Last updated: November 4, 2026
This addendum is part of the contract between Create Your AI LLC (“we”) and each client, and applies whenever we process personal data on the client’s behalf. It is written for Brazil’s LGPD and for US state privacy laws, including the California Consumer Privacy Act as amended.
Roles and instructions
The client is the controller (the “business” under US state laws). We are the processor: an “operador” under the LGPD and a service provider or contractor under US state laws.
We process personal data only on the client’s documented instructions, which are the contract, the order form, the client’s settings and its written requests, unless the law requires otherwise. If it does, we tell the client first unless the law forbids it.
What we process
| People | Shoppers and customers who use the concierge; client staff who use our tools. |
|---|---|
| Data | Messages; product interests; contact details people choose to give for a hand-off (name, email, phone, WhatsApp); order references; technical data such as IP address, browser and timestamps. |
| Sensitive data | Not intended. Concierges are set up not to ask for it (see section 6). |
| Purpose | Providing, securing, supporting and improving the client’s concierge. |
| Duration | The contract, plus up to 30 days to return and delete the data. |
Our commitments
- We process personal data only for the purposes above.
- We don’t sell or share it, as US state laws define those terms, and we don’t use it for targeted advertising.
- We don’t keep, use or disclose it outside our direct business relationship with the client, and we don’t combine it with data from other sources except as the law allows service providers to do.
- We never use one client’s data to serve another client, and we don’t use it to train AI models.
- Our staff and contractors are bound to confidentiality.
- We tell the client if we can no longer meet these duties, and the client may take reasonable steps to stop unauthorized use.
Security measures
- Encryption in transit (TLS), and at rest where our providers support it.
- Access limited by role, with multi-factor sign-in.
- Each client’s data and configuration kept separate.
- Logging of administrative access.
- Backups with tested recovery.
- Review of providers before we use them, and prompt patching of the systems we manage.
Subprocessors
The client authorizes us to use the subprocessors below. We give at least 30 days’ notice of a new one by email. The client may object on reasonable data protection grounds and, if we can’t resolve it, end the affected service without penalty. We hold each subprocessor to data protection terms at least as protective as these.
| Subprocessor | What it does | Where |
|---|---|---|
| Anthropic, PBC | AI models that understand questions and write answers | United States |
| Railway Corporation | Application hosting | United States |
| Meta Platforms, Inc. (WhatsApp Business Platform) | WhatsApp hand-off and agent, when the client uses them | United States and other countries |
| Microsoft Corporation (Microsoft 365, through GoDaddy) | United States |
Sensitive data and health information
Concierges are set up not to request sensitive personal data, such as health information, racial or ethnic origin, religious beliefs, sex life, biometric data or financial account details. Clients in health care must tell us at kickoff.
We don’t process protected health information under HIPAA unless we have signed a Business Associate Agreement with the client.
International transfers
Personal data may be processed in the United States and in other countries where our subprocessors operate. For personal data from Brazil, where no other transfer mechanism applies, the parties adopt the standard contractual clauses approved by the ANPD in Resolution CD/ANPD 19/2024. They are incorporated by reference and prevail over this addendum for those transfers.
Helping the client
We help the client answer requests from individuals (access, correction, deletion and others), with data protection impact assessments and with questions from authorities, as far as our role allows. If someone contacts us directly about the client’s data, we pass the request to the client and don’t answer it ourselves unless the client asks us to.
Security incidents
We notify the client without undue delay, and within 48 hours of confirming a security incident that affects its personal data, with what we know: what happened, the data and people affected, the likely consequences and what we are doing about it. We keep the client updated.
This lets the client meet its own deadlines, such as the three business days the ANPD sets for notifying it and the people affected (Resolution CD/ANPD 15/2024).
Audits
Once a year, on request, we give the client the information it needs to check that we meet this addendum, such as a summary of our security measures and the current subprocessor list. Further audits are by agreement, at the client’s cost, with reasonable notice and confidentiality.
End of the contract
Within 30 days after the contract ends, we return the client’s personal data on request in a common format, then delete it, including from our subprocessors, except where the law requires us to keep it. Backups are overwritten on their normal cycle.
Order of precedence
If this addendum conflicts with our terms of service on the processing of personal data, this addendum wins. Questions: hello@createyourai.co.