Data processing agreement

Last updated: 17 October 2026

This agreement governs how Semaji, United Arab Emirates ("Semaji", "we") handles personal data on behalf of a business using Semaji ("you"). It forms part of our terms of service and applies automatically — you do not need to sign anything or ask us for a copy. Where it conflicts with the rest of the terms, this agreement wins on anything about personal data.

It is written to meet Article 28 of the UK and EU GDPR, the service provider requirements of the California Consumer Privacy Act as amended, and the equivalent requirements of Canadian, Swiss and other applicable privacy law. If your own law or your customers' law requires something more, write to support@semaji.com.

1. Who is who

You are the controller (in California, the business) of your customers' personal data. You decide what to collect, what your assistants say, and who you message. We are the processor (in California, the service provider). We act only on your instructions.

Your use of Semaji — the settings you choose, the channels you connect, the assistants you turn on, the broadcasts you send — is your instruction to us. You may give us further written instructions at support@semaji.com; we may charge for anything outside the normal running of the service. If we think an instruction breaks data protection law, we will tell you and may pause that processing until it is resolved.

Separately, we are the controller of our own account and billing data — who signed up, what plan they are on, how much of the service they used. Our privacy policy covers that, and this agreement does not.

2. What we process for you

3. Our undertakings

We will:

• Process only on your instructions, and only for the purposes in section 2 — never for our own purposes, and never for anyone else's.
• Not sell or share your customers' personal data, as "sell" and "share" are defined in the CCPA, and not use it for cross-context behavioural advertising.
• Not use it to train AI models, ours or anyone else's, and not let our AI providers train on it. This is a contractual commitment, not a preference.
• Not combine it with personal data we receive from anyone else, or from another business using Semaji, except as the CCPA permits a service provider to do.
• Not retain, use or disclose it outside the direct business relationship between us, or for any commercial purpose other than providing the service.
• Keep it confidential, and make sure every person we let near it is under a duty of confidence and trained for it. We keep access to the minimum number of people needed to run and support the service.
• Secure it as section 5 describes.
• Help you answer your customers' requests, as section 8 describes, and meet your own obligations on security, breach notification, impact assessments and consultation with regulators.
• Tell you promptly if we determine we can no longer meet these obligations.
• Give you what you need to show you are complying, as section 9 describes.
• Delete or return it when we are done, as section 10 describes.

We certify that we understand these restrictions and will comply with them. They flow down, in writing, to every sub-processor in section 7.

4. We are your tool, not a party to your conversations

This matters legally, so it is worth stating on its own. When a customer talks to your business through Semaji, we are not a participant in that conversation and we take nothing from it for ourselves. We process the conversation only to deliver it, to answer it on your behalf with your assistant, and to show it to you. We do not read it for our own ends, do not profile anyone, do not build any audience or model from it, do not pass it to any advertiser or data broker, and do not use it to benefit any other business on Semaji. We hold it as your extension, in the same way your own server would.

5. Security

The measures we take, as Article 32 requires. We will not reduce them during the term.

• Separation between businesses. Every row of your data carries your workspace, and the database refuses a read from outside it. One business cannot reach another's data, which is the core of how the service is built.
• Encryption in transit. HTTPS and TLS everywhere, with HSTS.
• Encryption at rest. Storage is encrypted by our hosting provider. On top of that, the credentials we hold for you — channel access tokens, mailbox app passwords — are encrypted by us before they are stored, with a key held outside the database, and are never shown back in full.
• Passwords. Held only as a salted hash by our authentication provider. We never see them.
• Access control. Administrative access to production is limited to those who need it, over multi-factor authentication, and is logged. Service credentials are kept in the hosting platform's secret store, not in our code.
• Webhook authenticity. Incoming webhooks from the platforms you connect are verified by signature, with constant-time comparison.
• Resilience. Point-in-time backups, taken and tested by our database provider, so your data can be recovered after an incident.
• Minimisation. We collect what the service needs and no more. We do not ask for payment card details at all — Paddle handles those and we never see a card number.

