Legal document
Data Processing Agreement (DPA)
Last updated:
July 22, 2026
This Data Processing Agreement ("DPA") supplements and forms part of our Terms and Conditions. It applies when you ("the Customer", acting as Data Controller) use BuilderBot Cloud ("the Data Processor") to process personal data of your own end users through the builderbot.cloud platform. It complements, and does not replace, our Privacy Policy and our GDPR notice.
1. Parties
- Data Controller ("Customer"): the individual or legal entity that subscribes to the Service and determines the purposes and means of processing the personal data of its own end users.
- Data Processor ("BuilderBot Cloud"): BuilderBot Cloud, LLC, 1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States. Email: support@builderbot.cloud.
2. Subject matter, nature and duration of processing
BuilderBot Cloud processes personal data on behalf of the Customer only to the extent necessary to provide the Service (creating, hosting, and operating chatbots and Agents, including integrations with WhatsApp Business, Instagram, and Google Drive/Sheets/Docs when enabled by the Customer). The duration of processing matches the term of the service agreement between the Customer and BuilderBot Cloud, plus the retention period described in Section 8.
2.1 Location of processing and storage of Agents
As of July 22, 2026, the processing and storage of Agents created on or after that date take place by default on servers located in the European Union.
The geographic zone for artificial intelligence processing is determined by the model the Customer selects in the platform's model selector, where each model is labeled EU or USA. That choice constitutes a documented instruction for the purposes of this DPA.
It is the Customer's sole responsibility to select the model (and, with it, the geographic zone) that matches its needs and data-protection obligations. Not all models are available in Europe. If the Customer selects a model labeled USA or available only outside the European Union, the Customer accepts that processing associated with that model may take place outside the EEA and may involve international transfers subject to Section 9. BuilderBot Cloud does not guarantee that every model will be available in every region.
The EU/USA label in the selector governs generative artificial intelligence processing. Other platform, voice, payment, or messaging sub-processors listed in Section 7 may process data in the United States or other locations regardless of that label, pursuant to the safeguards in Section 9.
3. Categories of data and data subjects
- Categories of data subjects: end users who interact with the Customer's chatbots (for example, the Customer's own customers or WhatsApp/Instagram contacts).
- Categories of data: identification and contact data, the content of messages exchanged with the chatbot, technical usage metadata, and any additional data the Customer configures its conversational flows to collect.
No special categories of data (Article 9 GDPR) are processed unless the Customer itself voluntarily introduces them into its flows, which is the Customer's sole responsibility.
4. Controller's instructions
BuilderBot Cloud will process personal data only on the Customer's documented instructions, as reflected in the platform configuration and the applicable service agreement, unless required to do otherwise by European Union or Member State law; in that case, BuilderBot Cloud will inform the Customer of that legal requirement before processing, unless prohibited from doing so on important grounds of public interest.
Without prejudice to the foregoing, the Customer authorizes BuilderBot Cloud to use internally, for testing, quality control, debugging, and improvement of the Service, data processed on the Customer's behalf, subject to the following limitations:
- To the extent reasonably possible, BuilderBot Cloud will use anonymized or aggregated data that does not allow identification of natural persons.
- If, exceptionally, identifiable personal data are required to debug or ensure the stability of the Service, access will be restricted to authorized personnel and such data will not be disclosed to third parties for purposes unrelated to providing or improving the Service.
- The Customer may object in writing to support@builderbot.cloud to the use described in this paragraph for internal improvement and testing. Such objection will not affect processing necessary to provide the contracted Service, nor will it relieve the Customer of its obligations as Controller. Absent a written objection, the authorization in this paragraph is deemed granted.
5. Confidentiality and authorized personnel
BuilderBot Cloud ensures that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to provide the Service.
6. Technical and organizational security measures
BuilderBot Cloud applies reasonable security measures, including:
- Encryption in transit (HTTPS/TLS) for communications with the platform.
- Secure storage at rest with the infrastructure providers listed in Section 7.
- Restricted access limited to authorized personnel.
- Deletion of the Customer's data within a maximum of 30 days after termination of the contract (see Section 8).
7. Authorized sub-processors
The Customer authorizes BuilderBot Cloud to engage the following sub-processors to provide the Service.
The location of artificial intelligence processing depends on the model the Customer selects in the platform selector (labeled EU or USA). Not all models are available in Europe. See Section 2.1.
