SwiftChat

Data Processing Agreement

Last updated: April 19, 2026SwiftChat Inc.

This DPA forms part of the agreement between SwiftChat (Processor) and the customer (Controller). It applies whenever SwiftChat processes personal data on the customer’s behalf.

1. Scope

This DPA governs SwiftChat's processing of personal data submitted by the Controller and end-customers via WhatsApp. It is incorporated by reference into the Terms of Service.

2. Roles

The Customer is the data Controller; SwiftChat is the Processor. End-customers' WhatsApp messages and contact information are processed on the Customer's instructions.

3. Subject matter and duration

Processing continues for the term of the subscription plus 90 days for safe deletion.

4. Nature and purpose

Storage, transmission, and analytics necessary to deliver the Service: shared inbox, broadcasts, templates, automations, AI features, and reporting.

5. Categories of data

  • End-customer identifiers (phone, name, profile)
  • Message content (text, media, metadata)
  • Custom attributes you configure
  • Operator (your team) identifiers and access logs

6. Subprocessors

We use the subprocessors listed at /security#subprocessors. The Controller authorises these subprocessors. We provide 30 days advance notice of changes.

7. International transfers

Where transfers leave the EU/EEA, we rely on Standard Contractual Clauses (Module 2 or 3). EU representatives are designated via Prighter.

8. Security

We maintain appropriate technical and organisational measures: TLS 1.3 in transit, AES-256 at rest, KMS-managed keys, audit log, role-based access, monitoring. See /security for details.

9. Breach notification

Without undue delay, and in any event within 72 hours of becoming aware of a personal data breach, we will notify the Controller with the information required under GDPR Article 33.

10. Audits

Customers may request our most recent SOC 2 / ISO attestations once available. On Enterprise plans, on-site audits may be arranged annually with reasonable notice.

11. Data subject rights

We assist the Controller with responding to data subject requests (access, erasure, restriction, portability, objection).

12. Deletion

At the end of processing, we delete personal data within 30 days unless retention is required by law.

13. Liability

The liability cap in the Terms of Service applies.

14. Contact

Use the contact form for DPA queries.