Legal · Dobi by Veyra

Data Processing Agreement

Version 1.0 · Effective 1 November 2026 · UK GDPR Article 28

In short

You (our client) stay in control of your end users' data. We process it only on your instructions.
We keep it secure, and our staff and providers must keep it confidential.
We tell you within 48 hours if we find a personal data breach affecting it, and help you deal with it.
We help you answer your end users' requests about their data.
We give you 30 days' notice of new sub-processors. You can object, and if we can't resolve it you can leave with a pro-rata refund.
Data leaving the UK is protected by the UK Addendum, the UK IDTA or the UK Extension to the EU-US Data Privacy Framework.
When you leave: 30 days to export (we'll help), deleted from live systems within 30 more days, backups gone within 35 days after that.
Dobi never reads what people type into fields on your pages.

This summary is not part of the DPA. If they differ, the full text below applies.

1. About this DPA

1.1This Data Processing Agreement ("DPA") is between Veyra Ltd ("Veyra", "we", "us") and the business customer that has accepted our Subscription Terms ("you", the "Client").

1.2It forms part of the Agreement described in the Subscription Terms. It applies whenever we process Client Personal Data while providing the Service. You accept it when you accept the Subscription Terms.

1.3This DPA is designed to meet Article 28 of the UK GDPR. Where the EU GDPR also applies to your processing, references to the UK GDPR include the equivalent parts of the EU GDPR.

2. Definitions

2.1Words defined in the Subscription Terms have the same meaning here. In addition:

Client Personal Data means personal data we process for you as your processor while providing the Service, as described in Annex 1. It includes End-User Data.
Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and, where it applies, the EU GDPR, each as amended or replaced.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data.
Sub-processor means a third party we engage to process Client Personal Data.
Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in Data Protection Law.

3. Roles

3.1You are the controller of Client Personal Data. We are your processor.

3.2We act as an independent controller, outside this DPA, only for: (a) personal data about your account users, buyers and billing contacts; (b) our own enquiries and leads; and (c) aggregated, anonymised statistics about how Dobi is used that do not identify any person or any client. Our Privacy Policy covers this data.

3.3If you connect your own API key for a supported AI or voice provider (for example OpenAI, Anthropic or ElevenLabs), that provider processes data under your own contract with it, as your processor. It is not our Sub-processor, and we pass data to it only on your instruction.

4. Your duties as controller

4.1As controller, you agree to:

have a lawful basis for the processing you instruct us to carry out;
give End Users a clear privacy notice that covers Dobi. We provide a ready-made paragraph in your Portal for this;
decide whether you need consent for Dobi's storage on End Users' devices, and get it where needed;
make sure your instructions comply with Data Protection Law;
not use Dobi to ask End Users for special category data, criminal offence data, payment card data or passwords, and not teach Dobi such data;
consider whether your Platforms are used by children and, if so, meet the extra duties that apply; and
handle requests from End Users about their rights, with our help under section 9.

5. Our duties as processor

We will:

5.1Instructions. Process Client Personal Data only on your documented instructions, including about international transfers, unless the law requires otherwise. If it does, we will tell you before processing, unless the law forbids this. Your instructions are: the Agreement; your settings and use of the Service and Portal; and any other written instructions you give us that we agree to. We will tell you straight away if we think an instruction breaks Data Protection Law.

5.2Confidentiality. Make sure that everyone we authorise to process Client Personal Data is bound by a duty of confidentiality, by contract or by law.

5.3Security. Take the technical and organisational measures required by Article 32 of the UK GDPR, including those in Annex 2. We may update these measures, as long as the overall level of protection does not fall.

5.4Sub-processors. Follow the rules in section 6 when engaging Sub-processors.

5.5Data subject rights. Help you, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights, as set out in section 9.

5.6Compliance help. Help you meet your duties under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us, as set out in sections 8 and 10.

5.7Deletion or return. At the end of the Service, delete or return Client Personal Data as set out in section 12, unless the law requires us to keep it.

5.8Information and audits. Make available the information needed to show we meet Article 28, and allow for and contribute to audits, as set out in section 11.

5.9No other use. Not sell Client Personal Data, and not use it for our own purposes, except to create the anonymised statistics in section 3.2(c).

6. Sub-processors

6.1You give us general written authorisation to use the Sub-processors listed in Annex 3 and on our Sub-processors page.

6.2We will give you at least 30 days' notice by email before we add or replace a Sub-processor. The notice will say who the Sub-processor is, what it will do, and where it will process data.

6.3You may object on reasonable data protection grounds by emailing george@veyraconsult.com within that 30-day period. We will discuss your concerns in good faith. If we cannot resolve them, you may end the Agreement by written notice before the change takes effect. If you do, we will refund the prepaid Fees for the unused part of your Subscription Year, as set out in section 9.4 of the Subscription Terms.

6.4We will put a written contract in place with each Sub-processor that gives Client Personal Data at least the same protection as this DPA.