7.1 Infrastructure
| Sub-processor | Function | Location |
|---|---|---|
| Vercel | Hosting and delivery of the marketing website | United States |
| Hetzner | Hosting of the main application | European Union |
| Microsoft Azure | Hosting of the AI microservice (VM) | European Union |
| MongoDB | Database of the main application | European Union |
| MongoDB Atlas | Database of the AI microservice | European Union |
| AWS | Document storage (S3) | European Union |
7.2 Generative AI processing
These sub-processors are engaged only when the Customer selects the corresponding model or provider:
| Sub-processor | Function | Location |
|---|---|---|
| Microsoft Azure OpenAI | Generative AI processing (GPT models and Model Router) | European Union |
| Google Cloud Platform (Vertex AI) | Generative AI processing (Gemini, Claude, and xAI/Grok served via Vertex AI) | European Union or United States, depending on the model selected by the Customer |
| Parasail | Generative AI processing (DeepSeek, Gemma, and related models) | European Union or United States, depending on the model selected by the Customer |
| Fireworks AI | Generative AI processing (GLM, Kimi, DeepSeek Pro, and related models) | United States |
7.3 Voice / text-to-speech
| Sub-processor | Function | Location |
|---|---|---|
| ElevenLabs | Voice generation / text-to-speech | United States |
| Inworld AI | Voice generation / text-to-speech | United States |
7.4 Platform, payments, and integrations
| Sub-processor | Function | Location |
|---|---|---|
| Cal.com | Appointment scheduling | United States |
| Cloudflare | Anti-bot protection (Turnstile) on login | United States |
| Resend | Transactional email delivery | United States |
| Stripe | Payment processing and billing | United States |
| PostHog | Product analytics | United States |
| Meta | Messaging platforms (WhatsApp, Instagram), when enabled by the Customer | United States / Ireland |
BuilderBot Cloud imposes data protection obligations on these sub-processors that are equivalent to those set out in this DPA. If we onboard a new sub-processor with access to personal data, we will update this table and communicate the change on this page at least 30 calendar days before that sub-processor begins processing the Customer's personal data. If the Customer has a reasonable, documented objection on data protection grounds, it may raise it in writing to support@builderbot.cloud within that 30-day period; absent an objection within that period, the new sub-processor will be deemed accepted. If the objection is not resolved by mutual agreement within a reasonable time, the Customer may terminate the affected Service contract; BuilderBot Cloud is not obliged to provide an equivalent alternative sub-processor or model in the European Union, and will not be liable for the unavailability of an alternative the Customer considers equivalent.
If the Customer uses the database agent feature to connect its own PostgreSQL database, that database is the Customer's own infrastructure and is not included in the tables above; the Customer is responsible for its security and configuration.
8. Deletion or return of data
Upon termination of the contractual relationship, BuilderBot Cloud will permanently delete personal data processed on behalf of the Customer within a maximum of 30 days, unless applicable law requires a different retention period.
If the Customer requests in writing to support@builderbot.cloud the return or export of its data before contract termination, and such return is technically feasible, BuilderBot Cloud will make an export available in a commonly used format. Absent a timely written request or if return is not feasible, deletion will proceed. After deletion, no general right of later return will remain.
9. International transfers
When processing involves a transfer of personal data outside the European Economic Area — in particular, the transfer from the Customer (exporter / Controller) to BuilderBot Cloud, LLC (importer / Processor) — the Parties are governed by the European Commission's Standard Contractual Clauses (Module 2) published at /en/scc, which form part of this DPA. Where the sub-processor is certified, BuilderBot Cloud may also rely on the EU-U.S. Data Privacy Framework, or equivalent adequacy mechanisms offered by the sub-processors listed in Section 7.
If the Customer selects a model labeled USA or any configuration that involves processing outside the EEA, that selection constitutes a documented instruction by the Customer authorizing the corresponding international transfer. The Customer is solely responsible for assessing the lawfulness of that transfer with respect to its own end users and for informing them where required.
10. Assistance to the Controller
BuilderBot Cloud will assist the Customer, to the extent reasonably possible given the platform's functionality, so that the Customer can comply with its obligation to respond to data subject rights requests (access, rectification, erasure, portability, objection, and restriction), and with its obligations regarding security, breach notification, and impact assessments, when reasonably required. The Customer remains solely responsible for handling requests from its own end users and for deciding the content of any response.
11. Personal data breach notification
In the event of a breach of security affecting personal data processed on behalf of the Customer, BuilderBot Cloud will notify the Customer without undue delay and in any case within a maximum of 72 hours after becoming aware of it, providing the information available so the Customer can meet its own notification obligations under the GDPR.
12. Audits
BuilderBot Cloud will make available to the Customer information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and, where applicable, the SCCs. Upon a reasonable request, BuilderBot Cloud will respond in the first instance via security questionnaires or equivalent documentation.
Without prejudice to the audit rights under the SCCs (Clause 8.9), any on-site audit or inspection will only take place: (a) with reasonable prior notice; (b) under an appropriate NDA; (c) during business hours and in a manner that does not unduly disrupt the Service; and (d) at the Customer's expense, unless the audit reveals a material breach attributable to BuilderBot Cloud.
13. Customer representations and warranties
The Customer represents and warrants that:
- It has a valid legal basis under the GDPR (or other applicable data protection law) for processing the personal data of its own end users through the Service.
- It has provided its end users with all the information required under Articles 13 and 14 of the GDPR before their personal data is processed through the Service.
- Its instructions to BuilderBot Cloud, as well as the configuration applied to its chatbots and flows, do not infringe the GDPR or any other applicable data protection law.
