Data Processing Addendum

Last updated: October 17, 2026

This page summarizes Queeble's standard data processing commitments for merchants and partners evaluating the platform for customer-data workflows.

1. Scope

•This Data Processing Addendum applies when Queeble processes personal data on behalf of a merchant or business customer in connection with the Queeble services.
•For that customer data, the merchant is the controller or business and Queeble acts as a processor or service provider except where applicable law states otherwise.

•Queeble processes personal data only on documented instructions from the merchant, including instructions reflected in the product configuration, support requests, and applicable service documentation.
•Queeble will not process merchant customer data for unrelated advertising or for sale to third parties.
•If the merchant opts in to chat review in the product (optional, off by default, withdrawable at any time), Queeble may review that merchant's customer chats to improve the merchant's assistant, using only chat text from which names, phone numbers, emails, addresses and payment data have been removed. Declining has no effect on the service.

•Depending on enabled features, Queeble may process names, email addresses, phone numbers, shipping or billing addresses, order records, support conversation content, store data, channel metadata, and associated operational records.
•For AI-assisted conversations, Queeble also records diagnostic traces (request timings, model and token usage, tenant identifiers, and log lines that pass through personal-data redaction). These traces are deleted automatically within 30 days.
•The categories of data subjects may include merchant staff, store customers, leads, prospects, and end users interacting with enabled channels.

•Queeble maintains technical and organizational safeguards designed to protect personal data, including access controls, authentication controls, encryption for sensitive data flows and secrets, audit logging, and service monitoring.
•Access to production data is limited to authorized personnel with a legitimate business need.

•Queeble may use subprocessors for hosting, cloud infrastructure, communication delivery, analytics, support, security, and payment operations.
•Queeble requires subprocessors to protect personal data through written obligations appropriate to the services they provide.
•Queeble publishes its current subprocessors at queeble.com/legal/subprocessors. Microsoft Azure (Central India) hosts the store for AI diagnostic traces.

•Queeble provides features and reasonable assistance to help merchants respond to access, deletion, correction, export, or restriction requests where required by law.
•If Queeble receives a request directly about merchant-controlled data, Queeble may direct the requester to the relevant merchant unless legally required to respond otherwise.

•If Queeble confirms a security incident affecting merchant customer data, Queeble will investigate, contain, and remediate the issue and notify the affected merchant without undue delay, subject to legal and operational constraints.
•Notifications may include the nature of the incident, affected data categories, known impact, and available remediation steps.

•Where cross-border transfers occur, Queeble applies safeguards available under applicable law, including contractual protections where appropriate.
•AI diagnostic traces are stored in India. Traffic between Queeble's services and that store passes through Cloudflare's network, which may process it outside India.

•Upon termination or deletion of the services, Queeble will delete or return personal data in accordance with the service terms, retention schedule, merchant instructions, and legal obligations.
•Backup, security, billing, and compliance records may be retained for limited periods where required for legitimate business or legal purposes.