Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Kulltivate.ai(“Processor”) and the business client engaging Kulltivate.ai's services (“Controller”). This DPA supplements and forms part of the Service Agreement between the parties.

By using Kulltivate.ai's AI chatbot service, the Controller agrees to the terms of this DPA.

• Controller — The business client that determines the purposes and means of processing personal data (your business).
• Processor — Kulltivate.ai, which processes personal data on behalf of the Controller.
• Personal Data — Any information that identifies or can identify a natural person (a website visitor).
• Processing — Any operation on personal data including collection, storage, retrieval, and deletion.

In providing the AI chatbot service on your website, we process the following categories of data:

We do not collect payment information, government IDs, or sensitive personal data categories.

Kulltivate.ai processes visitor data solely for the purpose of providing the AI chatbot service on the Controller's website. Specifically:

• Generating real-time AI responses to visitor questions
• Maintaining conversation context within a single session
• Building long-term memory to improve response quality over time
• Detecting and preventing abuse via rate limiting
• Providing the Controller with analytics and usage reporting

We do not use visitor data for advertising, profiling, or any purpose outside the chatbot service.

We engage the following trusted sub-processors. All sub-processors are bound by data processing agreements and handle data only for the purposes described.

We will notify the Controller at least 30 days before engaging any new sub-processor.

• →
  Chat messages: 90 days from the date of conversation
• →
  Compressed conversation summaries: Duration of the service agreement, then 30 days after termination
• →
  Knowledge base entries (Q&A): Until you delete them or terminate the service
• →
  Usage analytics: 12 months rolling
• →
  Audit logs: 24 months for compliance purposes

We implement industry-standard technical and organizational measures to protect personal data:

• Encryption in transit: All data transferred using TLS 1.3
• Encryption at rest: AES-256 encryption via Supabase storage
• Access control: Principle of least privilege; strict row-level security policies
• Authentication: Magic-link authentication with session hashing
• Rate limiting: Per-tenant limits to prevent abuse
• Monitoring: Automated anomaly detection and cost circuit breakers

You have the right to instruct us to take the following actions regarding personal data we process on your behalf:

• Access & Export: Request a full export of all data we hold for your tenant at any time.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of specific conversations or your entire data set. We will complete deletion requests within 30 days.
• Portability: Receive your data in a structured, machine-readable format (JSON).

To exercise these rights, email drew@kulltivate.ai or use the export/deletion tools in your client portal.

When the Service Agreement ends (for any reason), we will:

• Generate and deliver an offboarding data export package to you
• Retain your data for 30 days after contract termination to allow you to collect your export
• Permanently delete all personal data within 30 days of the termination date
• Provide written confirmation of deletion upon request

This DPA is governed by the laws of the Commonwealth of Massachusetts, United States. Any disputes arising under this DPA will be resolved in accordance with the dispute resolution terms in the Service Agreement.

We may update this DPA from time to time to reflect changes in our services or legal requirements. We will notify you at least 30 days before any material changes take effect. Continued use of our services after the effective date constitutes acceptance of the updated DPA.