Trust
Data processing terms
Pre-launch draft. These policies describe proposed arrangements, not a service operating today. Product behaviour, commercial terms, company details and legal review remain pending. They do not take effect until launch.
When a business puts our assistant on its website, the business decides what happens to its visitors’ data and we handle it on the business’s behalf. These terms set out how, as the GDPR requires. They form part of our terms of service and apply automatically to every customer.
Who is who
The customer is the controller of the personal data that its website visitors give the assistant (the “customer data”). NuTea Limited, trading as Punjabi Labs (“we”), is the customer’s processor. We are a controller in our own right for the data described in our privacy policy, such as account and billing details.
What we process
| Subject matter | Providing the voice and chat assistant to the customer’s website visitors, and sending the resulting enquiries to the customer. |
|---|---|
| Duration | For as long as the customer has an account, plus up to 30 days to delete the data afterwards. |
| Nature and purpose | Receiving visitors’ speech and text, generating replies with an AI model, collecting details and the enquiry, sending them to the customer, keeping a call log and counting minutes used. |
| Types of personal data | Names, telephone numbers, email addresses, postal addresses where given, the content of the enquiry, language, and call metadata (time, length, outcome). Live audio is passed to the AI service and is not recorded or stored by us. |
| People concerned | Visitors to the customer’s website who use the assistant, and the customer’s own staff who use the account. |
What we promise to do
- We process customer data only on the customer’s documented instructions, which are these terms and the customer’s use of the service. If we think an instruction breaks data protection law we will say so.
- We make sure that everyone who can access customer data is bound to confidentiality.
- We apply appropriate technical and organisational security measures (see below).
- We use only the sub-processors listed below, under written terms that give the same level of protection.
- We help the customer answer requests from people exercising their rights, and help with security, breach notification and impact assessments, taking into account what we do and what we know.
- We tell the customer without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting customer data, with the information we have.
- When the agreement ends we delete customer data within 30 days, or return it on request, unless the law requires us to keep it.
- We give the customer the information needed to show we follow these terms, and allow reasonable audits by the customer or its auditor with notice, in working hours and subject to confidentiality.
What the customer promises to do
- Have a lawful basis for the processing and keep a privacy notice on its website that covers the assistant.
- Tell visitors that they are talking to an AI assistant, and not remove the notice we show.
- Not use the service to collect special categories of personal data, or data about children, without telling us first and having a lawful basis.
- Give us lawful instructions, and review the enquiries the assistant sends.
Sub-processors
The customer gives us a general authorisation to use the sub-processors below. We will tell customers by email at least 30 days before adding or replacing one, and a customer may object on reasonable data protection grounds before then. If we cannot resolve the objection, the customer may cancel without penalty.
| Sub-processor | What it does | Data it sees | Location and safeguards |
|---|---|---|---|
| Google (Gemini API, paid service) | AI that understands speech and text and writes the assistant’s replies. | Live audio and text of the conversation; the customer’s approved information. | May process outside the EEA. Google’s data processing terms and standard contractual clauses or the EU–US Data Privacy Framework. |
| Hostinger (web hosting) | Hosts this website and the service that starts conversations. | Connection data such as IP address; conversation records held on the service. | [hosting location, to be confirmed] |
| Backend hosting provider | Runs accounts, limits and records for the service. | Account data; enquiries and call logs. | [provider and location, to be confirmed] |
| Email delivery provider | Sends enquiry alerts and account emails to the customer. | Enquiry details. | [provider and location, to be chosen] |
| Telegram (optional) | Delivers enquiry alerts to a chat app, only if the customer turns this on. | Enquiry details. | Outside the EEA. Chosen by the customer; email is the default. |
Our payment provider (Stripe) handles payments for our own customers. It does not receive customer data from website visitors.
Transfers outside the EEA
Where a sub-processor processes customer data outside the European Economic Area, we make sure an adequacy decision or the European Commission’s standard contractual clauses, with any extra safeguards needed, apply.
Security measures
- Encrypted connections between visitors, the customer and our service.
- Secret keys for the AI service are kept on our servers only and are never sent to a browser.
- Each assistant works only on the website address the customer registers, with limits on minutes and on how fast it can be used.
- Access to customer data is limited to people who need it, and is protected by strong sign-in.
- Live audio is passed to the AI service and is not recorded or stored by us.
- Regular updates and backups of the systems we operate.
People’s requests
If someone asks us to use their rights over customer data, we will pass the request to the customer without undue delay and will not answer it ourselves unless the customer tells us to or the law requires it.
Liability and order of documents
The liability terms in our terms of service apply to these terms. If these terms and the terms of service conflict on the processing of customer data, these terms prevail. They are governed by the law of Ireland.
Contact
Questions about these terms: contact@punjabilabs.com.