Data Processing
Agreement

Effective date: 1 July 2026 · Issued by: ScarletFlash™

1. Definitions
2. Scope and Role of the Parties
3. Details of Processing
4. Processor Obligations
5. Controller Obligations
6. Sub-processors
7. Security Measures
8. Data Subject Rights
9. International Data Transfers
10. Data Retention and Deletion
11. Personal Data Breach
12. Audits and Compliance
13. Liability
14. Term and Termination
15. Governing Law

1. Definitions

In this Agreement the following terms have the meanings set out below. Capitalised terms not defined here carry the meaning given in the Illumea Terms of Service.

• "Agreement" means this Data Processing Agreement together with any schedules or annexures attached hereto.
• "Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under this Agreement, including (where applicable) the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the Digital Personal Data Protection Act 2023 (India), and any implementing legislation in relevant jurisdictions.
• "Controller" means the Customer, being the natural or legal person who determines the purposes and means of processing of Personal Data.
• "Customer" means the entity or individual that has subscribed to the Illumea platform under the Terms of Service.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates — typically visitors to the Customer's website.
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by ScarletFlash on behalf of the Customer under this Agreement.
• "Platform" means the Illumea software-as-a-service product operated by ScarletFlash.
• "Processor" means ScarletFlash, which processes Personal Data on behalf of the Controller.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "ScarletFlash" means ScarletFlash, an independently operated technology company, the developer and operator of Illumea.
• "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• "Sub-processor" means any third party engaged by ScarletFlash to process Personal Data on its behalf in connection with the Platform.

2. Scope and Role of the Parties

The Customer acts as the Controller of Personal Data collected through their deployment of the Illumea widget and knowledge base. ScarletFlash acts as the Processor of that Personal Data, processing it solely to provide the Platform services as described in this Agreement and the Terms of Service.

Where ScarletFlash collects data for its own purposes (e.g., account management, billing, platform security), it acts as a Controller in its own right and its Privacy Policy applies.

This Agreement applies to all Personal Data processed by ScarletFlash on behalf of the Customer from the earlier of: (a) the effective date above, or (b) the date the Customer first uses the Platform.

3. Details of Processing

3.1 Nature and purpose of processing

ScarletFlash processes Personal Data on behalf of the Customer for the purpose of providing and operating the Illumea platform, which includes:

• Receiving, storing, and responding to visitor chat messages submitted through the Customer's Illumea widget
• Classifying visitor intent, sentiment, and buying signals for analytics purposes
• Storing conversation transcripts for session replay and analytics accessible to the Customer
• Generating AI-powered responses using retrieval-augmented generation against the Customer's knowledge base
• Delivering email or messaging notifications to the Customer when high-intent signals are detected
• Generating aggregated analytics reports and intelligence summaries for the Customer

3.2 Types of Personal Data processed

• Visitor chat messages and conversation content
• Approximate geolocation (derived from IP address; city/country level only)
• Session metadata: timestamps, session identifiers, device type, referring URL
• Any personal information voluntarily submitted by visitors within the chat (e.g., name, email address provided for handoff purposes)
• Customer-provided knowledge base content, which may incidentally contain personal data

3.3 Categories of Data Subjects

Visitors to the Customer's website or digital properties who interact with the Illumea widget.

3.4 Duration of processing

ScarletFlash processes Personal Data for the duration of the Customer's subscription and for such period thereafter as required by this Agreement or Applicable Data Protection Law.

4. Processor Obligations

ScarletFlash shall, in its capacity as Processor:

• Process Personal Data only on documented instructions from the Customer, including as set out in this Agreement and the Terms of Service, unless otherwise required by applicable law
• Ensure that personnel authorised to process Personal Data have committed to confidentiality or are subject to an appropriate statutory obligation of confidentiality
• Implement and maintain appropriate technical and organisational security measures as described in Section 7
• Not engage any Sub-processor without the general or specific authorisation of the Customer, and inform the Customer of any intended changes concerning the addition or replacement of Sub-processors, giving the Customer the opportunity to object
• Assist the Customer, insofar as reasonably possible and given the nature of the processing, in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law
• Assist the Customer in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments, and prior consultation
• At the choice of the Customer, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless applicable law requires retention
• Make available to the Customer all information necessary to demonstrate compliance with this Agreement and allow for audits as described in Section 12
• Promptly inform the Customer if, in ScarletFlash's opinion, any instruction infringes Applicable Data Protection Law

