sub-processors. They are named here anyway, because conversation content necessarily flows through them on its way to and from your assistants.

Card details are handled by the payment provider and never reach our systems.

5. International data transfers

Personal data is processed in the United States. Where our personnel access data from outside the country it came from, that access counts as a transfer and is covered by the same mechanism.

5.1 From the EU and EEA

The EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module Two, controller to processor, are incorporated into this addendum and completed as follows: Annex I.A (the parties) is deemed completed with the parties to your agreement; Annex I.B (details of the transfer) with section 13; Annex I.C with the supervisory authority determined in accordance with Clause 13; and Annex II with section 14. The clauses' Annex III is completed only under Clause 9 Option 1; under the Option 2 general authorisation used here, the agreed list of sub-processors is the one maintained in section 4. The docking clause applies. Clause 9 uses Option 2, general written authorisation with 30 days' notice, as described in section 4. Under Clause 17 Option 2 and Clause 18, the clauses are governed by the law of, and disputes are heard in, the Member State in which you are established; where that law does not provide for third-party beneficiary rights, or where you are not established in a Member State, the law and courts of Ireland apply instead. The optional redress mechanism in Clause 11 is not selected. Entering into your agreement constitutes execution of the clauses, including Annex I, by both parties.

5.2 From Turkey

Turkey has issued no adequacy decision, including for the United States, so transfer relies on Standard Contract No. 2 (Controller to Processor) published by the KVKK Board, signed without modification, in its Turkish text, by duly authorised signatories. The information in sections 13, 14 and 4 is used to populate the corresponding annexes of the executed Turkish standard contract - what is signed and filed is that contract, not this page. Unless otherwise agreed in it, the standard contract designates us as the notifying party: we notify the Board within five business days after both parties' signatures are complete, and send you the executed copy together with proof of the filing. KVKK Article 9 permits informed explicit consent as one of the exceptional grounds, available only for occasional transfers where the statutory conditions are met and the person is informed of the possible risks; we do not rely on that exception for continuous processing.

5.3 From the United Kingdom

The same clauses apply together with the UK International Data Transfer Addendum (ICO version B1.0), or any successor instrument issued by the ICO; per the Addendum's default, the governing law is that of England and Wales and its courts have jurisdiction. The Addendum's Part 1 tables are deemed completed as follows: Table 1 with the parties to your agreement; Table 2 with the clauses as completed in section 5.1; Table 3 with sections 13, 14 and 4; and Table 4 allowing either party to end the Addendum when the ICO issues a revised version. Where UK law requires a transfer risk assessment (the statutory data protection test), we will provide reasonable assistance with it.

5.4 From Switzerland and other jurisdictions

Transfers from Switzerland rely on the same EU clauses with the adaptations recognised by the Swiss Federal Data Protection and Information Commissioner, with Swiss law governing where Swiss data protection law requires it. Where you are established in another jurisdiction whose law prescribes its own transfer instrument, we will execute the locally required instrument on request; until then this addendum and the clauses above apply as the baseline.

5.5 Transfer impact assessment

We maintain written transfer-assessment materials covering us and our sub-processor chain - the laws and practices of the destination country, the nature of the data, the safeguards in section 14 and each provider's own commitments - and we provide them to assist the parties in completing any assessment the applicable transfer mechanism requires. If we receive a legally binding request from a public authority concerning your data, we will notify you before disclosing anything unless the law prohibits it, in which case we will seek a waiver and challenge the prohibition, and we will disclose only the minimum required. A dated summary, including the number of government requests received to date, is available to you on request.

6. How long data is kept

Personal data is not kept until further notice. Each category has a default period, measured from the last relevant event and enforced by an automated job. You stay in control: the defaults below can be shortened per category on the Privacy screen, and you may instruct us to delete data earlier at any time, except where a law binding on us requires otherwise.

  • Conversation content, meaning messages and chat transcripts - default 24 months from the last message in that conversation; configurable
  • Call transcripts - default 6 months from the end of the call; configurable
  • Contact records such as name, phone, email and address - default 24 months of inactivity, counted from the latest of a record edit, an appointment including a future one, or a message; configurable
  • Derived profiles, meaning facts an assistant inferred and conversation summaries - default 12 months without use; configurable
  • Commercial records such as orders and invoicing data - kept for the life of your subscription and deleted at the end of the agreement (section 7). Statutory bookkeeping periods, such as ten years under Turkish commercial law, bind you as the controller: export your records before closing your account if your law requires longer
  • Consent and disclosure evidence - default 10 years after the consent ends, subject to your instructions; on an erasure request the person's words and identifiers are removed, and only a minimal record (notice version, timestamp, event) remains, kept by AGENTIC LLC as an independent controller to demonstrate its own compliance
  • Documents you upload - until you delete them
  • Usage and cost records, which contain no message content and no customer identifiers - 12 months

Call audio is transiently processed by our telephony and speech providers for transcription; we do not persist the audio, and only the transcript reaches our database. The lifecycle has two phases. When a period ends, the record is first pseudonymised: names, addresses, message content and identifiers embedded in technical fields are deleted, and the identifier is replaced by a keyed one-way code whose key is held separately from the database, so your counts and history stay intact for a while longer. Because a pseudonymised record is still personal data, it does not live forever either: twelve months after the period ends, the individual-level record is deleted outright, leaving only data that no longer relates to an individual. We never attempt to re-identify pseudonymised data, and only aggregated statistics from which no individual-level record remains are treated as anonymous. Data removed from production also leaves disaster-recovery backups on our automated cycle - currently 7 days, and in any event no later than 35 days.

