Data Processing Agreement

What changed — October 2026

Clause 7 and Schedule 2 now say that Google Gemini receives a phone number when a customer types one into the conversation; a number already held on file is still not sent — only whether there is one. Clause 10 now reflects the admin's self-service tools: the Controller can erase a customer and download its customer list itself, while a full copy of one customer's data is still produced by the Confirmed team on request. Clause 7 and Schedule 2 now list each task Google Gemini performs, and Clauses 7 and 12 and Schedules 1 and 2 now name day spas wherever photos are read. Clause 10 also covers deleting a single conversation and lists the customer CSV's fields. Clause 5.3 and the Clause 12 photo row now say that a record made before 1 October 2026 may also hold a nail colour or pattern, or hair details read from a covered head. Schedule 2 now says Firebase holds the images the business uploads, never a photo a customer sends, and that OpenAI plans a turn when Gemini is unavailable.

What changed — September 2026

Photos. On a hair, nail or beauty salon or a barbershop, a photo a customer sends is now read by Google Gemini, and what it shows is saved with the enquiry; the photo itself is not stored. Clinics and every other kind of business are excluded — their customers' photos are not sent to any model. Clause 5.3, Clause 7, Clause 12 and Schedules 1 and 2 are updated to say so.

Photos, 26 September 2026. What is saved is no longer a sentence: it is a short form of style details, each picked from a fixed list (hair colour, length, cut and texture; nail shape, length, colour and finish; brow shape and tint; lash style and tint). The form has no free-text field, so it cannot hold a person's features, age, ethnicity or religious dress, a condition, or words from the picture. Records made before 27 September 2026 may hold a one-sentence description until the enquiry's retention ends. Clause 5.3 and Schedules 1 and 2 are updated.

Photos, a second look, 26 September 2026. Each photo is now sent to Google Gemini twice at the same moment: once for the form and once to check it for writing and for any mark on the nails, skin, scalp or hair themselves. Any words the check copies out of the picture are used only to decide that the photo is not described, and are never stored. A patterned nail finish (nail art, glitter, a French or ombré finish) is no longer recorded, and a nail colour is recorded only on nails the check sees as polished. Clause 5.3 and Schedule 2 are updated.

Photos, an adversarial check, 30 September 2026. No nail colour is recorded any more — a discolouration under two matching nails was read as a polish colour — and the second look also asks whether the head is covered: where it is, nothing about hair is recorded. Clause 5.3 is updated.

Photos, eligibility. A photo is read only where the Controller itself has chosen a hair, nail or beauty salon, a barbershop or a day spa as its business type in the admin; a type the onboarding step guessed from the business name does not count until the Controller confirms it. Clinics are excluded. Photos per conversation and per Controller per day are capped; past the cap a photo is not read and nothing is kept.

What changed — August 2026

Schedule 2 is now the real sub-processor list: Make.com has been removed, and Google Gemini, OpenAI, Retell AI, the voice adapter host, Stripe Connect, Sentry, Firecrawl, Square and Timely are named — including what each AI provider actually receives from a conversation.

The security measures in Clause 6 have been replaced with the controls we actually run, and Clause 12 now states retention honestly: a few categories expire automatically, most data is kept for the life of your account and deleted when you ask or when you leave. The previous "12 months" figure was wrong and has gone.

New clauses cover AI processing, international transfers under the UK IDTA, help with data subject requests, sub-processor change notice with a right to object, and the use of anonymised aggregate statistics.

Parties

Data Processor: Razaq Ltd, a company registered in England and Wales, company number 17057410 | Email: privacy@razaq.ai | Website: razaq.ai

Razaq Ltd is registered with the Information Commissioner's Office (ICO), registration number ZC103225. Razaq Ltd has not appointed a Data Protection Officer; data protection enquiries go to privacy@razaq.ai.

Data Controller: The Business Customer as identified in their Confirmed account.

The Controller is the controller of personal data about its own customers. Razaq Ltd is the processor of that data. Razaq Ltd is a controller in its own right only for salon owner and staff account data, which is covered by the Privacy Policy rather than this DPA.

1. Definitions

2. Scope and Duration

This DPA applies to all processing of Personal Data carried out by Razaq Ltd on behalf of the Controller in connection with the Platform. It remains in force for the duration of the Terms of Service and until all Personal Data has been deleted in accordance with Clause 12.

3. Details of Processing

The subject matter, duration, nature, purpose, data subjects and categories of Personal Data are set out in Schedule 1 at the end of this document.