- It is solely responsible for obtaining the consents necessary from its own end users to enable third-party integrations (WhatsApp Business, Instagram, Google Drive/Sheets/Docs) and for any special category data it chooses to introduce into its flows under Section 3.
- It is solely responsible for selecting the artificial intelligence model (labeled EU or USA in the platform selector) appropriate for its Agent, acknowledging that not all models are available in Europe and that a choice outside the EEA may involve international transfers under Sections 2.1 and 9.
- It accepts that content, responses, and outputs generated by third-party artificial intelligence models are produced under its instruction and configuration, and that BuilderBot Cloud does not control or warrant the accuracy, lawfulness, or suitability of such outputs.
- It has read and accepts that use of each AI provider and integration is also subject to that third party's terms.
14. Liability and indemnification
- Each party's own compliance: each party is responsible for its own obligations under the GDPR. Nothing in this DPA relieves BuilderBot Cloud of its obligations as a data processor under Article 28 of the GDPR.
- Limitation of liability: to the maximum extent permitted by applicable law, BuilderBot Cloud's aggregate liability arising out of this DPA is subject to, and is not additional to or cumulative with, the limitations of liability set out in the applicable Terms and Conditions or Service Conditions between the parties.
- Exclusion of indirect damages: unless resulting from BuilderBot Cloud's willful misconduct or fraud, or to the extent applicable law prohibits such exclusion, BuilderBot Cloud will not be liable for lost profits, lost revenue, loss of business opportunity, or any indirect, incidental, special, or consequential damages arising from the processing of personal data under this DPA.
- Exclusion for Customer choices and third parties: to the maximum extent permitted by law, BuilderBot Cloud will not be liable for (a) the Customer's selection of models labeled USA or other configurations involving processing outside the EEA; (b) the unavailability of a specific model in Europe; (c) acts, omissions, outages, or policies of sub-processors or AI/messaging providers beyond BuilderBot Cloud's reasonable control; or (d) content or decisions generated by AI models under the Customer's configuration.
- Full Customer indemnification: the Customer will indemnify and hold BuilderBot Cloud fully harmless, including reimbursement of legal costs, attorneys' fees, and defense expenses reasonably incurred, from any claim, penalty, fine, regulatory investigation, or damage arising from: (i) Customer instructions that violate the GDPR or other applicable data protection law; (ii) the Customer's lack of a valid legal basis for processing the data of its own end users; (iii) the Customer's failure to meet its notice or consent obligations toward its end users under Section 13; (iv) misuse or unauthorized use of the WhatsApp Business, Instagram, or other messaging integrations, including sending unsolicited communications ("spam") or communications that violate those platforms' policies; (v) the introduction of special categories of data or other sensitive data into its conversational flows without a valid legal basis; (vi) the selection of models or regions that involve international transfers or processing outside the EEA; (vii) content, responses, or outputs generated by AI models under the Customer's instruction or configuration; or (viii) the Customer's use of the Service in breach of this DPA, the GDPR, or the applicable Terms and Conditions. This indemnification applies regardless of the limitations of liability set out for BuilderBot Cloud in the preceding paragraphs.
- Time limit for claims: any claim arising from this DPA must be notified in writing to BuilderBot Cloud within one (1) year of the claiming party becoming aware, or reasonably having become aware, of the facts giving rise to it, unless applicable law mandatorily provides for a different period.
15. General provisions
- Force majeure: neither party will be liable for failures resulting from causes beyond its reasonable control, including infrastructure or artificial intelligence provider outages, natural disasters, government actions, or widespread network disruptions.
- Assignment: BuilderBot Cloud may assign this DPA, in whole or in part, in connection with a merger, acquisition, or substantial sale of assets, and will notify the Customer through this page or by email.
- Severability: if any provision of this DPA is held invalid or unenforceable, the remaining provisions will remain in full force and effect.
- Entire agreement: this DPA, together with the applicable Terms and Conditions or Service Conditions and the Privacy Policy, constitutes the entire agreement between the parties regarding the processing of personal data, and supersedes any prior agreement on this subject.
- No third-party beneficiaries: this DPA does not create rights enforceable by the Customer's end users or any third party outside the parties, without prejudice to third-party beneficiary rights under the SCCs (in particular Clause 3) and to any rights those end users may have directly against BuilderBot Cloud under the GDPR and our GDPR notice.
16. Governing law and precedence
This DPA is governed by the same applicable law as the Terms and Conditions, except as provided in the SCCs regarding Clauses 17 and 18 (law and forum of a Member State, Ireland).
In case of conflict: (1) the SCCs prevail on international transfers Customer → BuilderBot Cloud; (2) this DPA prevails on personal data processing as processor, including indemnity, Customer warranties, liability caps, and USA-model instructions, provided it does not directly contradict the SCCs or prejudice data subjects' rights; (3) the Terms and Conditions prevail otherwise.
17. Contact
BuilderBot Cloud, LLC
- Address: 1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States
- Email: support@builderbot.cloud