Data processing agreement

Version 27.10.2026. This agreement is part of the Vestly.ai terms of service. The Estonian version prevails.

1. Parties

Controller: the business using the Vestly.ai service (the customer).
Processor: RITOLD OÜ (registry code 16402166, Betooni tn 15a-1, Lagedi alevik, Rae vald, 75303 Harju maakond, hello@rixio.ee), "Vestly".

2. Subject matter, duration and purpose

Vestly provides the customer with an AI chat service: it answers questions on the customer's website and in channels the customer connects (such as WhatsApp, Messenger, Instagram) from the customer's content, collects enquiries and bookings, passes conversations to the customer's team and shows statistics. Personal data is processed only to provide this service, while the agreement is in force and until deletion under section 8.

3. Data subjects and data

Visitors to the customer's website and the customer's clients: chat messages, the page the chat started on, language, a salted hash of the IP address (the address itself is not stored); when the person gives them, name, email, phone, the reason for contact, extra fields the customer defines and consent, booking time; for an order status lookup the order number and email; when the customer allows photos, the photo the person sends; in messaging channels the channel user id and name.
The customer's staff: name, email, role, activity log.

The service is not meant for special categories of personal data (such as health data). The customer sets up the chat so that it does not ask for them; clinics find guidance on the security page.

4. Vestly's obligations

Vestly processes personal data only on the customer's documented instructions: this agreement, the terms of service and the customer's choices in the dashboard (what the chat asks, which integrations are on, how long data is kept). If Vestly believes an instruction infringes data protection law, it tells the customer without delay.
Only people who need access to provide the service have it, and they are bound by confidentiality.
Vestly applies the security measures in annex 1 and keeps them up to date.
Vestly helps the customer answer data subject requests: data can be viewed, exported and deleted in the dashboard and through the API; the WordPress plugin adds Vestly's data to WordPress's personal data export and erase tools.
Vestly helps the customer meet its obligations under GDPR articles 32–36, taking into account the nature of processing and the information available to Vestly.
Vestly notifies the customer of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with what is known about its nature, the data affected and the measures taken.
Vestly does not use the customer's data to train its own AI models and does not sell it.

5. Subprocessors

The customer gives general authorisation for the subprocessors in the list of subprocessors. Vestly emails the account owner at least 30 days before adding a new subprocessor. If the customer reasonably objects, it may end the agreement before the change takes effect and is refunded for the prepaid unused period. Vestly's contracts with subprocessors bind them to at least the same level of data protection.

Integrations the customer turns on itself (such as Meta, Shopify, Google Calendar, Cal.com, Calendly, HubSpot, Pipedrive, Klaviyo, Mailchimp, Notion, Slack, Telegram) are the customer's instruction to send data to that service; their processing is governed by the customer's own agreement with them.

6. Transfers outside the European Economic Area

Data is stored in the European Union. To write an answer, the question and the relevant content go to an AI provider whose processing may take place in the United States. Such transfers rely on the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework.

7. Audits

Vestly makes available all information needed to demonstrate compliance with this agreement and answers written security questionnaires. The customer may carry out an on-site audit once a year, with 30 days' notice, at its own cost and without breaching Vestly's confidentiality.

8. End of the agreement and deletion

When the customer deletes its account or the agreement ends, Vestly deletes the customer's personal data within 30 days unless the law requires keeping it. The customer can export the data from the dashboard before that. Data leaves the encrypted backups as they rotate: daily backups within 35 days, monthly ones within 13 months. While the service runs, conversations are deleted after 90 days, photos after 30 days and enquiries after 24 months, unless the customer set a shorter time.

9. Other terms

Liability is limited as in the terms of service. Estonian law applies. Where this agreement and the terms of service conflict on the processing of personal data, this agreement prevails.

Annex 1. Security measures

Location: servers and database in Hetzner's data centre in Helsinki (Finland); backups in Backblaze's EU data centre in Amsterdam.
Encryption: all traffic over HTTPS (TLS); passwords hashed; integration keys and access tokens encrypted (AES-256); only a salted hash of the IP address is kept.
Backups: the database every night, encrypted (age, X25519), to a data centre in another country; restoring has been tested.
Access: roles in the dashboard (owner, admin, agent, viewer), two-step sign-in with an authenticator app, and on Enterprise sign-in only with the company's Google Workspace accounts. The server accepts SSH keys only, password and root logins are off, and the firewall opens only the ports needed.
Logs: an activity log (settings changes, chat takeovers, exports, API tokens); any access by Vestly staff to a customer account is logged.
Reliability: external availability checks every 5 minutes, a health check and alerts; a second AI provider answers when the first does not.
Development: every update passes automated tests before it is released.

How to sign: the account owner accepts the agreement in the dashboard (Account → Security & privacy) and downloads the signed PDF there.