5. Controller Obligations

The Customer, in its capacity as Controller, represents and warrants that it shall:

• Have a lawful basis for processing Personal Data and for instructing ScarletFlash to process Personal Data on its behalf
• Provide all necessary notices to, and obtain all necessary consents from, Data Subjects as required by Applicable Data Protection Law prior to deploying the Illumea widget
• Not instruct ScarletFlash to process Personal Data in a manner that would violate Applicable Data Protection Law
• Ensure that any special categories of Personal Data (as defined under GDPR or equivalent) are not submitted through the Platform without prior written agreement with ScarletFlash
• Maintain and publish a privacy notice to visitors that accurately describes the processing of their Personal Data, including through the Illumea widget

5.1 Children's Personal Data (DPDP Act §9)

Under §9 of the Digital Personal Data Protection Act 2023, the Customer — as Data Fiduciary — is responsible for obtaining verifiable parental or guardian consent before processing personal data of children (persons under 18) or persons with disabilities. The Customer shall:

• Not deploy the Illumea widget in a context that knowingly targets children without first implementing a compliant age-verification and parental consent mechanism
• Ensure their own privacy notice covers children's data processing and satisfies all applicable requirements under DPDP Act §9
• Not use the Illumea platform to profile, direct advertising at, or monitor the behaviour of persons identified or suspected to be children
• Promptly notify ScarletFlash at arun@scarletflash.io if they become aware that the widget has collected personal data of a child without appropriate parental consent, so that the data may be deleted without undue delay

ScarletFlash does not independently verify the age of website visitors. Compliance with DPDP Act §9 in respect of the Customer's end-users is the Customer's sole responsibility as Controller and Data Fiduciary.

6. Sub-processors

The Customer grants ScarletFlash general authorisation to engage Sub-processors to process Personal Data in connection with the Platform. ScarletFlash shall ensure that Sub-processors are bound by data protection obligations no less protective than those in this Agreement.

ScarletFlash will notify the Customer of any intended addition or replacement of a Sub-processor by updating this page. Customers who have opted in to DPA notifications at arun@scarletflash.io will also receive direct notice. The Customer may object to a new Sub-processor within 14 days of notification by writing to ScarletFlash; if the parties cannot resolve the objection, either party may terminate the affected services on reasonable notice.

6.1 Current Sub-processors

The following Sub-processors are currently engaged by ScarletFlash in connection with the Illumea Platform:

7. Security Measures

ScarletFlash implements technical and organisational security measures appropriate to the risk, including:

• Isolation: Each customer's data is stored in a dedicated, namespaced partition of the database. Cross-customer data access is not possible at the application layer.
• Encryption in transit: All data transmitted between visitors, the Illumea widget, and the Platform API is encrypted using TLS 1.2 or higher.
• Encryption at rest: Integration credentials and sensitive configuration values are encrypted at rest using AES-256-GCM.
• Access control: Access to production infrastructure is restricted to authorised ScarletFlash personnel. Role-based access controls are enforced at the application layer.
• No shared model training: Customer data, conversation logs, and knowledge base content are never used to train or fine-tune any shared AI model.
• Vulnerability management: Third-party dependencies are audited for known vulnerabilities on a monthly basis using automated tooling (npm audit). Critical CVEs (CVSS 9.0+) are patched within 14 days of public disclosure; high-severity vulnerabilities (CVSS 7.0–8.9) within 30 days. All findings are tracked to resolution and documented in an internal vulnerability log. Security researchers may report vulnerabilities to arun@scarletflash.io.

ScarletFlash will review and update these measures periodically to reflect changes in technology, threats, and best practice.

8. Data Subject Rights

Where a Data Subject submits a request to exercise rights under Applicable Data Protection Law (such as access, rectification, erasure, restriction, portability, or objection), ScarletFlash will promptly notify the Customer and provide reasonable assistance so that the Customer, as Controller, can respond within the applicable legal deadline.

The Customer is responsible for responding to Data Subject rights requests. ScarletFlash will not independently respond to such requests except as required by law, and will not disclose Customer data to a Data Subject without the Customer's authorisation unless required to do so by a court or regulatory order.

Where the Customer requires ScarletFlash to delete, export, or restrict processing of specific Personal Data in response to a Data Subject request, the Customer may use the admin dashboard's data management tools or submit a request to arun@scarletflash.io.

