Data Processing Agreement

Version 1.0 · Last updated: 18 October 2026 (2026-10-18)

Download this DPA (Markdown)

This DPA is between the Customer (the site owner or tenant using ai-me-bot, as controller) and Sinai Tech Ventures LLC, 53 Capital Mall, Behind the Courthouse, 2nd Floor, Fifth Settlement (New Cairo), Egypt (processor). It forms part of the Terms. Contact: legal@sinaitechventures.com.

1. Scope and precedence

This DPA applies where the Customer is a controller under the GDPR, UK GDPR or Egypt's Personal Data Protection Law No. 151/2020. Incorporated SCCs prevail over this DPA, which prevails over the Terms.

2. Description of processing (Annex I)

The subject is answering website visitors' questions from the Customer's knowledge base. Processing lasts while the assistant exists, plus section 11 deletion periods. It includes receiving questions, retrieving passages, generating answers, rate limiting, abuse protection, usage metering and, only when enabled, storing conversations.

Data subjects are visitors and people named in uploaded content. Data includes free-text questions and answers; opt-in stored conversations without IP address or user agent; IP addresses in short-lived rate-limit counters removed about one hour after last use; submitted content and URLs; and content-free token counts. Special-category data is not intended and must not be solicited.

3. Instructions

We process only on documented instructions in this DPA, the Terms and Customer settings, including allowed origins, conversation storage, retention and own-provider key. Where law requires other processing, we inform the Customer first unless prohibited. We immediately inform the Customer if an instruction appears to infringe data-protection law.

4. Confidentiality

Authorised persons are bound by confidentiality and access is limited to need.

5. Security (Annex II)

• TLS for service traffic through nginx.
• PostgreSQL row-level security on every tenant table.
• API keys stored only as hashes and own-provider keys encrypted with AES-256-GCM.
• Application, database and embedding services limited to loopback or an internal network.
• Nightly encrypted off-box backups in operator-controlled storage.
• Local TEI embeddings; no visitor or knowledge text is sent to a third party for embeddings.
• Conversation storage off by default with hourly expiry purge.
• Request logs contain route, status, timing and assistant identifier, not message content.

The service runs on our own server, operated by a hosting provider.

6. Sub-processors

The Customer gives general written authorisation for this list. Additions or replacements are announced at least 30 days ahead by updating this list and its Last updated date, and by email where we hold a contact address. The Customer may object on reasonable data-protection grounds and, if unresolved, stop use and delete the assistant. Each sub-processor receives obligations no less protective than this DPA, and Sinai Tech Ventures LLC remains liable.

• Own provider (BYOK): the Customer's allow-listed provider acts under its contract, is not our sub-processor, and does not use the platform key.
• Embeddings are computed on our own server with an open model; no third party receives visitor or knowledge text. Model files are downloaded once from Hugging Face without personal data.
• Only the landing page uses self-hosted Umami; the widget and API do not, so chat data is not sent to analytics.
• Our server is operated by a hosting provider; details are available on request.

7. International transfers

Sinai Tech Ventures LLC is established in Egypt. For EEA Customers, EU SCC Module 2 is incorporated: Clause 7 applies; Clause 9(a) Option 2 uses general authorisation and 30 days; Clause 11 optional language is omitted; Clauses 13, 17 Option 2 and 18 use the Customer's member-state authority, law and courts; Annexes I–III are sections 2, 5 and 6. Groq onward transfer relies on its Module 3 SCCs. Only text needed for an answer is sent over TLS. The ICO International Data Transfer Addendum applies for UK Customers; SCCs apply with FADP adaptations for Swiss Customers.

8. Data-subject requests

Tools include storage off by default, retention of 1–3650 days (default 30), knowledge-source deletion and whole-assistant deletion. Direct requests are forwarded to the Customer; we do not answer them ourselves.

9. Assistance

We provide information reasonably needed for security, DPIA and prior-consultation duties under GDPR Articles 32–36.

10. Personal data breach

We notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Customer's personal data. As known, notice covers nature, categories and approximate numbers, likely consequences, measures and contact point; it may be phased and is not an admission of fault.

11. Deletion or return

Before deletion the Customer may retrieve its data in these ways. Through the REST API: the list of its knowledge sources with their metadata (GET /v1/knowledge/sources) and any stored conversation by its ID (GET /v1/conversations/{id}). Through the MCP connection (/mcp): every source (list_sources) and the stored text of each source as chunks in reading order (get_source), both paged. The stored text is what the service keeps after processing, not the original uploaded file, of which the Customer keeps its own copy. Deleting the assistant through DELETE /v1/tenant or the admin control immediately removes its keys, sources, chunks, conversations, messages, usage records, rate-limit counters and MCP connections. Expired conversations are purged hourly and empty conversations after one day. Encrypted backups are overwritten in normal rotation within [backup retention period — operator to confirm before publishing], except data law requires us to keep.

12. Audits and information

We provide information needed to show compliance and permit audits, including inspections, by the Customer or its auditor with 30 days' notice, at most annually unless following a breach or regulator requirement, during business hours, confidentially and at the Customer's cost.

13. Customer obligations

The Customer maintains a lawful basis and visitor privacy notice, avoids special-category knowledge data and is responsible for its BYOK provider contract.

14. Liability, term, law and language

Liability follows the Terms without limiting SCC liability. This DPA lasts while processing continues. Egyptian law and Cairo courts apply except for SCC choices. Arabic governs for Customers in Egypt; otherwise English governs.

15. Changes

1.0 (2026-10-18): first version.