Data processing addendum

1. Definitions

Data Protection Laws means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws (including the California Consumer Privacy Act) and any other law that applies to the processing. Customer Personal Data means personal data in Customer Data (as defined in the terms) that INFIOO processes for the Customer. SCCs means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, and the UK Addendumis the UK Information Commissioner's international data transfer addendum to them. Terms like controller, processor, personal data breach and data subject have their GDPR meaning.

2. Roles

The Customer is the controller of Customer Personal Data, or a processor acting for its own controller, in which case INFIOO is its sub-processor. INFIOO is the processor, and a "service provider" or "contractor" under US state privacy laws. Annex I describes the processing.

3. Instructions

INFIOO processes Customer Personal Data only on the Customer's documented instructions. They consist of the terms, this DPA, the Customer's use and configuration of the Service — including what Fioo may do on its own, the tools and AI assistants it connects, its automations and the destinations of its API calls and webhooks — and other written instructions agreed between the parties. INFIOO tells the Customer if it believes an instruction breaks Data Protection Laws. If the law requires other processing, INFIOO tells the Customer first unless the law forbids it.

4. Confidentiality

Everyone at INFIOO authorised to process Customer Personal Data is bound to confidentiality and accesses it only as far as needed.

5. Security

INFIOO maintains the technical and organisational measures in Annex II and may change them as long as protection does not fall below that level.

6. Sub-processors

• The Customer gives general authorisation for INFIOO to engage sub-processors. The current list, with locations, is in Annex III.
• INFIOO announces an intended addition or replacement at least 30 days in advance, by email to the account owner and on the subprocessor page.
• The Customer may object on reasonable data-protection grounds within that period. If no alternative can be agreed, the Customer may end the affected part of the Service and receive a refund of fees prepaid for the time after it ends.
• INFIOO binds every sub-processor to data-protection obligations at least as protective as this DPA and remains responsible for it.
• Connected Services the Customer chooses to connect, and the AI assistants it links, are not INFIOO's sub-processors: they act under the Customer's own agreements with them.

7. Requests from data subjects

The Service lets the Customer find, export, correct and delete data. If INFIOO receives a request about Customer Personal Data, it refers the requester to the Customer and helps the Customer answer it.

8. Help with security, assessments and authorities

INFIOO helps the Customer, as far as reasonable and with the information available to it, with security, breach notifications, data protection impact assessments (including for the AI and voice features) and consultations with supervisory authorities.

9. Personal data breaches

INFIOO notifies the Customer without undue delay and, where feasible, within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, and it is completed as more becomes known.

10. Return and deletion

• The Customer can export its data at any time (Settings → Data & privacy).
• When the Customer deletes its business in the Service, processing stops at once and Customer Personal Data is erased after a 30-day grace period, within 60 days of the request.
• When the agreement ends without that, the data remains retrievable for at least 30 days and is then erased within a further 90 days.
• Unless the Customer instructs earlier deletion, INFIOO keeps the Customer's invoices on its behalf for the statutory retention period that applies to the Customer, and then erases them. Data the law requires INFIOO to keep is kept only for that purpose.
• INFIOO confirms the erasure in writing on request.

11. Information and audits

INFIOO provides the information needed to show compliance with this DPA, including answers to reasonable security questionnaires. The Customer, or an independent auditor it appoints under confidentiality, may audit INFIOO once a year with 30 days' notice, during business hours and at the Customer's cost, and additionally when a supervisory authority requires it.

12. International transfers

• INFIOO is established in the United States and processes Customer Personal Data in the locations in Annex III, mainly Germany, Singapore and the United States.
• For transfers of personal data from the EEA, the SCCs are incorporated into this DPA: Module 2 where the Customer is a controller, and Module 3 where it is a processor. The Customer is the data exporter and INFIOO the data importer.
• In the SCCs: clause 7 (docking) applies; clause 9 uses option 2 (general authorisation, 30 days' notice); the optional wording in clause 11 does not apply; under clause 13 the competent supervisory authority is the one for the Customer's establishment or, failing that, for the Customer's EU representative; and the law and courts under clauses 17 and 18 are those of Ireland. Annexes I to III of this DPA complete the SCC annexes.
• For transfers from the UK, the UK Addendum applies, with its tables completed by this DPA.
• For transfers from Switzerland, the SCCs apply with these changes: the FDPIC is the competent authority, references to the GDPR include the Swiss Federal Act on Data Protection, and data subjects in Switzerland may bring claims there.
• If an authority asks INFIOO for Customer Personal Data, INFIOO tells the Customer unless the law forbids it, challenges requests it considers unlawful, and discloses no more than required.
• Onward transfers to sub-processors are covered by their own SCCs or by the EU–U.S. Data Privacy Framework.