We are candid about what we do not have: Semaji does not hold a SOC 2 report or ISO 27001 certification, and we do not claim either. If you need one before you can use us, tell us and we will say honestly where we are.

6. International transfers

We are established outside the EEA, the UK and Switzerland, and our sub-processors operate in several countries, including the United States and the European Union. Where your instructions involve a transfer of personal data out of the EEA, the UK or Switzerland, that transfer is made under the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), which are incorporated into this agreement by reference:

• Module Two (controller to processor) applies between you and us, with you as data exporter and us as data importer.
• Module Three (processor to processor) applies where you are yourself a processor for someone else.
• For the UK, the ICO's International Data Transfer Addendum applies to those clauses. For Switzerland, references to the GDPR are read as references to the Swiss FADP and to the Federal Data Protection and Information Commissioner.
• The optional docking clause applies. For clause 17, the governing law is the law of Ireland; for clause 18, the forum is the courts of Ireland. The annexes are filled in by sections 2, 5 and 7 of this agreement, and the frequency of transfer is continuous.

We have no reason to believe any law applicable to us prevents us meeting those clauses. If we receive a request from a public authority for your data, we will tell you unless we are legally forbidden, challenge it where there are grounds, and disclose only the minimum required.

7. Sub-processors

You give us general authorisation to use the sub-processors below. Each is bound in writing to obligations no less protective than these.

The messaging platforms you choose to connect — Meta, TikTok, Telegram, Discord, Google, Microsoft, Zoho, Shopify and the rest — are not our sub-processors. You connect them yourself, under your own agreement with each of them, and each is an independent controller of what it holds.

We will give you at least 30 days' notice by email before a new sub-processor starts handling your customers' data. If you reasonably object on data protection grounds within that time, write to us and we will try to find a way round it; if we cannot, you may end the affected part of the service and we will refund any unused prepaid fees for it.

8. Your customers' requests

The dashboard is built so you can answer most requests yourself: you can read, export and delete conversations, contacts, leads, appointments and transcripts whenever you like. If a customer asks us directly, we will not answer for you — we will tell them to ask you, and tell you they asked. Where you need more than the dashboard gives you, we will help, free of charge, within the time your law allows you. See also data deletion.

9. Audits and information

On request, we will give you the information you reasonably need to show you are complying with Article 28 — what we hold, where, under what measures, and our answers to your security questionnaire. Once in any twelve months, or after a breach affecting you, you may audit our processing: we will cooperate with a remote review of documentation, and with an on-site inspection by you or an auditor we both find acceptable, at your cost, on reasonable notice, during working hours, and in a way that does not compromise another business's confidentiality.

10. Breaches

If there is a personal data breach affecting your data, we will tell you without undue delay, and in any event within 48 hours of becoming aware of it — not after an investigation is finished. We will tell you what happened, what data and roughly how many people are affected, the likely consequences, what we are doing about it, and a contact who can answer you. We will keep you updated as we learn more, and help you with any notification you owe to a regulator or to the people affected. You decide what your customers are told; we will not notify them without your agreement unless the law makes us.

11. When we are done

You can delete your data yourself at any time. When your workspace closes, we delete your data within 30 days, including from our active systems and our sub-processors, except where the law requires us to keep something — billing records, mainly. Deleted data persists in point-in-time backups for a short window before it ages out. If you ask in writing before the 30 days are up, we will return it to you in a machine-readable export instead of deleting it straight away.

12. Liability

The limits in our terms of service apply to this agreement too, and to the standard contractual clauses so far as the law allows. Nothing here limits a data subject's rights against either of us under Article 82, or either party's liability to a regulator.

13. Contact

Privacy and data protection: support@semaji.com, marked for the attention of the privacy lead. Semaji, United Arab Emirates.