7. Deletion

There are three routes, and all three are implemented rather than promised:

  • Automatic: a nightly job finds records that have reached the end of their retention period and pseudonymises them; twelve months later the pseudonymised individual-level record is deleted outright (section 6)
  • On request: an erasure request from one of your customers is processed through Console, Privacy and completes within 30 days, covering conversations, message logs, the contact record, the identifying content of consent evidence and the assistant's derived memories and conversation summaries about the person, in a single operation (section 6 describes the minimal record that remains)
  • End of contract: at your choice we return your data in a structured, commonly used, machine-readable format within 30 days of your request, and delete it within 30 days of the end of the agreement, except where a law binding on us requires us to keep something, in which case we keep only what that law requires, for only as long as it requires

8. Requests from data subjects, and assisting you

The platform gives you self-service tools for the rights your customers hold, including access, correction, erasure, objection and withdrawal of consent, under Console, Privacy. Where a request reaches us instead of you, we will not respond to it on our own account: we will pass it to you without undue delay and provide reasonable assistance if you need it. Beyond individual requests, we will provide reasonable assistance - taking into account the nature of the processing and the information available to us - with your obligations under GDPR Articles 32 to 36: security, breach notification, data protection impact assessments and prior consultation with supervisory authorities, and their equivalents under other applicable law.

We will not notify your data subjects or any authority on your behalf unless you ask us in writing or the law requires us to.

9. Personal data breach

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours. That window is deliberately shorter than the deadline you face, which is 72 hours to the supervisory authority under GDPR Article 33 and to the KVKK Board under the Board's notification decision, so that the remaining time is yours rather than ours.

The notification will describe what happened, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken, and a contact point. Where we cannot provide all of it at once we will provide it in phases without further undue delay.

10. Audit and information

We will make available the information needed to demonstrate compliance with this addendum, including the descriptions above and, where they exist, current third-party audit reports and certifications of our infrastructure providers. You may audit us, or appoint an independent auditor who is not our competitor, once per twelve months - and additionally after a personal data breach affecting you, where required by applicable law, a supervisory authority or the applicable standard contractual clauses, or where there is reasonable evidence of material non-compliance - on 30 days' written notice, during business hours, without unreasonable disruption and subject to confidentiality. You bear the cost unless the audit reveals a material breach of this addendum.

11. Country-specific terms

11.1 United States

We are a service provider under the California Consumer Privacy Act as amended by the CPRA, and a processor under the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other US states with comparable statutes. We certify that we understand the restrictions in section 2 and will comply with them, and we provide at least the level of privacy protection those laws require of you. We assist you with consumer requests as described in section 8; if we determine we can no longer meet these obligations we will notify you, and you may take reasonable and appropriate steps to stop and remediate any unauthorised use of personal data. We will also reasonably assist you with any legally required privacy risk assessment, cybersecurity audit or automated decision-making technology assessment, to the extent it concerns our processing of your data. Where you are a covered entity under HIPAA or handle other sector-regulated data, the platform is not offered for that purpose without a separate written agreement.

11.2 European Union and EEA

This addendum is intended to satisfy GDPR Article 28(3)(a) to (h) in full: section 2 covers instructions and confidentiality, section 3 security, section 4 sub-processors, sections 7 and 8 data subject rights, deletion and assistance, section 9 breach assistance, and section 10 audit and information. We maintain records of processing activities under Article 30(2) and make available what is needed to demonstrate compliance. Transfers rely on the clauses in section 5.1.

11.3 Turkey

We act as veri isleyen (data processor); you are the veri sorumlusu (data controller) and are responsible for your VERBIS registration where you are required to have one. Transfer abroad relies on Standard Contract No. 2 as described in section 5.2. KVKK Board principle decision 2026/347 requires the disclosure and the consent request to be separate acts, and the platform is built to keep them separate: informing your customers, asking them about marketing and requiring consent before answering are three independent settings, and the disclosure is never bundled into a consent question.

11.4 United Kingdom

The UK GDPR imposes the same processor requirements as Article 28 of the EU GDPR, and this addendum satisfies them in the same way as described for the EU. Transfers rely on the mechanism in section 5.3, and references to a supervisory authority include the Information Commissioner's Office.

