Data processing addendum

1. Roles and scope

For personal data Customer submits, or causes SlyOS to process on its behalf, Customer is the controller or business and SlyOS is the processor or service provider. Each party is an independent controller for the business-contact, account-administration, security, billing and legal-compliance data it determines to process for its own purposes. Terms such as controller, processor, personal data, processing and data subject carry the meanings given by applicable law, including the GDPR and UK GDPR and the US state privacy laws where they apply.

2. Customer instructions

SlyOS processes Customer personal data only to provide, secure, support and improve the services as described in the agreement and the public notices; on Customer’s documented instructions through product configuration, connected channels, support requests or the agreement; and as required by law, after informing Customer unless prohibited from doing so.

SlyOS will tell Customer if it reasonably believes an instruction breaks applicable data-protection law, and may suspend the affected processing while that is resolved. Customer is responsible for the lawfulness of its instructions, for the notices and permissions given to data subjects, for its authority over connected accounts, and for the accuracy and minimisation of what it supplies.

3. Confidentiality and access

Access to personal data is limited to authorised personnel and subprocessors who need it to provide the services and are bound by confidentiality obligations. Privileged access to the administrative console requires a second factor, and that requirement is enforced in code rather than by policy. Routine administrative analytics are designed to read metadata only; access to customer content is exceptional, minimised, and written to an append-only audit log.

4. Security

SlyOS maintains technical and organisational measures proportionate to the risk. They include TLS for public service traffic; managed encryption at rest, with per-user envelope encryption for channel credentials, second-factor secrets and other high-risk material; least-privilege, tenant-scoped authorisation; hashed refresh and recovery material with token rotation and replay detection; separated production and non-production environments; versioned change management with health checks and rollback; protected audit logging; documented retention, erasure and object-deletion processes; and incident, secret-rotation, supplier and AI-governance procedures.

Attachments received from third parties are scanned before their contents are parsed, and that ordering is enforced by a database constraint rather than by convention: a row that is not marked clean cannot hold extracted text. An attachment that cannot be scanned is not read.

Said plainly, because a security section that overstates itself is one somebody relies on wrongly: these are the measures as designed and implemented. SlyOS has not yet commissioned an independent penetration test, and holds no SOC 2, ISO 27001 or equivalent attestation. Where this document describes a control, it is describing the control, not an auditor’s opinion of how it has operated over time. SlyOS will not materially reduce overall protection during a paid subscription without appropriate notice.

5. Subprocessors

Customer gives general authorisation for SlyOS to engage subprocessors necessary to provide the services. SlyOS maintains a public register naming each one, what it does, what it receives and where it processes.

The sub-processor register →

That page is rendered from the register held in the SlyOS source code, so it is the register rather than a copy of it. It is maintained by hand: nothing in the code checks that every service called has an entry, and the register says so on its own face.

SlyOS imposes data-protection obligations on subprocessors appropriate to the processing and remains responsible for its own processor obligations. SlyOS gives advance notice of a new subprocessor where the agreement or applicable law requires it; Customer may object on reasonable data-protection grounds within the notice period, the parties will work in good faith towards an alternative, and if none exists either party may terminate the affected service as the agreement permits.

6. International transfers

Where personal data subject to the GDPR or UK GDPR is transferred outside an adequate jurisdiction, the parties will use an applicable transfer mechanism, such as the European Commission Standard Contractual Clauses with the UK Addendum, together with supplementary measures where required. The module, the exporter and importer roles, the competent authority, the governing law and the forum are completed on execution for the particular customer; they are not asserted here, because they depend on who the customer is.

7. Data-subject requests

Taking account of the nature of the processing, SlyOS provides reasonable assistance for Customer to answer authenticated requests for access, correction, deletion, restriction, objection and portability. Export and account deletion are available to Customer directly in the product. If SlyOS receives a request about data Customer controls, it directs the requester to Customer unless the law requires otherwise.

8. Security incidents

SlyOS notifies Customer without undue delay after confirming a personal-data breach affecting Customer personal data, with what is known about its nature, the data and people affected, the likely consequences, the mitigation, and a contact for follow-up. Information may be given in phases. SlyOS takes reasonable steps to contain, investigate, remediate and preserve evidence. Customer is responsible for its own regulatory and data-subject notifications unless the law assigns that duty to SlyOS.

9. Assistance and audits

SlyOS provides the information reasonably necessary to demonstrate compliance with its processor obligations, including current questionnaires and policies where they exist. Audits must protect other customers, must use independent qualified auditors, occur no more than annually unless the law or a confirmed incident requires otherwise, and are at Customer’s expense unless the audit identifies a material breach by SlyOS. SlyOS assists reasonably with Customer data-protection impact assessments and regulator consultations for the services.

10. Return and deletion — and what deletion does not reach

During the subscription Customer may use the export functions in the product. On termination, or on an authenticated deletion instruction, SlyOS deletes or returns Customer personal data as described in the agreement, unless the law requires it to be kept. Deletion removes the data from the live database at once and queues deletion of stored objects. Secrets encrypted per user are crypto-shredded by destroying the wrapped key.

The part that is uncomfortable and is stated anyway. SlyOS’s database provider keeps a rolling seven-day history that the database can be wound back into. SlyOS does not edit that history and does not restore selectively from it, so for seven days a deleted row is still inside it. After seven days the provider has no restorable copy left. That sentence is about the provider: stored objects, logs and what subprocessors keep are separate matters with their own terms. Security audit records may be kept where necessary for legal claims, security or fraud prevention, and are access-restricted.

Anything already sent to a model provider cannot be recalled, and messages a Customer user has already sent to a correspondent belong to that conversation and are not deleted from it.

11. Government requests

SlyOS reviews government demands for legal validity, challenges unlawful or overbroad demands where appropriate, discloses only the minimum required, records the request, and notifies Customer unless prohibited by law.

12. Precedence

Where this addendum conflicts with the agreement on a data-protection matter, this addendum controls. Liability and remedies are governed by the agreement, unless applicable law prohibits that result.

Annex A — details of the processing

Subject matter

Receipt and organisation of messages across connected channels, contextual retrieval, drafting of replies, sending that a user approves, follow-up assistance, account and security administration, and support.

Duration

The subscription term, plus the documented retention periods and the seven-day provider history described in section 10.

Nature and purpose

Collection from connected channels; storage; organisation; search and retrieval; embedding and extraction; inference through the disclosed model providers; draft generation; transmission that a user authorises; security and abuse prevention; export and deletion.

Data subjects

Customer’s users and their correspondents, contacts, employees, contractors, clients and leads, and other people whose communications Customer connects.

Categories of personal data

Names, email addresses, phone and channel identifiers, profile and account data, message and calendar content and metadata, attachments, contacts, context a user supplies, drafted and sent text, device and security metadata, and usage, billing and support data.

Special-category data

Not requested as a category. Unstructured communications may nonetheless contain sensitive data chosen by Customer or by a correspondent, which is a reason the retention and access terms above matter rather than a reason to claim they cannot.

Frequency

Continuous or on demand, according to Customer’s configuration and connected channels.

Annex B — technical and organisational measures

The measures in sections 3 and 4, together with the published privacy notice and the sub-processor register linked in section 5.

How this is entered into

This page is the current text. It takes effect between Belto Inc. and a Customer when it is incorporated by reference into a signed order or service agreement, or when Belto Inc. countersigns a copy of it. It is not made binding by being read here, and there is deliberately no signature block on this page: a contract that displays blank signature lines invites somebody to believe it is in force when it is not.

To have it executed for your organisation, or to raise a change, write to support@belto.world.