Data Processing Agreement
Version 1.0 · Last updated: March 2026
1. Introduction and Applicability
This DPA applies where AXD Intelligence (“Famara”) processes personal data on behalf of a Customer in connection with the provision of the Famara widget platform (the “Service”). It is entered into between:
- Data Processor: AXD Intelligence (ABN 36 242 601 526), operated by Diego Pablo Nanini, Perth, Western Australia, Australia
- Data Controller: The Customer, as identified in their Famara account registration
This DPA supplements the Terms of Service and prevails over any conflicting terms in the Terms of Service solely with respect to the processing of personal data subject to GDPR or UK GDPR. Where the Customer is not subject to GDPR or UK GDPR, the Privacy Policy and Terms of Service govern all data processing.
This DPA is effective from the date the Customer first accepts the Terms of Service or first uses the Service, whichever is earlier.
2. Definitions
In this DPA, the following terms have the meanings given below:
Controller
The entity that determines the purposes and means of processing personal data. In this context, the Customer is the controller of end-user personal data collected via the widget on the Customer's website.
Processor
An entity that processes personal data on behalf of the controller. AXD Intelligence acts as processor when it processes end-user data to provide the Service to the Customer.
Personal Data
Any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR. In the context of this DPA, this primarily means conversation messages, session IDs, IP addresses, browser user-agent strings, and any identity fields passed via Famara.identify().
Processing
Any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
Sub-processor
A third party engaged by AXD Intelligence to process personal data on behalf of the Customer in connection with the Service.
Standard Contractual Clauses (SCCs)
The standard contractual clauses for the transfer of personal data to third countries as approved by the European Commission under GDPR (2021 edition), or equivalent clauses approved under UK GDPR (UK IDTA).
Data Subject
An identified or identifiable natural person whose personal data is processed. In this context, an end user who interacts with the Famara widget embedded on the Customer's website.
Personal Data Breach
A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
3. Processor and Controller Roles
Famara as data processor: When providing the Service, AXD Intelligence acts as a data processor. We process personal data only on documented instructions from the Customer (as expressed through the widget configuration, API calls, and the Terms of Service and this DPA), unless otherwise required by applicable law. Where required by law to process data beyond the Customer’s instructions, we will inform the Customer of that legal requirement before processing, unless prohibited by law from doing so.
Customer as data controller: The Customer determines the purposes for which personal data is collected via the widget (e.g., providing customer support, answering product questions). The Customer is responsible for ensuring a valid lawful basis exists under GDPR for the collection and processing of end-user personal data, and for providing adequate privacy notices to end users.
Confidentiality of staff: We ensure that all personnel authorised to process personal data under this DPA are subject to binding confidentiality obligations (whether contractual or statutory) and receive appropriate data protection training commensurate with their role.
Assistance with data subject rights: We will promptly notify the Customer if we receive a request from a data subject exercising their rights under GDPR (access, erasure, restriction, portability, objection). We will not respond to such requests directly unless instructed to by the Customer or required by law. We will provide reasonable technical assistance to enable the Customer to fulfil such requests.
4. Details of Processing
| Subject matter | Operation of the Famara embeddable AI chat widget on the Customer's website |
| Duration | For the term of the agreement and thereafter until data is deleted in accordance with Section 9 of this DPA |
| Nature of processing | Collection, storage, transmission to AI sub-processors, retrieval, display, and permanent deletion of personal data |
| Purpose of processing | Generating AI responses to end-user queries on the Customer's website; providing the Customer with conversation analytics; enforcing plan message limits |
| Categories of personal data | Conversation message content; session identifiers; IP addresses; browser user-agent strings; optional identity fields (name, email address, custom fields) if passed via Famara.identify() by the Customer |
| Categories of data subjects | End users (natural persons) who interact with the Famara widget embedded on the Customer's website |
| Default retention period | 90 days (configurable by the Customer) |
5. Technical and Organisational Security Measures
We implement and maintain appropriate technical and organisational measures (TOMs) to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, at minimum:
Encryption at rest
All database data stored in Supabase (Sydney, ap-southeast-2 region) is encrypted using AES-256 managed encryption.
Encryption in transit
All data transmitted between clients, the Famara API, and sub-processors is protected by TLS 1.2 or higher. Unencrypted HTTP connections are rejected.
Access control
Access to personal data is restricted on a need-to-know basis using role-based access control. Production database credentials are segregated from development environments.
Authentication
Dashboard access requires authenticated sessions with secure, rotating session tokens. API access requires a scoped, hashed API key. Brute-force protection is applied to all authentication endpoints.
Automated backups
Supabase performs daily automated encrypted backups stored in the same Australian region, retained for 30 days.
Incident response — 72-hour notification
We maintain an incident response procedure. In the event of a personal data breach likely to result in risk to data subjects, we will notify the Customer without undue delay and within 72 hours of becoming aware, including details required by GDPR Article 33(3).
Pseudonymisation
Session IDs assigned to widget interactions are randomly generated UUIDs. They are not linked to a real-world identity unless the Customer explicitly calls Famara.identify().
