FALA Data Processing Addendum

Last updated: October 16, 2026

The processor and service-provider terms for personal data that FALA processes on a customer’s behalf. This addendum is part of the Terms of Service and applies automatically, without signature.

1. Scope and Parties

This Data Processing Addendum (“DPA”) is between ELAV8 AI LLC, a Florida limited liability company (“Elav8”) and the customer that has accepted the FALA Terms of Service (“Customer”). It applies to Customer Personal Data that Elav8 processes on Customer’s behalf in providing the Services, and forms part of the Agreement. If this DPA conflicts with the Terms of Service on a matter of personal data protection, this DPA controls.

2. Definitions

“Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU and UK General Data Protection Regulations, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”), and other U.S. state comprehensive privacy laws.

“Customer Personal Data” means personal data or personal information within Customer Data. “Controller,” “processor,” “data subject,” “personal data breach,” “processing,” “business,” “service provider,” “contractor,” “sell,” and “share” have the meanings given in the applicable Data Protection Laws. “Subprocessor” means any processor Elav8 engages to process Customer Personal Data.

3. Roles of the Parties

For customer end-user data, the customer is the controller/business and FALA is the processor/service provider. FALA processes personal data only to provide and secure the services or as otherwise instructed.

Elav8 is an independent controller of personal data about Customer’s account, Users, billing, support, and security, which it processes as described in its Privacy Policy.

4. Customer’s Instructions and Responsibilities

The Agreement, Customer’s configuration of the Services, and Customer’s use of the Services’ features are Customer’s complete documented instructions to Elav8. Additional instructions require Elav8’s written agreement. Elav8 will tell Customer if it believes an instruction violates Data Protection Laws, and may suspend the affected processing.

Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving every notice, and obtaining every consent required for Elav8 to process Customer Personal Data, in particular for recording, intercepting, transcribing, and storing Visitor communications and for calls and texts. Customer will not instruct Elav8 to process special-category or sensitive data unless the parties have agreed in writing.

5. Elav8’s Processing Obligations

Elav8 will process Customer Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless the law requires otherwise (in which case Elav8 will inform Customer unless the law prohibits it).

Elav8 will not: sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, including any commercial purpose other than providing the Services; retain, use, or disclose it outside the direct business relationship between Elav8 and Customer; or combine it with personal data received from other sources, except as the Data Protection Laws permit for service providers. Elav8 will comply with the obligations applicable to it as a service provider or processor, provide the same level of privacy protection the Data Protection Laws require, and notify Customer if it can no longer meet them. Customer may take reasonable steps to stop and remediate unauthorized use.

Elav8 will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, secure, and support the Services.

6. Artificial Intelligence

Elav8 will not use Customer Personal Data to train or fine-tune artificial intelligence models, and will engage AI model providers only under terms that prohibit them from using Customer Personal Data to train their models. AI model providers may retain inputs and outputs for a limited period to detect abuse and comply with law.

7. Subprocessors

Customer gives Elav8 general authorization to engage Subprocessors. The current list is available to signed-in customers at fala.elav8.ai/subprocessors. Elav8 will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors’ performance as the Data Protection Laws require.

Elav8 will update the list at least 15 days before a new Subprocessor begins processing Customer Personal Data, except in an emergency affecting the Services’ security or availability. Customer may object on reasonable data protection grounds by emailing support@elav8.ai within that period. The parties will discuss the objection in good faith; if they cannot resolve it, Customer’s sole remedy is to stop using the affected Services and terminate the affected subscription without penalty.

8. Security

Elav8 will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. The measures in Annex II describe the current baseline; Elav8 may update them as long as it does not materially reduce overall security.

9. Personal Data Breaches

Elav8 will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Elav8 will provide further information as it becomes available and take reasonable steps to contain and remediate the breach.

Customer is responsible for notifying data subjects and authorities where the law requires. Elav8’s notification of a breach is not an acknowledgment of fault or liability.

10. Assistance and Data Subject Requests

Taking into account the nature of the processing, Elav8 will provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights, primarily through the Services’ self-service tools for exporting, correcting, and deleting data. If Elav8 receives a request directly, it will forward it to Customer when the request identifies Customer, and will not respond to it except as Customer instructs or the law requires.

Elav8 will provide reasonable assistance with Customer’s data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and based on information available to Elav8. Assistance beyond the Services’ self-service tools may be subject to reasonable fees.