4. Obligations of the Processor

Razaq Ltd agrees to:

• Process Personal Data only on the documented instructions of the Controller — which, for these purposes, are this DPA, the Terms of Service and the configuration choices the Controller makes in its account — unless required to do otherwise by law.
• Ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain the technical and organisational security measures described in Clause 6.
• Not train or fine-tune any model on the Controller's Personal Data, and not enrol the Controller in any Model Provider programme that would use its data for model training.
• Assist the Controller in responding to data subject requests, as described in Clause 10.
• Assist the Controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to Razaq Ltd.
• At the Controller's choice, delete or return all Personal Data on termination (see Clause 12).
• Make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA (see Clause 14).
• Notify the Controller without undue delay if Razaq Ltd receives an instruction that, in its opinion, infringes UK GDPR or other applicable law.

5. Obligations of the Controller

5.1 General

• Ensure it has a lawful basis for collecting and processing customer Personal Data via the Platform.
• Provide its customers with a privacy notice that covers the processing described in this DPA, including the use of AI Model Providers named in Schedule 2.
• Ensure that Personal Data submitted to the Platform is accurate and limited to what is necessary.
• Not instruct Razaq Ltd to process Personal Data in a way that would breach UK GDPR or any other applicable law.
• Respond to data subject requests relating to Personal Data for which it is the controller, with Razaq Ltd's assistance under Clause 10.
• Obtain and manage marketing consent where it uses the Platform to send marketing messages, and honour opt-outs.

5.2 Voice calls

Where the Controller enables the AI phone line, calls are recorded by Retell AI. The Controller must ensure callers are given a recording notice and told they are speaking to an AI assistant. The AI greeting supplied by Confirmed states both; the Controller must not disable or replace that notice, and remains responsible for any further notice its own line or regulator requires.

5.3 Images and special category data

Customers can send photos into a conversation. In a beauty or clinic setting a photo may show skin, hair or body and may therefore reveal health-related information, which is special category data under UK GDPR. The Platform does not store the photo itself.

Where the Controller has chosen a hair, nail or beauty salon, a barbershop or a day spa as its business type in the admin (a type guessed at onboarding does not count until the Controller confirms it), the photo is sent to Google Gemini (Schedule 2) twice, in parallel: once to return a short form of the style details it shows, every value picked from a fixed list (hair colour, length, cut and texture; nail shape and length, and a plain glossy, matte or chrome finish only on nails the second look sees as polished; brow shape and tint; lash style and tint), and once to check the photo for writing, for any mark on the nails, skin, scalp or hair themselves, and for whether the head is covered. Any words the check copies out of the picture are used only to decide that the photo is not described and are never stored. Those details are saved with the enquiry for the Controller's team and the photo is discarded. The form has no free-text field: it cannot hold a person's face, age, skin, ethnicity or religious dress, anything they are wearing, words that appear in the image, a price, a diagnosis or suitability. A photo that shows skin, that may show a condition of the hair, scalp, skin or nails, or that has any writing in it is recorded only as that kind of photo, with nothing about it described. No nail colour is recorded, and neither is a patterned nail finish (nail art, glitter, a French or ombré finish); where the head is covered, nothing about hair is recorded. The assistant's reply may repeat the style details, and replies are part of the conversation transcript, kept under the transcript retention in Clause 12. The details (never the photo) are also part of the conversation content OpenAI receives to write replies. A record made before 27 September 2026 may instead hold a one-sentence description, and one made before 1 October 2026 may also hold a nail colour or pattern, or hair details read from a covered head; both are kept under the same retention. Where the Controller is a clinic or any other kind of business, has not chosen its type, or has reached the per-conversation or daily photo cap, photos are not sent to any model.

The Controller must not use the Platform to solicit health information or other special category data, must not configure the AI to ask for it, and is responsible for its own lawful basis and Article 9 condition if such data is nonetheless received.

