Data processing terms
The Article 28 contract between you as controller and us as your processor. It forms part of our terms of service.
Draft, 31 August 2026. Written from the actual data flows in our systems, not adapted from a template, but not yet reviewed by a solicitor. If your procurement needs a signed DPA, ask us — we would rather send you the reviewed version than have you sign this one.
1. Roles
For the personal data the roster handles on your properties — your guests, your owners, your cleaners and contractors — you are the controller and A Fuller Life AI Ltd is your processor. You decide what the data is for; we act on your documented instructions, which are your configuration and these terms together.
If we ever determined the purpose ourselves, we would be a controller for that and would tell you first. We do not currently do this for any customer data.
2. What we process, and about whom
- Guests — name, the content of their messages, stay dates, and anything they choose to tell the roster. Access details and codes where you configure them.
- Property owners — name, email, and the financial figures in their statements.
- Cleaners and contractors — name, phone number, and the jobs assigned to them.
Processing lasts as long as your subscription. The subject matter is running the roles you switch on.
We do not ask for special category data (health, beliefs, and the rest of Article 9). Guests occasionally volunteer it in a message — "I'm coming out of hospital", say. We do not solicit it, do not process it separately, and it is subject to the same retention as any other message.
3. Our obligations
- Process only on your documented instructions, unless the law requires otherwise — in which case we will tell you first if we are allowed to.
- Keep everyone who handles the data under a duty of confidentiality.
- Apply appropriate technical and organisational measures (section 6).
- Use sub-processors only under section 4.
- Help you respond to data-subject requests, and help you with security, breach notification and impact assessments.
- Delete or return the data at the end, as you choose (section 7).
- Make available what you need to verify this, and allow audits (section 8).
4. Sub-processors
You give us general authorisation to use the sub-processors below. We will give you 30 days' notice before adding or replacing one. If you reasonably object on data-protection grounds, tell us within those 30 days — if we cannot resolve it, you may terminate the affected part of the service without penalty.
| Who | What they do | What they see | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge network, database (D1), key-value and object storage, and the AI model behind the website chat | Website requests, IP addresses, enquiry records, operational records | Global edge; UK/EU data centres for storage |
| Anthropic PBC | The language model that drafts replies, reads cleaning photos, triages maintenance and extracts certificate dates | Guest message content, property knowledge, photos and documents you provide | United States |
| Airtable, Inc. | The operational database for a host's own properties, conversations and jobs | Guest messages, property details, bookings, tasks | United States |
| Guesty Inc. | The booking-platform integration — reading and sending guest messages and review replies | Guest messages, reservations, reviews | United States / Israel |
| Resend (Plain Text, Inc.) | Transactional email — enquiry notifications, owner statements, contractor and renewal emails | Names, email addresses, message content | United States |
| Twilio Inc. | WhatsApp dispatch to cleaners and contractors | Phone numbers, job details | United States |
| Xero Limited | Accounting sync for Back Office, only when a host connects it | Transactions, invoices, payouts | New Zealand / Australia |
Each is bound by written terms no less protective than these. We remain liable to you for their performance.
Worth naming explicitly: guest message content is sent to Anthropic to generate a reply. It is not used to train models. If that is a blocker for your business, say so at the audit rather than after — it is not something we can architect around.
5. International transfers
Several sub-processors are outside the UK, principally in the United States. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where they apply. We will provide the documentation on request.
6. Security
- Encryption in transit (TLS) and at rest with our infrastructure providers.
- Per-tenant credential isolation — one customer's keys cannot reach another's data.
- Secrets held in the platform's secret store, never in source control.
- Access limited to the people who need it to run the service.
- Sensitive details — door codes, wifi, addresses — are withheld from a guest until arrival is verified, by design rather than by policy.
- Human oversight of the roster's actions while a property beds in, and per-property autonomy afterwards.
7. Return and deletion
On termination, or on request, we will delete or return the personal data we hold for you. Deletion is completed within 30 days, except where we must keep something by law, in which case we tell you what and why. Your operational database is in your own account and remains yours throughout.
8. Audit
We will give you the information you reasonably need to demonstrate compliance with Article 28, and allow an audit on 30 days' notice, no more than once a year unless a regulator or a breach requires otherwise, at your cost and subject to confidentiality.
9. Breach
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know, what we are doing, and what we recommend you do. Notifying the ICO or your data subjects is your call as controller; we will give you what you need to make it.
10. Data-subject requests
If a guest contacts us directly, we will not respond substantively — we will refer them to you and tell you promptly. We will help you meet the deadline.
11. General
These terms take precedence over the terms of service on data protection, and are governed by the laws of England & Wales. Contact: team@afullerlifeai.com.