6.5We remain fully liable to you for the performance of each Sub-processor's data protection duties.

7. International transfers

7.1We store the main Dobi database in the EU or UK. Some Sub-processors are based in, or may access data from, the United States or other countries outside the UK.

7.2We will only transfer Client Personal Data outside the UK where the transfer is lawful under Data Protection Law. We rely on one of these safeguards:

UK adequacy regulations (for example, for transfers to the EU);
the UK Extension to the EU-US Data Privacy Framework, where the US recipient is certified under it; or
the International Data Transfer Addendum to the EU Standard Contractual Clauses (the "UK Addendum"), or the UK International Data Transfer Agreement ("IDTA"), together with a transfer risk assessment.

7.3The safeguard for each Sub-processor is shown in Annex 3.

8. Personal data breaches

8.1We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach.

8.2As far as we know at the time, we will tell you: what happened; the categories and rough number of data subjects and records affected; the likely consequences; and what we have done or plan to do about it. We will provide more information as it becomes available.

8.3We will take reasonable steps to contain the breach and limit its effects, and will help you meet your duties to notify the ICO and data subjects.

8.4Telling you about a breach is not an admission of fault or liability.

9. Data subject requests

9.1If we receive a request from a data subject about Client Personal Data, we will pass it to you without undue delay. We will not respond to it ourselves, except to tell the person to contact you, unless you ask us to.

9.2We will give you reasonable help to respond to requests to access, correct, delete, restrict, move or object to the processing of Client Personal Data, including by searching for and exporting data linked to a device identifier or email address you give us.

10. Help with compliance

10.1We will give you reasonable information and help for any data protection impact assessment, or prior consultation with the ICO, that relates to your use of the Service.

10.2Our help under sections 9 and 10 is free where the Portal or a short task covers it. If you need help that takes significant time, we may charge reasonable costs, agreed with you in advance. We will not charge where the need arises from our own breach of this DPA.

11. Information and audits

11.1On request, we will give you the information reasonably needed to show that we meet this DPA, such as answers to a security questionnaire and a summary of our security measures.

11.2If that information is not enough to show compliance, or a supervisory authority requires it, or after a Personal Data Breach, you (or an independent auditor bound by confidentiality) may audit our compliance with this DPA. You agree to give us at least 30 days' written notice, carry out the audit during Business Days with minimal disruption, and pay your own costs. Unless a supervisory authority requires otherwise or there has been a Personal Data Breach, audits are limited to once in any 12 months.

11.3Audits do not give access to other clients' data, or to our Sub-processors' systems. For those, we will provide the Sub-processors' own reports or certifications where available.

12. Return and deletion

12.1For 30 days after the Agreement ends, you may export Client Personal Data through the Portal or by asking us at george@veyraconsult.com. We're happy to help you with this.

12.2After that, we will delete Client Personal Data from our live systems within a further 30 days.

12.3Copies held in backups are overwritten in the normal backup cycle, within 35 days after deletion from live systems. Until then they stay protected by this DPA and are not used.

12.4We may keep Client Personal Data longer only where the law requires it, and then only for as long as required. Invoices and contract records are our own records as controller and are kept for 6 years.

12.5During the Agreement, Client Personal Data is kept for as long as you keep your subscription, unless you ask us to delete it sooner. You may ask us at any time to delete specific data.

13. Liability

13.1Each party's liability under this DPA is subject to the limits and exclusions in section 21 of the Subscription Terms.

14. Term and precedence

14.1This DPA lasts for as long as we process Client Personal Data for you, including during the export and deletion periods in section 12.

14.2If this DPA conflicts with the Subscription Terms, this DPA applies. If it conflicts with the UK Addendum or IDTA, the UK Addendum or IDTA applies.

14.3We may update this DPA. We will always tell you first, by email, at least 30 days before a change takes effect, as set out in section 24 of the Subscription Terms. We will not reduce the protection it gives Client Personal Data unless the law requires it.