11.5 Other jurisdictions

The commitments in this addendum apply to all personal data we process for you, wherever you and your customers are. Where the law of another jurisdiction - for example Brazil's LGPD, Canada's PIPEDA and Quebec Law 25, Australia's Privacy Act or Switzerland's revised FADP - requires specific processor terms, we will execute the locally required terms on request, and this addendum applies as the baseline until then.

12. Changes, precedence and contact

If this addendum conflicts with your agreement, this addendum prevails on data protection matters; if it conflicts with the Standard Contractual Clauses or the KVKK standard contract, those prevail. Each party's liability under this addendum is subject to the limitations agreed in your agreement, except where data protection law does not permit them to apply. We may update this addendum to reflect a change in law, a new sub-processor or a change in the platform, on 30 days' notice, and changes that materially reduce your rights require your agreement. This addendum applies for as long as we process personal data for you, and its confidentiality, deletion and liability provisions survive.

Address: AGENTIC LLC, 1925 W River Rd Apt 11307, Tucson, AZ 85704, United States

13. Details of processing (Schedule 1)

This section is the processing record for the whole addendum: it completes Annex I.B of the EU clauses and Table 3 of the UK Addendum, supplies the content for the annexes of the executed Turkish standard contract, and lists the specific business purposes US law requires a service-provider contract to state.

  • Subject matter: operation of AI assistants that answer your customers on your connected channels, take orders and bookings, and perform the tasks you configure
  • Duration: the term of your agreement, plus the retention periods in section 6
  • Nature: collection, recording, organisation, storage, retrieval, use, transmission to the AI model providers in section 4.2 to generate replies, disclosure to customer-directed third parties on your instruction, de-identification and erasure
  • Specific business purposes: receiving and answering inbound customer communications; sending service notifications and, where you enable them, marketing messages; creating and updating orders, appointments and customer records; retrieving knowledge you uploaded to ground answers; carrying out the integrations you configure; and preventing abuse and misuse of the service
  • Data subjects: your customers and prospective customers; your staff, to the extent their messages and work inside the platform are processed on your behalf (their account and business-contact details fall under the section 1 carve-out); people mentioned in messages
  • Personal data: name, phone number, email, messaging identifiers, conversation content and call transcripts, order and appointment details, consent evidence, documents you upload
  • Call audio and voice data - transiently processed by the telephony and speech providers in section 4.3 where voice features are enabled; we do not persist call audio in our own storage and do not use voice for biometric identification or speaker recognition
  • Special categories: not intentionally solicited; they may appear incidentally in free-text communications. Where they do, they remain subject to the safeguards in section 14 and the retention limits in section 6, are never used for profiling or inference, and are handled under applicable special-category requirements and your documented instructions; the platform must not be configured for a purpose that requires the systematic collection of special-category data without a separate written agreement
  • Frequency: continuous, as your customers write and call
  • Your instructions reach us through: the agreement, this addendum, the platform's configuration screens, and written instructions to support

14. Technical and organisational measures (Schedule 2)

The schedule of measures for the transfer instruments: it completes Annex II of the EU clauses and supplies the content for Annex II of the executed Turkish standard contract. Everything listed is implemented; nothing here is aspirational.

  • Pseudonymisation and encryption: TLS in transit; storage-level encryption at rest; third-party credentials under envelope encryption with a managed key service; expired or erased records pseudonymised with a keyed one-way code whose key is held apart from the database
  • Customer separation: row-level access policies enforced in the database itself, with least-privilege connection roles that cannot bypass them
  • Access control: role-based access within each account, enforced server-side; internal service calls behind a shared key, unreachable from the public internet; provider credentials never sent to a browser
  • Availability and resilience: managed database with automated daily backups and 7-day point-in-time recovery (the 35-day figure in section 6 is the contractual ceiling for backup persistence; current practice is 7 days); services run as replaceable containers behind a load balancer
  • Restore: backups allow restoration to any point inside the recovery window; the retention and deletion jobs re-apply to restored data
  • Event logging: application and access logging, with credential values excluded by design
  • Change and configuration management: infrastructure and deployment configuration kept in version control; changes reviewed and deployed through automated pipelines
  • Vulnerability management: dependencies kept current and changes code-reviewed before deployment
  • Effectiveness testing: automated test suites that exercise the customer-separation, consent-gate and retention controls run on every change
  • Physical security: inherited from our infrastructure provider's data centres, which maintain ISO 27001 and SOC 2 attestations
  • Data minimisation: assistants recall only memories scoped to the customer they are talking to, and connected services receive only what the configured task requires
  • AI-specific safeguards: the pre-processing gate, untrusted-content containment, recipient pinning and spending limits described in section 3.4
  • Retention and erasure: the automated periods in section 6 and the three deletion routes in section 7
  • Portability: export of your data in a structured, commonly used, machine-readable format (section 7)
  • Accountability: records of processing activities under GDPR Article 30(2), and an internal data-processing inventory kept current as providers change
  • Incidental special-category data: never used for profiling or inference; expires with the conversation content it arrived in