BotNotice
Log In
How It WorksWhat’s IncludedPricingFAQBlogWhich AI Laws Apply to Me?AI Law TrackerLog In

Data Processing Agreement

Version 2026-10-26

This agreement is between J&B Partner Solutions, Inc., 6726 Lamar Ave, Overland Park, Kansas 66204, USA ("J&B"), which provides the BotNotice™ service, and the customer that accepts it ("Customer"). It forms part of the Terms of Service and applies whenever J&B processes personal data for Customer that is protected by the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection. Customer accepts it on the Privacy and data page of the BotNotice dashboard, or by signing a copy.

1. Roles

For the records BotNotice keeps about visitors to Customer's websites and callers to Customer's AI phone agents ("Customer Personal Data"), Customer is the controller and J&B is the processor. For Customer's own account details, J&B is the controller, as set out in the Privacy Policy.

2. What J&B processes, and why

  • Purpose: showing Customer's AI disclosure notice, keeping a tamper-evident record of each time it is shown, and producing the reports, lookups and copies Customer asks for.
  • People concerned: visitors to Customer's websites and chats; people who call Customer's AI phone agents; people whose consent to AI calls Customer records; Customer's staff, where a first name is given when a person takes over a chat.
  • Data: the time and page of each notice; country and region; a visitor code that changes daily, computed with a key only J&B holds from the IP address and browser, which are not stored; random conversation IDs; the chat vendor's conversation ID where the chat makes one available (stored only as a salted hash when it is an email or phone number); call IDs and whether the disclosure was spoken; for consent records, a keyed hash of the phone number with its last four digits, the consent wording and time. No chat messages, call recordings or transcripts are kept: a transcript a platform sends is read once to confirm the disclosure and discarded. J&B does not ask for special categories of data, and Customer should not send them.
  • Duration: for as long as Customer uses BotNotice, and each record for the retention period chosen on the Privacy and data page (7 years by default on plans with records), unless Customer places it under a legal hold.

3. J&B's commitments

  • Process Customer Personal Data only on Customer's documented instructions: the Terms, this agreement, and the settings Customer chooses. J&B will tell Customer if it believes an instruction breaks data protection law.
  • Make sure everyone at J&B who can access Customer Personal Data is bound by confidentiality.
  • Keep the security measures in Annex 2 in place.
  • Use only the sub-processors listed on the sub-processors page, under written terms that protect the data at least as well as this agreement. J&B will email Customer at least 30 days before adding or replacing one. Customer may object on reasonable data protection grounds; if the objection can't be resolved, Customer may end the affected service and receive a pro-rated refund of prepaid fees for it.
  • Help Customer answer requests from people exercising their rights. The dashboard lets Customer find, export and, outside legal holds, delete records; J&B will help with anything those tools don't cover.
  • Help Customer with security, breach notifications, data protection impact assessments and consultations with regulators, as far as BotNotice's processing is concerned.
  • Tell Customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting Customer Personal Data, with the information Customer needs to meet its own obligations, and follow up as more becomes known.
  • When Customer's account ends, delete Customer Personal Data within 30 days, including the off-site copies, unless law requires keeping it. Customer can export its records before then.
  • Make available the information needed to show it meets these commitments, and allow and contribute to audits by Customer or an auditor it appoints, on reasonable notice, at Customer's cost, and no more than once a year unless a regulator requires it or a breach has occurred.

4. Transfers out of Europe

J&B and its sub-processors process Customer Personal Data in the United States. Where that is a transfer of personal data protected by the GDPR, the parties agree to the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), with Customer as data exporter and J&B as data importer. They are incorporated into this agreement by reference with these choices: the optional docking clause (Clause 7) applies; Clause 9 Option 2 (general written authorisation, with the 30 days' notice above); the optional wording in Clause 11 does not apply; Clause 17 Option 1, the law of Ireland; Clause 18, the courts of Ireland. Annexes I and II of the clauses are completed by sections 2 and 3 and Annex 2 of this agreement, and Annex III by the sub-processors page. For transfers protected by the UK GDPR, the UK International Data Transfer Addendum (version B1.0) applies to those clauses; for Swiss data, the clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority and references to the GDPR read as the Swiss Act. If the clauses conflict with this agreement, the clauses prevail.

5. Everything else

Each party's liability under this agreement is subject to the limits in the Terms, except where the law or the standard contractual clauses do not allow that. If this agreement conflicts with the Terms on data protection, this agreement prevails. It lasts as long as J&B processes Customer Personal Data.

Annex 1: Details of the processing

As set out in section 2. Processing is continuous while Customer's notice is installed.

Annex 2: Security measures

  • All traffic to and from BotNotice is encrypted in transit (HTTPS).
  • Data is stored with infrastructure providers that encrypt it at rest.
  • IP addresses and browser strings are never stored; the daily visitor code is a keyed hash (HMAC-SHA256) under a secret only J&B holds. Phone numbers are kept as a keyed hash plus the last four digits. A chat vendor's conversation ID that is an email or phone number is kept only as a hash salted per site.
  • Every record is chained to the one before it with SHA-256, so a change or deletion shows when the chain is checked; the chain is checked regularly and on every evidence report.
  • Records are copied nightly to storage separate from the database, each copy with its SHA-256 recorded.
  • Records, and their off-site copies, are deleted after the chosen retention period unless under a legal hold.
  • Access to production systems is limited to J&B personnel who need it to run the service.

Annex 3: Sub-processors

Current list, also on the sub-processors page:

  • Vercel Inc. (United States): Runs the BotNotice service and serves the notice script; stores the nightly off-site copies of records (Vercel Blob).
  • Databricks, Inc. (Neon serverless Postgres) (United States): The database that holds records and account data.
  • Stripe, Inc. (United States): Billing and payments.
  • Plus Five Five, Inc. (Resend) (United States): Sends sign-in links, receipts and alerts by email.

To sign a copy instead of accepting in the dashboard, or with questions, email support@botnotice.app.

Data Processing Agreement · BotNotice