14.4This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Processing details

Subject matter	Providing Dobi, an AI in-app guide, on the Client's Platforms, and the related Portal, under the Agreement.
Duration	The term of the Agreement, plus the export and deletion periods in section 12 (30 days to export, deletion from live systems within a further 30 days, and backups overwritten within 35 days after that).
Nature of processing	Collecting, recording, storing, organising, structuring, analysing, retrieving, using, sending to AI and voice providers, displaying, exporting and deleting data. This includes: generating AI answers; running tours and highlights; recording usage events; showing insights in the Portal; storing feedback and bug reports; turning text into speech; and taking a screenshot of the Client's public homepage for a preview.
Purpose	To provide, secure, support and maintain the Service for the Client, and to show the Client insights about how End Users use Dobi on its Platforms.
Data subjects	End Users of the Client's Platforms. Any individuals whose personal data appears in content the Client teaches Dobi, or on the Client's public homepage captured for the preview.
Types of personal data	Identifiers: a random device identifier and session identifier created by Dobi and kept in the End User's browser storage. Usage events: pages viewed (page address and title), time on page, landing page and campaign tags in the page address, taps on labelled buttons and links (their label), repeated or unresponsive taps, tour progress, and Dobi settings chosen (such as reading aids, text size or voice). Conversations: questions End Users type or speak to Dobi, and Dobi's answers. These may contain any personal data an End User chooses to include. Feedback (optional): a Happy or Not happy rating, an optional comment, and an optional email address. Bug reports (optional): the End User's description, page errors, addresses of failed requests (which may contain identifiers if your Platform puts them in addresses), and browser and device type. Voice (optional): the text of answers sent for conversion to speech. Technical data: IP address and browser details that come with any web request, handled by our hosting providers. Client content: any personal data in content the Client teaches Dobi or on its public homepage. Not collected: anything End Users type into fields on the Client's pages, such as passwords, card numbers or form inputs.
Special category data	Not intended. End Users might choose to include it in free-text questions or comments. Some reading-aid settings could suggest an End User's needs; these are tied only to a random device identifier and are used only to provide the Service and insights.
Frequency	Continuous, while Dobi is active on the Client's Platforms.

Annex 2: Security measures

We take the following technical and organisational measures. We describe them plainly and do not claim certifications we do not hold.

Encryption in transit: all traffic between Dobi, the Portal, our servers and our providers uses TLS (HTTPS).
Encryption at rest: data is stored with our providers' encryption at rest.
Access control: access to systems and data is limited to people who need it to provide the Service (least privilege).
Client separation: database row-level security keeps each client's data separate, so one client cannot read another's data.
Key-locked API: Dobi's API only accepts requests that carry a valid Licence Key from the domains or apps registered to it.
Abuse protection: firewall rules and rate limits help protect the Service against misuse and overload.
Portal log-in: Portal accounts are managed by our authentication provider. Passwords are stored hashed, never in plain text.
Backups: our database provider keeps regular backups, which are overwritten on a rolling cycle of up to 35 days.
Data minimisation: Dobi never reads typed fields such as passwords, card numbers or form inputs. Usage events record button labels, not what is typed.
Sub-processor checks: we choose established providers and put data processing terms in place with each one.
Incident response: we investigate suspected incidents promptly and notify clients as set out in section 8.
Confidentiality: everyone with access to Client Personal Data is bound by confidentiality duties.

Annex 3: Sub-processors

The current list is also published on our Sub-processors page, which shows when it last changed.

Sub-processor	Purpose	Location	Transfer safeguard
Supabase	Database, Portal log-in and file storage. Holds Dobi's stored data, including usage events, conversations, feedback, bug reports, taught content and preview screenshots.	Data stored in the EU or UK. US company.	Storage in the EU or UK. Any access from outside the UK: UK Addendum to the EU SCCs.
Vercel	Hosting of the Dobi script, API and Portal. Handles web requests, including technical data such as IP address.	Edge network, with Dobi traffic served mainly from London and Dublin. US company.	UK Extension to the EU-US Data Privacy Framework where certified; otherwise UK Addendum to the EU SCCs.
Anthropic	AI model that generates Dobi's answers, and that also screens messages for abuse, summarises feedback and usage into insights for the Client, and drafts the weekly lessons Dobi learns. Receives End Users' questions, the conversation, feedback comments, and relevant page and taught content.	United States.	UK Extension to the EU-US Data Privacy Framework where certified; otherwise UK Addendum to the EU SCCs.
ElevenLabs	Text-to-speech, only when the Client turns on this voice option. Receives the text of answers to be read aloud.	United States and EU.	UK adequacy regulations for EU processing; for US processing, UK Extension to the EU-US Data Privacy Framework where certified, otherwise UK Addendum to the EU SCCs.
Resend	Sending service and account emails, such as Portal invites, renewal reminders and alerts.	United States.	UK Extension to the EU-US Data Privacy Framework where certified; otherwise UK Addendum to the EU SCCs.

Other providers

Provider	Role	Location	Transfer safeguard
Stripe	Payments and billing for the Client's subscription. Processes the Client's billing contacts and payment details, not End-User Data. We use it as controller of our own billing data.	UK, EU and United States.	UK Extension to the EU-US Data Privacy Framework where certified; otherwise UK Addendum to the EU SCCs.
The Client's own AI or voice provider (for example OpenAI, Anthropic or ElevenLabs), via the Client's own key	Only if the Client connects its own API key. The provider acts under the Client's own contract, as the Client's processor, not as our Sub-processor.	As set by the Client's contract with the provider.	The Client's responsibility.
End User's browser	Voice input uses the speech recognition built into the End User's browser. Depending on the browser, the browser maker may process audio under its own terms. We receive only the resulting text.	Depends on the browser.	Not engaged by us.