Legal
Data Processing Agreement
This agreement governs our handling of personal data that you put into Re: Caffeinate, or that reaches us through it. It forms part of the terms of service and applies automatically — there is nothing to sign, though we will sign a copy on request.
It is written to satisfy Article 28 of the UK GDPR and the EU GDPR where that applies, so the structure follows the article rather than reading as prose.
1. Roles
You are the controller. You decide why your customers' personal data is processed and what happens to it.
We are the processor. We handle it on your behalf and on your instructions.
Where we determine our own purposes — your account details, your billing, our own marketing — we act as controller, and our privacy policy covers that instead. This agreement is only about the first situation.
2. What we process, and why
| Element | Description |
|---|---|
| Subject matter | Providing the customer service platform described in the terms of service |
| Duration | For as long as your account exists, plus the deletion periods in clause 10 |
| Nature | Collection, storage, retrieval, display, transmission, translation, and deletion |
| Purpose | Enabling you and, on the Managed plan, our staff, to receive and answer messages from your customers, manage their orders, and get answers from Store AI about your store, customers and orders |
| Categories of data subject | Your customers and anyone else who contacts you through a connected channel |
| Types of personal data | Name, email address, telephone number, postal address, the content of messages and attachments, and order information retrieved from your store platform |
Full detail is in Annex I.
3. Our instructions come from you
3.1 We process personal data only on your documented instructions, including in relation to transfers, unless the law requires otherwise — in which case we will tell you first, unless we are legally forbidden to.
3.2 Your instructions are: this agreement, the terms of service, and what you do through the product's own settings and features. Configuring an inbox, assigning an agent, deleting a conversation — those are instructions.
3.3 We will tell you if, in our opinion, an instruction breaches data protection law.
3.4 We do not use your data for our own purposes. We do not sell it, we do not use it to train artificial intelligence models, and we require the same of every sub-processor.
4. Confidentiality
Everyone we authorise to process your data — employees and contractors alike — is bound by a written confidentiality obligation that survives the end of their engagement. On the Managed plan, our staff are contractors, and that obligation binds each of them individually, not merely the company.
5. Security
We implement appropriate technical and organisational measures under Article 32 of the UK GDPR. They are set out in Annex II and are subject to improvement over time — we will not reduce them materially during your subscription.
6. Sub-processors
6.1 You give general authorisation for us to appoint sub-processors. The current list, with what each does and where it processes, is published at recaffeinate.com/subprocessors and forms Annex III.
6.2 Changes. Before a new sub-processor starts processing your data we will give at least 15 days' notice, by updating that page and notifying account holders who have asked to be told.
6.3 Objection. You may object on reasonable data protection grounds within 10 days of that notice. We will work with you to find an alternative. If we cannot, you may terminate the affected part of the service and we will refund the unused portion of the period you have paid for.
6.4 Each sub-processor is bound by written terms imposing obligations equivalent to those in this agreement, and we remain fully liable to you for what they do.
7. Helping you answer your customers
If one of your customers exercises a right — access, rectification, erasure, restriction, portability or objection — you are the one who must answer them. We will assist, taking into account the nature of the processing, by providing the tools in the product and, where those are not enough, reasonable help on request.
If such a request reaches us directly, we will not answer it ourselves. We will pass it to you promptly, because it is yours to answer.
8. Breaches, and other help
8.1 We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and further detail as it becomes available.
8.2 We will assist you, taking into account the nature of processing and the information available to us, with your obligations under Articles 32 to 36 — security, breach notification to regulators and to data subjects, and data protection impact assessments.
9. Demonstrating compliance
9.1 We will make available the information reasonably necessary to demonstrate compliance with this agreement.
9.2 You may audit us, or appoint an independent auditor to do so, no more than once a year, unless a breach or a regulator's requirement makes more frequent audits necessary. Give us 30 days' notice, keep what you learn confidential, and conduct it without unreasonable disruption. We may charge for time spent on audits beyond the annual one.
10. Deletion and return
10.1 For 30 days after your account ends you may export your data, and we will help if you need it.
10.2 After that we delete it. Contacts, conversations, messages and attachments are destroyed rather than hidden or flagged.
10.3 Copies in backups persist until those backups expire, which is within a further 30 days. We do not restore a deleted account's data from a backup except where we are legally required to.
10.4 We may retain data where the law requires it, and where we do, this agreement continues to apply to it.
11. International transfers
Your data is processed in the United States. Annex I says where each category is handled. Some processing happens elsewhere — outbound email is processed in Ireland, and our Managed staff work from the United States, the United Kingdom, Brazil and South Korea.
Where personal data is transferred out of the UK or the EEA to a country without an adequacy decision, the transfer is made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses with the UK Addendum, which are incorporated into this agreement by reference, or under another lawful mechanism where a recipient is certified under one. We carry out transfer risk assessments and will share the relevant one on request.
12. Liability and precedence
The liability provisions of the terms of service apply to this agreement. Where this agreement conflicts with the terms of service on the subject of data protection, this agreement prevails.
Annex I — Details of processing
Controller: you, the customer.
Processor: Re: Caffeinate Ltd, company number 17458812, Office 2016, 60 Tottenham Court Road, London, England, W1T 2EW.
Categories of data subject Your customers; anyone who contacts you through a connected channel; your own agents and staff whose names appear in conversations.
Categories of personal data Identity and contact data — name, email address, telephone number, postal address. Communications data — the content of messages, attachments, and the metadata around them such as timestamps and channel. Commerce data — order history, delivery status and related records retrieved from your store platform. Technical data — IP address and device information where a channel supplies it.
Special category data None. The terms of service prohibit submitting it.
Frequency Continuous, for the duration of the subscription.
Retention As set out in clause 10.
Where processing happens The platform and its database are hosted in the United States. Application services for the dashboard run in the United States. Outbound email is processed in Ireland. Message content sent for translation, and the order and customer information Store AI reads to answer your team, are processed by our translation and AI provider, which may cache them transiently in other countries for abuse detection. Managed staff access data from the United States, United Kingdom, Brazil and South Korea.
Annex II — Security measures
Access control. Access to a store's data is governed by inbox membership, verified server-side on every request rather than at login. Removing someone from an inbox removes their access immediately. No anonymous path to customer data exists.
Authentication. Staff accounts are individually credentialled and subject to password requirements. Credentials are never shared between people.
Encryption. Data is encrypted in transit using TLS on every hop, including between our own services. Stored credentials for connected platforms are encrypted at rest.
Data minimisation by design. Our store-platform integration is stateless: order and customer data is fetched for a request, rendered, and discarded. It is not copied into our database. Queries request only the fields a screen actually displays.
Logging. Application logs record endpoint names and error messages. They do not contain personal data. Every access to customer data is attributable to a named agent.
Backups. Daily and weekly encrypted backups, with the longest retention being 30 days.
Incident response. We maintain a written security incident response policy covering detection, containment, assessment, notification and review, and a log of incidents.
Segregation. Development and production environments are separate, and development does not use live customer data.
Sub-processor diligence. Each sub-processor is assessed before appointment and is bound by a data processing agreement imposing equivalent obligations.
Annex III — Sub-processors
The current list is maintained at recaffeinate.com/subprocessors and forms part of this agreement. It is kept as a separate page so that it stays accurate, and changes to it follow the notice procedure in clause 6.
Effective 26 October 2026. Questions: .