Data Processing Addendum

1. Scope, roles and acceptance

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer") and Beyondt Consultancy & Services Pvt. Ltd. ("TalkToWP", "we"), whose details are on our Legal & company information page. It is incorporated into our Terms of Service by reference and applies from the moment you use the Service. It applies to personal data we process on your behalf when you connect a WordPress site, and prevails over the Terms on processor matters.

Roles. The Customer is the controller of that personal data, or, where the Customer manages sites for its own clients, a processor acting for them. TalkToWP is the Customer's processor, or sub-processor. For our own account, billing and usage data we act as controller, as described in our Privacy Policy, which this DPA does not cover.

2. Processing on documented instructions

We process personal data only on the Customer's documented instructions. The Terms, the Customer's configuration in the TalkToWP dashboard, and every request made through the plugin, the dashboard or a connected AI assistant (MCP tool calls) together constitute those instructions. If we think an instruction breaches data-protection law, we will tell the Customer. We may also process personal data where law requires it, and will tell the Customer first unless the law forbids that.

3. Confidentiality

Everyone who has access to the personal data on our behalf is bound by a duty of confidentiality.

4. Security

We maintain the technical and organisational measures in Annex 2.

5. Sub-processors

The Customer gives us general authorisation to use the sub-processors below. We will notify the Customer before adding or replacing one, and the Customer may object on reasonable data-protection grounds. If we cannot accommodate the objection, the Customer may terminate the affected service. We bind each sub-processor to data-protection obligations no less protective than those in this DPA, and remain responsible for them.

Sub-processor	Purpose	Data
Dodo Payments	Payments, billing, tax, invoicing (Merchant of Record)	Name, email, payment details
Supabase	Authentication and database	Email, account data, all monitoring and action data
Railway	Application hosting	All of the above, in transit and in compute
Anthropic	AI analysis and chat	Site URL, site context, incident error text, chat messages
Cloudflare	CDN, DDoS protection, analytics loader	IP addresses, request metadata
Resend	Transactional email	Email address, notification content
Google PageSpeed Insights	Performance analysis	Public site URLs
PostHog	Product analytics	Usage events, IP address
Google Analytics 4	Web analytics	Usage events, IP address

Supabase and Railway host data in Sydney, Australia (Supabase) and Singapore (Railway). AI assistants that the Customer connects itself are chosen by the Customer and are not our sub-processors.

6. Assistance

Taking into account the nature of the processing, we will help the Customer respond to data-subject requests, carry out data-protection impact assessments, and handle personal-data breaches, so far as the information is available to us.

7. Personal-data breach

We will notify the Customer of a personal-data breach affecting its data without undue delay, and in any event within 72 hours of becoming aware of it. The notice will describe, so far as we know, what happened, the data and people affected, the likely consequences, and what we are doing about it, and we will add detail as we learn it.

8. Deletion or return

When the Customer's account ends, we will delete or return the personal data on request, unless law requires us to keep it. We delete it within 90 days of termination.

9. Audit and information

We will give the Customer the information needed to show we comply with this DPA, in the first instance through documentation and security questionnaires. If that is not enough, the Customer may audit us on reasonable notice, at the Customer's cost, during business hours, and without unreasonable disruption.

10. International transfers

We operate from India and use sub-processors in other countries, including the United States and the European Union. Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the following apply and are incorporated here:

• the European Commission's Standard Contractual Clauses: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is acting as a processor for its own client;
• the UK International Data Transfer Addendum, for transfers subject to UK GDPR;
• for personal data transferred from India, the requirements of the Digital Personal Data Protection Act, 2023.

Annex 1. Details of processing

Subject matter, nature and purpose

Monitoring WordPress sites, detecting and explaining incidents, and, where the Customer enables Site Actions or connects an AI assistant, carrying out the changes and reads that the Customer requests. The processing is continuous while the Customer's account is active.

Categories of data subjects

• The Customer's WordPress site administrators and authors
• Where WooCommerce actions are used, the store's customers

Categories of personal data

• Administrator usernames, email addresses and registration dates (from the suspicious-admin scan)
• Post titles and 120-character content excerpts (from the malware scan), and the username of the logged-in user on a manual push
• The contents of the WordPress debug log
• When Site Actions or MCP is used: the contents of files read or written, post and page content, WooCommerce product data, and WooCommerce order status and notes, which may include customer details
• Technical data about the site (versions, plugins, themes, performance, security configuration), which is not personal data in itself

Where a WooCommerce order note is marked as a customer note, WooCommerce sends it by email to the store's customer. The Customer is responsible for the content and lawfulness of those messages.

Annex 2. Security measures

• TLS for data in transit; encryption at rest through our database provider
• Dashboard API tokens stored only as SHA-256 hashes, with the plaintext shown once. Per-site API keys are shared HMAC signing secrets and are therefore stored in recoverable form.
• Row-level security on most tables, and a two-tier storage layer that enforces tenant isolation
• A guard against server-side request forgery on every outbound fetch to a customer URL
• Rate limiting on public endpoints
• HMAC signature, nonce and timestamp on every site action, with a five-minute window and single-use nonces
• Site Actions off by default, needing both a per-site dashboard permission and a master toggle in the customer's own WordPress admin
• The plugin refuses to read or write credential-bearing files (wp-config.php, .env, .htpasswd, private keys), resolving symlinks first, and confines writes to wp-content/

Contact

Questions about this DPA: [email protected]. Security reports: [email protected].