Legal document
Standard Contractual Clauses (SCCs)
Last updated:
July 22, 2026
Commercial preface
This document forms part of the Terms and Conditions and the Data Processing Agreement (DPA). By using the builderbot.cloud Service, the Customer accepts these Standard Contractual Clauses ("SCCs") to the same extent that it accepts the DPA.
Roles. For the purposes of these SCCs:
- Data exporter: the Customer that contracts the Service and acts as Controller of the personal data of its own end users.
- Data importer: BuilderBot Cloud, LLC, 1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States (processor). Email: support@builderbot.cloud.
Hierarchy. On international transfers of personal data outside the European Economic Area (EEA), these SCCs prevail. On all other matters — including Customer warranties, indemnity, liability caps, exclusion for selection of models labeled USA, and the Customer's documented instructions — the DPA prevails, in particular Sections 2.1, 9, 13, and 14, provided they do not directly contradict these SCCs or prejudice data subjects' rights.
Customer instructions. The Customer's selection of a model labeled USA (or any configuration that involves processing outside the EEA) constitutes a documented instruction by the exporter authorizing the corresponding international transfer. The Customer is solely responsible for assessing the lawfulness of that transfer with respect to its own end users and for informing them where required, in accordance with the DPA.
This preface and Annexes I–III do not modify the official SCC text (Clause 2: invariability). They do not constitute legal advice.
1. Incorporation of the SCCs (Module 2)
The Parties incorporate by reference the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, applicable to Module 2: Transfer controller to processor.
Modules 1, 3, and 4 do not apply unless the Parties agree otherwise in writing.
The full official text of the Clauses is available on EUR-Lex. Annexes I, II, and III of this document complete the Appendix to those Clauses and form an integral part of them.
2. Selected options
Pursuant to the incorporated Clauses:
- Applicable module: Module 2 (controller → processor).
- Clause 9 — Use of sub-processors: Option 2 (general written authorisation). The Customer generally authorizes BuilderBot Cloud to engage the sub-processors listed in Annex III and in Section 7 of the DPA. BuilderBot Cloud will give at least 30 calendar days' prior notice of new sub-processors via the DPA page. The Customer may object in writing to support@builderbot.cloud within that period, on the terms of DPA §7.
- Clause 7 (docking clause): optional; not activated by default.
- Clause 11 (redress): the standard option under the Clauses applies without further expansion.
- Clauses 17 and 18 (governing law and forum for the SCCs): the Parties choose the law of Ireland and the courts of Ireland solely with respect to these SCCs. The remainder of the contract (Terms, Service Conditions, and the DPA on commercial matters) remains governed by Delaware law and forum under the Terms.
Where a sub-processor is certified under the EU-U.S. Data Privacy Framework or another equivalent adequacy mechanism, BuilderBot Cloud may also rely on that mechanism, without prejudice to these SCCs regarding the Customer → BuilderBot Cloud transfer.
Annex I
I.A. List of parties
Data exporter (Controller)
- Name / entity: the Customer that contracts the BuilderBot Cloud Service (as per account and billing details).
- Address: as provided by the Customer in its account or contract.
- Contact details: as provided by the Customer in its account.
- Relevant activities: determines the purposes and means of processing personal data of its own end users through the platform.
- Signature / acceptance: by using the Service and accepting the Terms and the DPA.
Data importer (Processor)
- Name: BuilderBot Cloud, LLC
- Address: 1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States
- Contact details: support@builderbot.cloud
- Relevant activities: provides the Service (creation, hosting, and operation of chatbots and Agents, and integrations enabled by the Customer) processing personal data on behalf of the exporter.
- Signature / acceptance: publication of these SCCs and provision of the Service under the Terms and the DPA.
I.B. Description of the transfer
- Categories of data subjects: end users who interact with the Customer's chatbots (for example, the Customer's WhatsApp/Instagram customers or contacts).
- Categories of personal data: identification and contact data, content of messages exchanged with the chatbot, technical usage metadata, and any additional data the Customer configures to collect through its conversational flows. Special categories of data (GDPR Art. 9) are not processed unless the Customer voluntarily introduces them, which is the Customer's sole responsibility.
- Frequency of the transfer: continuous for the duration of the service contract.
- Nature of the processing: hosting, storage, transmission, generation of responses via artificial intelligence models (according to the model selected by the Customer), technical operations necessary to provide the Service, and — to the extent authorized by DPA §4 — limited internal use for testing, quality control, debugging, and Service improvement (preferably with anonymized or aggregated data).