9. International Data Transfers

ScarletFlash's primary data storage is located within the European Union (Hetzner, Germany). Certain processing activities involve Sub-processors in the United States, including LLM inference (Anthropic via Vercel) and transactional email (Resend).

For transfers of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to countries not providing an adequate level of data protection, ScarletFlash relies on the Standard Contractual Clauses (SCCs) adopted by the European Commission (or UK equivalents where applicable), as incorporated into Sub-processor agreements.

Customers who require a copy of the relevant transfer mechanisms or SCCs may request them by contacting arun@scarletflash.io.

10. Data Retention and Deletion

ScarletFlash retains visitor conversation data and platform logs for 30 days from the date of collection across all subscription tiers. Customers may configure a shorter retention period in the admin dashboard. Data whose retention period has expired is permanently deleted during ScarletFlash's daily automated maintenance window.

Upon expiry or termination of the Customer's subscription, ScarletFlash will:

• Retain Customer data for a grace period of 30 days to allow the Customer to export data
• Permanently delete all Personal Data associated with the Customer's account, including conversation logs, session data, knowledge base embeddings, and configuration, within 60 days of termination

The Customer may request immediate deletion of their data at any time via the admin dashboard's Danger Zone, or by contacting arun@scarletflash.io. ScarletFlash will confirm completion of deletion within 14 business days.

Backups containing Personal Data may persist for up to 30 days following deletion, after which they are permanently purged.

11. Personal Data Breach

In the event of a Security Incident affecting Personal Data processed under this Agreement, ScarletFlash shall:

• Notify the Customer without undue delay and no later than 72 hours of becoming aware of the incident
• Provide, to the extent known at the time: the nature of the incident, the categories and approximate number of Data Subjects affected, the categories and approximate volume of Personal Data affected, the likely consequences of the incident, and the measures taken or proposed to address it
• Cooperate with the Customer and provide such further information as is reasonably required for the Customer to comply with its own breach notification obligations under Applicable Data Protection Law

Where a Security Incident is likely to result in high risk to the rights and freedoms of Data Subjects, the Customer (as Controller and Data Fiduciary) is responsible for notifying affected Data Subjects and, where required, the relevant supervisory authority — including the Data Protection Board of India within the timelines prescribed by the DPDP Act. ScarletFlash will provide the Customer with all information in its possession necessary to fulfil these obligations, including the nature of the incident, categories of data affected, approximate number of Data Subjects impacted, and remediation steps taken or planned.

Notification of a Security Incident is not an acknowledgement of fault or liability on the part of ScarletFlash.

12. Audits and Compliance

ScarletFlash will make available to the Customer all information reasonably necessary to demonstrate compliance with this Agreement, including this DPA and any Sub-processor agreements upon request.

The Customer may request an audit of ScarletFlash's data processing activities no more than once per calendar year, with at least 30 days' written notice. Audits shall be conducted during normal business hours, shall not unreasonably disrupt ScarletFlash's operations, and shall be carried out at the Customer's cost. ScarletFlash may require the Customer (and any appointed auditor) to sign a reasonable confidentiality agreement prior to the audit.

ScarletFlash may satisfy an audit request by providing a report from an independent third-party auditor in lieu of a direct audit, where such a report covers the subject matter of the requested audit.

13. Liability

Each party's liability under this Agreement is subject to the limitations and exclusions set out in the Illumea Terms of Service. Nothing in this Agreement limits either party's liability for death or personal injury caused by its negligence, or for fraudulent misrepresentation.

Where a Data Subject suffers damage as a result of a breach of Applicable Data Protection Law, the parties shall cooperate in good faith to determine their respective liability and in any proceedings brought by or on behalf of a Data Subject.

14. Term and Termination

This Agreement remains in force for as long as ScarletFlash processes Personal Data on behalf of the Customer under the Terms of Service. It automatically terminates when the Customer's subscription ends and ScarletFlash has completed its deletion obligations under Section 10.

ScarletFlash reserves the right to amend this Agreement to reflect changes in Applicable Data Protection Law or in its processing activities. Material amendments will be notified to Customers with at least 30 days' notice. Continued use of the Platform following notification constitutes acceptance of the amended Agreement.

15. Governing Law

This Agreement is governed by and construed in accordance with the laws of India. Disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of India.

For Customers established in the European Economic Area or the United Kingdom, this Agreement is interpreted in a manner consistent with GDPR requirements, and nothing in the choice of governing law limits the application of Applicable Data Protection Law in the relevant jurisdiction.