Data Processing and Security Addendum (DPSA)
How we process and protect your customers' data: instructions, 72-hour incident notification, sub-processors, international transfers, jurisdiction-specific terms and security measures.
Documents
Legal and privacy documents
Public policies that apply to all our customers. Download and share them with your team. September 2026 edition.
Data Privacy Policy
What data we collect and why, legal basis, storage and security, retention, third parties, cookies and individuals' rights (GDPR, CCPA, LGPD, ARCO).
Terms of Service
The rules for using ChatSales, payments, termination and governing law (Delaware, US).
Data Protection & Security Standard
Summary of our policies, AWS certifications and the data protection laws it supports.
Contracts to sign
When your company decides to proceed, we sign a Data Processing Agreement (DPA) with the EU Standard Contractual Clauses and a Mutual Non-Disclosure Agreement (NDA). We also complete security questionnaires.
Commitments
How we protect your data
The essentials of our documents, at a glance.
Your data is yours
You are the controller; we process it only to provide the service. We never sell it or share it for advertising.
Export and delete
Export your contacts at any time. When the service ends, we delete your data within 30 days.
Per-user permissions
Admin, Editor and Agent roles. An agent can see only the chats assigned to them.
Incident notice within 72 hours
If an incident affects your data, we notify you without undue delay and within 72 hours, with the information you need.
AI under your control
AI replies only where you enable it. Data sent to the model provider is not used to train its models.
Pay Meta directly
WhatsApp message fees are paid directly to Meta, with no markup from ChatSales.
Compliance
Legal frameworks and certifications
Our practices and contracts are designed to support our customers' compliance with these laws. Infrastructure certifications are those of Amazon Web Services.
Data protection laws
International transfers under the EU Standard Contractual Clauses (2021/914) and the UK Addendum.
Infrastructure certifications (AWS)
Published by AWS at aws.amazon.com/compliance. Under the shared responsibility model, AWS secures the infrastructure and ChatSales secures what runs on it.
Sub-processors
Providers that process data
Only to provide the service. We give 30 days' notice before adding or replacing one. Current as of September 2026.
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services | Database, hosting and storage of messages and media | US, Hong Kong and other regions |
| Google Cloud | Cloud services | Configurable regions |
| Meta | WhatsApp Business Platform, Instagram and Messenger | US, Ireland / global |
| OpenAI | AI model for AI-assisted replies (only when enabled) | US |
| Render | Hosting of the AI assistant service | US |
| Cloudflare | Website, edge security and DDoS protection | Global |
| Stripe | Payment processing (billing data only) | US |