Data Processing Addendum (DPA)
Last updated: 2/16/2026
This DPA applies when Aliigo processes personal data on behalf of a business customer (“Customer”) as a processor in connection with the Service.
1. Roles
Customer is the controller of personal data submitted to or collected via the Service (e.g., website visitor messages and leads). Aliigo acts as a processor and will process such data only to provide and improve the Service and as documented by Customer instructions.
2. Processing details
Subject matter: providing the website assistant service. Duration: for the term of the subscription. Categories of data subjects: Customer website visitors; Customer staff/users. Types of personal data: names, emails, phone numbers (if collected), message content, metadata. Processing operations: collecting, storing, analyzing to generate responses, transmitting to Customer, and supporting product operations.
3. Processor obligations
Aliigo will: (a) process data only on documented instructions; (b) ensure confidentiality; (c) implement reasonable security measures; (d) assist Customer with data subject requests where applicable; (e) notify Customer of personal data breaches without undue delay after becoming aware.
4. Subprocessors
Customer authorizes Aliigo to use subprocessors to provide the Service. Key subprocessors may include: - Supabase (database/auth) - Vercel (hosting) - Cloudflare (security/CDN) - Resend (transactional email) - Stripe (payments) - OpenAI (AI processing) Aliigo may update subprocessors over time. A current list may be provided via a Subprocessors page.
5. International transfers
Where processing involves transfers outside the EEA, Aliigo relies on appropriate safeguards such as SCCs and vendor-provided transfer mechanisms where applicable.
6. Deletion or return
Upon termination, Aliigo will delete or return Customer personal data within a reasonable time, unless retention is required by law.
7. Audit
Upon reasonable request, Aliigo will provide information necessary to demonstrate compliance with this DPA, subject to confidentiality and security constraints.