11. Deletion and Return

Customer can export and delete Customer Personal Data with the Services’ tools during the subscription, and can set retention periods for conversations and leads. After the Agreement ends, Elav8 will delete Customer Personal Data in its production systems within 90 days, unless the law requires it to keep some of it. Copies in backups and logs are deleted in the ordinary course on their regular schedules and remain protected under this DPA until then. Consent records may be kept as evidence of consent, as described in the Privacy Policy.

12. Audits and Information

Elav8 will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA. Customer may exercise any audit right under Data Protection Laws by sending a written request to support@elav8.ai, no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach. Elav8 will respond to reasonable written security and privacy questionnaires. Any on-site audit requires at least 30 days’ notice, will be conducted during business hours by an independent auditor bound by confidentiality, will avoid disrupting Elav8’s operations or compromising other customers’ data, and will be at Customer’s expense.

13. International Transfers

Elav8 processes Customer Personal Data in the United States, and its Subprocessors may process it in other countries. To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated by reference: Clause 7 does not apply; under Clause 9 the general authorization and notice period in Section 7 of this DPA apply; the optional language in Clause 11 does not apply; Clause 17 is governed by the laws of Ireland; and under Clause 18 disputes are resolved by the courts of Ireland. Annex I and Annex II of this DPA complete the Clauses’ appendix.

For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with the Clauses, and for transfers subject to Swiss law, the Clauses apply with the necessary adaptations, with the Swiss Federal Data Protection and Information Commissioner as the competent authority where required.

14. U.S. State Privacy Laws

To the extent the CCPA or another U.S. state privacy law applies, Elav8 acts as Customer’s service provider, contractor, or processor; processes Customer Personal Data only for the limited and specified business purpose of providing the Services described in the Agreement; and certifies that it understands and will comply with the restrictions in Section 5. Elav8 will provide Customer the information reasonably necessary to conduct any required data protection assessment.

15. Liability and Term

Each party’s liability arising out of or relating to this DPA, however caused, is subject to the limitations and exclusions of liability in the Terms of Service, to the extent the Data Protection Laws permit. This DPA lasts as long as Elav8 processes Customer Personal Data on Customer’s behalf.

Annex I: Details of Processing

Subject matter and duration: providing the Services under the Agreement, for the duration of the Agreement and the deletion period in Section 11.

Nature and purpose: hosting, storage, retrieval, and transmission; real-time AI voice and chat processing, transcription, and response generation; knowledge base building and search; lead capture and routing; page guidance and form filling at the Visitor’s request; integrations, exports, and syncs Customer enables; usage metering and billing; security, abuse prevention, and support.

Data subjects: Customer’s website Visitors and other end users who interact with Customer’s agents, and Customer’s Users and personnel.

Categories of personal data: names, email addresses, phone numbers, and other contact details; message content and voice transcripts; requests, form entries, and other information data subjects choose to share; page addresses and context; browser identifiers, conversation identifiers, timestamps, device and browser information, and IP address; and User account details.

Special categories: none intended. Customer must not configure the Services to collect them.

Frequency: continuous, for as long as Customer uses the Services.

Annex II: Technical and Organizational Measures

Encryption: data is encrypted in transit using TLS, and is stored with hosting, database, cache, and object storage providers that encrypt data at rest.

Access control: sign-in through the ELAV8 Account using OAuth 2.1 with PKCE and optional two-factor authentication; role-based access within workspaces; Elav8 personnel access limited to what is needed to provide, secure, and support the Services.

Isolation and keys: every record is scoped to its workspace server-side; widget embed keys are locked to the customer’s own domains by default; API keys and access tokens are stored only as one-way hashes; integration credentials are encrypted.

Monitoring and accountability: an append-only audit trail of sign-ins, changes, exports, and administrative access; rate limiting and abuse detection; error and security monitoring.

Data minimization and retention: customer-configurable retention with automatic deletion of leads and transcripts; transcripts instead of audio recordings for widget voice conversations; personal information removed from helpdesk handoff transcripts where possible; dashboard telemetry that excludes message content, keystrokes, and form values.

Resilience: managed database services with backups, a separate protected copy of consent records, and infrastructure distributed across multiple machines.

Development and vendors: automated testing before release, dependency management, and contractual data protection obligations for Subprocessors.

Annex III: Subprocessors

The current list of Subprocessors, with their purposes and locations, is available to signed-in customers at fala.elav8.ai/subprocessors.