Vulnerability management
Production dependencies are monitored for known vulnerabilities (CVEs). Critical and high-severity patches are applied within a reasonable timeframe. Security issues can be reported to privacy@famara.ai.
We review and update these measures as technology evolves and as required to maintain an appropriate level of security. We will inform the Customer of any changes that materially reduce the level of protection offered.
6. Sub-Processors
By entering into these terms, the Customer provides general written authorisation for us to engage the sub-processors listed below. We will notify the Customer at least 30 days before engaging any new sub-processor or replacing an existing one, giving the Customer the opportunity to object on reasonable, documented grounds. If the Customer objects and we cannot accommodate that objection, the Customer may terminate the Service without penalty by providing written notice within 14 days of our response.
| Sub-Processor | Location | Transfer basis | Purpose |
|---|---|---|---|
| Supabase, Inc. | Australia (Sydney, ap-southeast-2) | No cross-border transfer | Database, authentication, and storage of conversation and account data |
| Groq, Inc. | United States | SCCs (Processor → Sub-Processor) | AI inference — conversation messages forwarded to generate LLM responses |
| Google LLC | United States | SCCs (Processor → Sub-Processor) | AI inference — conversation messages forwarded to Gemini models |
| Vercel, Inc. | United States | SCCs (Processor → Sub-Processor) | Application hosting, edge compute, CDN for dashboard and widget delivery |
| Cloudflare, Inc. | United States | SCCs (Processor → Sub-Processor) | DDoS protection, DNS, edge caching; may process IP addresses in transit |
| Stripe, Inc. | United States | SCCs (Processor → Sub-Processor) | Payment processing and billing; processes operator payment and identity data |
We impose data protection obligations on all sub-processors that are substantially equivalent to those set out in this DPA, by written contract. We remain liable to the Customer for the performance of sub-processors to the same extent as if we were performing the processing directly.
7. International Data Transfers
Personal data of EEA or UK data subjects may be transferred to sub-processors located outside the EEA or UK as detailed in Section 6.
Transfers to Australia (primary storage): Personal data is stored primarily in Supabase’s Sydney (ap-southeast-2) region, which is located in Australia. Australia is recognised as providing an adequate level of data protection by the European Commission. No additional transfer safeguard is required for this transfer under GDPR.
Transfers to the United States: For transfers of personal data to Groq, Google, Vercel, Cloudflare, and Stripe, we rely on Standard Contractual Clauses (EU SCCs, 2021 edition, Module 3: Processor to Sub-Processor) executed between us and each sub-processor. For UK-originating transfers, we additionally rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.
We have conducted transfer impact assessments (TIAs) for each US-based sub-processor and have implemented supplementary technical measures (encryption in transit and at rest) where required. Copies of applicable SCCs or TIA summaries are available upon written request to privacy@famara.ai.
8. Audit Rights
We will provide the Customer with all information reasonably necessary to demonstrate compliance with the obligations set out in GDPR Article 28 and this DPA.
Upon the Customer’s written request, no more than once per 12-month period unless a confirmed personal data breach has occurred, we will:
- Provide documentation, certifications, or evidence demonstrating compliance with this DPA and our security obligations.
- Allow the Customer, or a mutually agreed independent third-party auditor, to conduct an audit of our data processing facilities and practices relevant to the Service, subject to: at least 30 days’ prior written notice; agreement on scope, timing, and duration; execution of a mutual confidentiality agreement; and compliance with our reasonable operational and security requirements.
The Customer bears all costs associated with any audit, including our reasonable costs in supporting the audit. Audits must be conducted during normal business hours and must not unreasonably disrupt our operations.
9. Data Return and Deletion on Termination
Upon termination or expiry of the Terms of Service for any reason, we will, within 30 days of receiving the Customer’s written instruction or of account closure, at the Customer’s election:
- Return: Provide a complete export of all personal data we hold on behalf of the Customer (in JSON or CSV format), and then permanently delete all copies from our systems.
- Delete: Permanently delete all personal data from our live systems and from backups within the applicable backup rotation cycle (maximum 30 additional days), without providing a prior export.
We will provide the Customer with written confirmation of deletion upon request. We may retain personal data beyond this period only to the extent required by applicable Australian law (e.g., tax records), in which case we will inform the Customer of the specific legal basis and the categories of data retained.
To request a data export or confirm deletion, contact privacy@famara.ai with the subject line “Famara Data Deletion/Export Request” within 30 days of account termination. After that window, data will be deleted according to our standard retention schedule.
10. Download and Countersigned DPA
A PDF version of this DPA is available for download. The PDF is identical in legal content to this web page and constitutes the same agreement.
If your organisation requires a countersigned hard-copy or PDF of this DPA (e.g., for GDPR Article 28 compliance records), email privacy@famara.ai with the subject line “Famara DPA — Countersigned Copy Request” and include your organisation name, ABN/registration number, and contact details. We will respond within 5 Australian business days.