13. US state privacy laws

For personal information covered by US state privacy laws, INFIOO:

1. does not sell or share it;
2. retains, uses and discloses it only to provide the Service — the business purpose specified in the terms — or as those laws permit;
3. does not retain, use or disclose it outside its direct business relationship with the Customer;
4. does not combine it with personal information from other sources, except as those laws permit;
5. complies with those laws and gives the information the same level of protection they require;
6. lets the Customer take reasonable steps to ensure INFIOO uses it consistently with the Customer's obligations, including the audits in section 11;
7. tells the Customer if it can no longer meet these obligations;
8. lets the Customer, on notice, stop and remediate unauthorised use;
9. helps the Customer respond to consumer requests;
10. engages subcontractors only under a written contract with the same obligations, with notice to the Customer.

INFIOO certifies that it understands these restrictions. Where the Customer handles consumer health data under Washington's My Health My Data Act, INFIOO processes it only under this DPA and the Customer's instructions.

14. Other jurisdictions

• Québec: INFIOO keeps the information confidential, uses it only for this mandate, does not keep it after the agreement ends except as section 10 provides, tells the Customer without delay of any confidentiality incident, and lets the Customer verify these measures.
• Australia and New Zealand:INFIOO holds the information solely on the Customer's behalf, for its own safekeeping or processing, and does not use or disclose it for its own purposes.

15. AI processing

INFIOO does not use Customer Personal Data to train AI or machine-learning models. Its AI sub-processors process it under terms that bar them from training on it and limit how long they keep it (Annex III). Which data the AI features receive is described in How Fioo uses data.

16. Liability and precedence

Liability under this DPA follows the terms of service, except where Data Protection Laws do not allow it to be limited. On data protection, this DPA prevails over the terms; the SCCs prevail over both.

Annex I — Description of the processing

Parties

• Data exporter: the Customer, as identified in its INFIOO account, acting as controller (or processor).
• Data importer: ONE 28 LLC, 1401 Pennsylvania Ave., STE 105, Wilmington, DE 19806, United States; contact hello@infioo.com. EU representative: being appointed. Until then, contact us at hello@infioo.com.

Data subjects

The Customer's customers and prospective customers, people who message or call it, people who book through it, people who review it, its staff and Users, and other people its records mention.

Personal data

Contact details; messages by text, WhatsApp and email and their metadata; transcripts of what callers say; appointments, jobs and addresses where work is done; quotes, invoices, payments and expenses; payroll records; reviews; notes and tags; knowledge entries; conversations with Fioo; data received from Connected Services.

Special categories

Not intended. If the Customer stores them (for example appointment details at a clinic), it does so under section 8 of the terms; they are protected by the same measures, and access within the Workspace follows the roles the Customer assigns.

Nature, purpose and duration

Hosting and storage; organising and retrieving records; AI-assisted drafting, answering and searching; sending and receiving messages and calls, including live transcription; synchronising with Connected Services; deletion. The purpose is providing the Service under the terms. Processing is continuous for as long as the agreement lasts, and data is kept as section 10 describes.

Annex II — Technical and organisational measures

• Access control: sign-in through Google Firebase Authentication; roles inside each Workspace (owner, manager, staff, accountant); database security rules that isolate every business; credentials, agent runs and other sensitive records readable only by the server; export, deletion and disconnection limited to the owner.
• Encryption: TLS in transit; Google Cloud encryption at rest; access tokens for Connected Services encrypted with AES-256-GCM, with the key held in Google Secret Manager; API keys and access tokens for AI assistants stored only as SHA-256 hashes.
• Safeguards in the AI features:customer text is passed to models as fenced data, never as instructions; every concrete claim in a draft is checked against the Customer's own records before it can be sent without approval; approval gates for money and public posts; limits on actions per run and messages per customer; a stop switch; daily run budgets.
• Minimisation: Google Calendar reads only event times; Gmail access is send-only; AI-assistant connector requests are logged without their content; photos sent to Fioo are not stored.
• Records:audit records of changes to Fioo's permissions and of every action it executes; each inbound message processed exactly once.
• Operations: secrets kept out of source code; changes pass an automated test suite, including the database security rules, before they are merged; staff access limited to what their work requires.
• Availability:Google Cloud's managed infrastructure, with the database replicated across zones in Frankfurt.
• Incidents: breach handling and notification under section 9.

Annex III — Sub-processors

Current as of the version date above; changes follow section 6 and appear on the subprocessor page.

Changes to this document

• 6 October 2026: One set of documents for the INFIOO software, replacing the older website-services terms. Adds the data processing addendum, the Google API disclosure, How Fioo uses data, acceptable use, cookies, switching and export, and the illegal-content report route; the subprocessor list now names every provider and where it processes data.