- Purpose(s): to provide the BuilderBot Cloud Service on behalf of the Customer, in accordance with the DPA and the platform configuration, including Service improvement and stability on the terms of DPA §4.
- Retention period: coincides with the term of the contract, plus a maximum of 30 days after termination for permanent deletion, unless a different legal obligation applies (DPA §8).
- Transfers to third countries: processing and storage of Agents created from July 22, 2026 take place by default in the European Union. The geographic zone of AI processing is determined by the model the Customer selects (labeled EU or USA). If the Customer selects a USA model or a configuration that involves processing outside the EEA, transfers to the United States or other third countries may occur, including those involving the sub-processors in Annex III. That selection constitutes a documented instruction by the exporter. The EU/USA label governs generative AI processing; other platform, voice, or payment sub-processors may process data in the United States pursuant to Annex III.
- Recipients / sub-processors: those listed in Annex III and DPA §7.
I.C. Competent supervisory authority
The competent supervisory authority is that of the Member State in which the exporter is established. If the exporter is established in more than one Member State, or if GDPR Article 3(2) applies, the competent authority is determined in accordance with Clause 13 of the SCCs. BuilderBot Cloud does not designate a single authority for all customers.
Annex II — Technical and organisational measures
BuilderBot Cloud applies, among others, the following measures (aligned with DPA §6):
- Encryption in transit (HTTPS/TLS) for communications with the platform.
- Secure storage at rest with the infrastructure providers listed in Annex III.
- Restricted access limited to authorized personnel, subject to confidentiality obligations.
- Deletion of the Customer's data within a maximum of 30 days after termination of the contract, unless a different legal obligation applies.
- Imposition on sub-processors of data protection obligations equivalent to those in the DPA.
- Notification of personal data breaches to the Customer within a maximum of 72 hours of becoming aware of the breach (DPA §11).
Operational detail may be expanded through security questionnaires or equivalent documentation upon the Customer's reasonable request (DPA §12).
Annex III — List of sub-processors
The Customer generally authorizes (Clause 9, Option 2) the following sub-processors. The live list and the 30-day notice and objection terms appear in DPA §7; if there is any discrepancy as to the current composition of the list, the DPA page prevails.
The location of artificial intelligence processing depends on the model the Customer selects in the platform selector (labeled EU or USA). Not all models are available in Europe.
Infrastructure
| Sub-processor | Function | Location |
|---|---|---|
| Vercel | Hosting and delivery of the marketing website | United States |
| Hetzner | Hosting of the main application | European Union |
| Microsoft Azure | Hosting of the AI microservice (VM) | European Union |
| MongoDB | Database of the main application | European Union |
| MongoDB Atlas | Database of the AI microservice | European Union |
| AWS | Document storage (S3) | European Union |
Generative AI processing
These sub-processors are engaged only when the Customer selects the corresponding model or provider:
| Sub-processor | Function | Location |
|---|---|---|
| Microsoft Azure OpenAI | Generative AI processing (GPT models and Model Router) | European Union |
| Google Cloud Platform (Vertex AI) | Generative AI processing (Gemini, Claude, and xAI/Grok served via Vertex AI) | European Union or United States, depending on the model selected by the Customer |
| Parasail | Generative AI processing (DeepSeek, Gemma, and related models) | European Union or United States, depending on the model selected by the Customer |
| Fireworks AI | Generative AI processing (GLM, Kimi, DeepSeek Pro, and related models) | United States |
Voice / text-to-speech
| Sub-processor | Function | Location |
|---|---|---|
| ElevenLabs | Voice generation / text-to-speech | United States |
| Inworld AI | Voice generation / text-to-speech | United States |
Platform, payments, and integrations
| Sub-processor | Function | Location |
|---|---|---|
| Cal.com | Appointment scheduling | United States |
| Cloudflare | Anti-bot protection (Turnstile) on login | United States |
| Resend | Transactional email delivery | United States |
| Stripe | Payment processing and billing | United States |
| PostHog | Product analytics | United States |
| Meta | Messaging platforms (WhatsApp, Instagram), when enabled by the Customer | United States / Ireland |
If the Customer uses the database agent feature to connect its own PostgreSQL database, that database is the Customer's own infrastructure and is not part of this Annex; the Customer is responsible for its security and configuration.
Contact
BuilderBot Cloud, LLC
- Address: 1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States
- Email: support@builderbot.cloud