Hibira Live Chat Data Processing Agreement

Draft, not yet reviewed by a lawyer. The English version prevails over translations. Effective date: set at the public launch.

This DPA forms part of the Hibira Live Chat Terms of Service between the customer ("Controller") and Hibira, the trade name of an individual business operator (sole trader) based in Taiwan ("Processor"; the operator's name is given without delay on request). It applies when the Processor processes personal data in Customer Data on the Controller's behalf. Where it conflicts with the Terms, this DPA prevails.

1. Scope of processing

2. Processor obligations

The Processor will:

1. process the data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration of the Service, and tell the Controller if it believes an instruction breaks the law;
2. keep conversations secret as section 3 of the Terms describes, and make sure the operator and any contractors with access are bound by confidentiality;
3. not use Customer Data to train AI models for anyone other than the Controller, and not sell it;
4. apply the security measures in Annex A;
5. help the Controller, as far as reasonably possible, respond to data subject requests (the portal lets admins find, export and delete a visitor's conversations) and carry out impact assessments and prior consultations;
6. make available the information needed to show compliance, and allow audits as set out in section 7.

3. Controller obligations

The Controller is responsible for having a lawful basis, telling its visitors that the chat is provided by the Processor on its behalf and whether AI replies are used, the accuracy and lawfulness of the data it collects, and keeping its visitor identity secret and single sign-on keys confidential.

4. Sub-processors

1. The Controller authorises the sub-processors in Annex B.
2. The Processor will give at least 30 days' notice of a new sub-processor by email and on chat.hibira.io. The Controller may object on reasonable data protection grounds; if the parties cannot resolve it, the Controller may terminate the affected Service and receive a pro-rata refund.
3. The Processor binds each sub-processor to data protection terms no less protective than this DPA and remains liable for its performance.

5. International transfers

The Processor is based in Taiwan and processes data in Hong Kong (AWS ap-east-1) and Singapore (Neon, on AWS ap-southeast-1), and, only for Controllers who turn on AI replies or knowledge base search, in Japan (Amazon Bedrock, AWS Tokyo ap-northeast-1, and Osaka ap-northeast-3 when Tokyo is busy). Cloudflare's network may route connections through the nearest edge location. Where a transfer needs a safeguard, the parties agree to the EU Standard Contractual Clauses (Module 2 or 3 as applicable), the UK Addendum, or the equivalent contract required by the law of the Controller's country (for example Korea's PIPA standard contract or China's PIPL standard contract), which are incorporated by reference.

6. Personal data breaches

The Processor will notify the Controller without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller's data. The notice will describe the nature of the breach, the data and subjects affected where known, likely consequences, and measures taken.

7. Audits

The Processor will answer reasonable security questionnaires and share third-party audit reports or certifications when available. If those are not enough to show compliance, the Controller may carry out an audit once a year, at its own cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

8. Return and deletion

While the workspace is open the Controller can export its conversations from the portal. If the Processor ends the workspace, the Controller can export for 30 days; a workspace the Controller deletes itself is deleted at once. The Processor then deletes remaining Controller data, including archives, and backups within 35 days, unless the law requires it to keep some.

9. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the applicable data protection law does not allow it.

Annex A: Security measures

• TLS 1.2 or later for all widget, inbox, API and webhook traffic; signed visitor identity (HMAC or JWT) and single sign-on tokens with short expiry and replay protection.
• Sign-in tokens and sessions stored only as SHA-256 hashes; secrets never written to logs.
• Each workspace's data kept apart from other workspaces' in every query; agents see only their own workspace.
• Data stores and archives encrypted at rest, reached only on private networks or over authenticated TLS; least-privilege access for the operator and contractors with multi-factor authentication.
• Rate limits, bot checks (Turnstile) and DDoS protection at the edge.
• Encrypted backups, monitoring and alerting, and an incident response procedure.
• Dependency updates and vulnerability fixes on a regular schedule.

Annex B: Sub-processors

Creem (our reseller and merchant of record) and Google Workspace (email) process only the Processor's own customer data, not Customer Data, so they are listed in the Live Chat Privacy Policy rather than here.