Data Processing Agreement

For data you bring to the platform — your brand profile, uploaded documents, messages exchanged with your AI staff, content published to your channels, and analytics data you authorise us to read — you are the organisation that determines the purposes (controller / "organisation" under Singapore's PDPA) and CANLAH AI is the data intermediary / processor acting on your instructions.

For your account details (name, email, sign-in method, signed-in devices) and for leads you submit on canlah.ai, CANLAH AI acts as controller. That processing is described in the Privacy Policy, not this DPA.

We process your data only to deliver the Services described in the Terms of Service and your service agreement, namely:

• •Provisioning and running AI staff (a dedicated container per staff member) that plan, draft, review and publish marketing content for your brand.
• •Building and maintaining your brand profile (facts, tone, positioning, intent ledger, schedules and plan cards) from documents and instructions you provide.
• •Relaying conversations between you and your AI staff in the console, and between your AI staff and the messaging channels you connect.
• •Publishing to social accounts you have authorised, subject to your approval mode setting.
• •Reading analytics and search data you have authorised (Google Analytics 4, Google Search Console, Bing Webmaster, Cloudflare zone analytics) to produce performance reports for you.
• •Auditing websites you ask us to audit and delivering the resulting reports.

Depending on which features you use, the following data may be processed:

• •Your staff and administrators: name, work email, sign-in provider, passkeys, session and device records, approval decisions.
• •Your brand: profile, positioning, documents and images you upload, published articles synced from your website, intent ledgers, plans, generated drafts and reports.
• •People who message your AI staff through channels you connect (Telegram, WhatsApp, WeChat and similar): their handle and the content of the conversation, as forwarded by that channel.
• •Your social accounts: platform, handle, display name and the publishing permission you granted. Platform access tokens are held by our publishing broker (see sub-processors) and are never written to our own logs or deliverables.
• •Your website visitors, in aggregate only: report data from analytics properties you authorise. We do not attempt to re-identify individuals.
• •Model prompts and outputs: the text, documents and images your AI staff send to AI model providers to do their work.

CANLAH AI will:

• •Process your data only on your documented instructions — your configuration in the console, your approvals, and your service agreement — unless required by law, in which case we inform you before processing where legally permitted.
• •Ensure that staff who access your data are bound by confidentiality obligations.
• •Use your data only for your account. Your brand data is never used to train or tune models for other customers.
• •Assist you, within reason, in responding to requests from individuals (access, correction, deletion) and in meeting your own PDPA / GDPR obligations.
• •Delete or return your data at the end of the Services as described in Section 7.
• •Make available the information necessary to demonstrate compliance with this DPA and allow audits as described in Section 10.

We use the following third parties to run the Services. Each acts under its own terms and data processing agreement with us. We will notify registered account holders by email at least 30 days before adding a new sub-processor that will process your data; you may object in writing within that period, in which case we will discuss alternatives or you may terminate the affected Service.

The Services run in a small number of clearly separated places:

Retention periods per data category, what happens when an AI staff member is deleted, and what backups exist are set out on the Data Retention page, which forms part of this DPA.

On termination of the Services, we retain your data for 30 days to allow export, after which it is permanently deleted from live systems (Terms of Service, Section 9). You may request earlier deletion by emailing privacy@canlah.ai. Deletion from Cloudflare's point-in-time recovery follows Cloudflare's own window (see Data Retention).

Today you can download your brand documents and delivered reports from the console, and receive intent ledgers, schedules and quotations as spreadsheets delivered by CANLAH AI. A complete export of all data held for your account (chat history, brand profile, plans, staff configuration) is available on request to privacy@canlah.ai; we aim to deliver it within 30 days. A self-service full export from the console is planned [To be confirmed].

Measures currently in place, as implemented in the platform code and deployment:

• •Transport encryption (TLS) for all traffic to canlah.ai, the console, the AI staff gateway and every sub-processor API.
• •Encryption at rest provided by Cloudflare (D1, R2) and Google Cloud (persistent disks, Cloud Storage). Third-party tokens held in our databases (staff app tokens, GA4 refresh tokens) are additionally encrypted at the application layer with AES-GCM before being written.
• •Tenant isolation: each AI staff member runs in its own container with its own persistent volume, secrets and per-bot API keys; those keys are revoked when the staff member is deleted.
• •Access control: the console databases have no public endpoint; every request is checked against your account's ownership of the bot or brand before any data is read or written.
• •Authentication: Google Sign-In or email + password, passkeys (WebAuthn), device/session list with remote sign-out, sessions expire after 30 days of inactivity.
• •Publishing safeguards: AI staff can only publish to accounts you have connected, and only after your approval when approval mode is on; published URLs are verified before they are recorded.
• •Abuse controls: per-IP rate limits on public forms and audit endpoints; security headers (HSTS, nosniff, frame denial) on every response.
• •Secrets management: service credentials are stored as Cloudflare Worker secrets and Kubernetes Secrets, never in source control.
• •Regular independent penetration testing and SOC 2 attestation: [To be confirmed].

On written request, not more than once per year unless required by a supervisory authority or following a security incident, we will provide the information reasonably needed to demonstrate compliance with this DPA, including a current list of sub-processors and a summary of security measures. Where that is insufficient, we will allow an audit by you or an independent auditor bound by confidentiality, at reasonable notice and at your cost.

If we become aware of a breach affecting your data, we will notify your account email without undue delay after confirming it, and in any case within 48 hours [To be confirmed], with what we know at that time: the nature of the incident, the data and individuals likely affected, measures taken, and a contact point. We will update you as the investigation progresses.

Where Singapore's PDPA applies and the breach is likely to result in significant harm or affects 500 or more individuals, we notify the PDPC within 3 calendar days of assessing it as notifiable. Where GDPR applies, we support you in meeting the 72-hour notification deadline. Report a suspected incident to privacy@canlah.ai.

This DPA applies for as long as we process data on your behalf and survives termination until all your data has been deleted or returned. It is governed by the laws of Singapore, and disputes are subject to the exclusive jurisdiction of the courts of Singapore, consistent with the Terms of Service.

Data requests and incident reports: privacy@canlah.ai. General enquiries: admin@canlah.ai. Our designated Data Protection Officer is Haoyang Pang.