6. Security Measures

Razaq Ltd implements the following technical and organisational measures. These are the controls the Platform actually runs, not aspirations:

• Encryption in transit: TLS for all traffic between users, the Platform and its sub-processors.
• Encryption at rest: provider-managed encryption of stored data.
• Application-layer encryption: channel and integration access tokens are encrypted with AES-256-GCM before they are stored.
• Tenant isolation: every record belongs to a single Controller under its own tenant path; queries are scoped to that tenant.
• No direct client access: database security rules deny all client-SDK access. Every read and write is mediated by the server.
• Authenticated administration: admin access is authorised from a verified identity token; the tenant is never taken from a value supplied by the browser.
• PII-safe logging: logs are written through a redaction layer, enforced by an automated test that fails the build if personal data can reach a log.
• Anonymised access logs: IP addresses are truncated to /24 before being logged.
• Webhook authentication: timing-safe HMAC signature verification on Meta, Twilio and Stripe webhooks.
• Signed, single-use OAuth state for every integration connection flow.
• SSRF and DNS-rebinding defences on any URL supplied by a Controller (for example website import).
• Abuse controls: distributed rate limiting keyed on hashed — never raw — phone numbers and IP addresses, plus booking caps per phone number and IP.
• Sub-processor diligence: sub-processors are reviewed before engagement and bound to equivalent data protection obligations.
• Incident response: a documented process for detecting, triaging and reporting personal data breaches (Clause 11).

Razaq Ltd does not currently hold ISO 27001 or SOC 2 certification, does not publish a third-party penetration test report and does not operate a bug bounty. Nothing in this DPA should be read as claiming otherwise.

7. AI Processing and Automated Decisions

The Platform sends conversation content to the Model Providers listed in Schedule 2 so the AI can understand a message and draft a reply. In plain terms:

• Google (Gemini): plans each conversation turn, runs short checks on the customer's message (for example whether it concerns someone else, or is sensitive), writes the one-line note the Controller sees on each conversation, and writes the reply when OpenAI is unavailable. The content sent includes the turn itself — anything the customer types in it, such as their name or phone number — and, where known, the name already held for the customer. A phone number already held on file is not sent: the planner receives only a flag recording whether one is held. For a Controller that has chosen a hair, nail or beauty salon, a barbershop or a day spa as its business type, Gemini also reads a photo the customer sends, and checks it a second time for writing, signs of a condition and whether the head is covered (Clause 5.3).
• OpenAI: writes replies, plans a turn when Gemini is unavailable (receiving what Gemini would), generates the insights report and powers the AI Consultant. The Consultant snapshot includes up to ten verbatim customer messages; phone numbers and email addresses in them are masked, but names are not.
• Anthropic: an adapter exists in the Platform but no live feature currently sends data to it. If that changes, Anthropic will be added to Schedule 2 under Clause 8.2 before any Controller data is sent.

The model never carries out an action. It produces a plan that is validated against a fixed schema, and deterministic Platform code performs the booking, the payment or the message. A human can take over any conversation at any time from the shared inbox.

The Platform applies automated abuse controls that can refuse a request — for example blocking obviously invalid phone numbers and capping bookings per phone number or IP address. These are fraud and abuse measures with a human override: the Controller can always intervene and complete the request manually. Razaq Ltd does not carry out automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them within the meaning of Article 22 UK GDPR.

8. Sub-processors

8.1 Authorisation

The Controller gives general authorisation for Razaq Ltd to engage the sub-processors listed in Schedule 2. Razaq Ltd remains liable to the Controller for its sub-processors' performance and will impose data protection obligations equivalent to those in this DPA on each of them.

8.2 Changes and right to object

Razaq Ltd will give the Controller at least 30 days' notice, by email to the account's registered address, before adding or replacing a sub-processor that processes Personal Data. The Controller may object on reasonable data protection grounds within those 30 days by writing to privacy@razaq.ai. Razaq Ltd will work with the Controller to find a workaround — for example leaving the affected feature disabled for that account. If no workaround is reasonably available, either party may terminate the affected services on 30 days' written notice without penalty, and the Controller will be refunded any fees paid in advance for the terminated services.

Optional integrations marked as such in Schedule 2 are engaged only if the Controller connects them, and no Personal Data reaches them otherwise.

9. International Data Transfers

The Personal Data is stored in the United Kingdom: the Firestore database and file storage for this Platform are located in Google Cloud's London region (europe-west2). Error monitoring is hosted in the EU (Germany). Most of the sub-processors in Schedule 2 are nevertheless located in the United States or on globally routed infrastructure, so Personal Data — including message content sent to the Model Providers — is processed outside the UK in the course of providing the Platform.

Where Personal Data is transferred outside the UK, Razaq Ltd will ensure an appropriate transfer mechanism is in place with the recipient, being:

• the UK International Data Transfer Agreement (IDTA), or
• the UK Addendum to the EU Standard Contractual Clauses, or
• UK adequacy regulations, where the recipient is in a country covered by them (including the EEA).

The mechanism relied on for each sub-processor is shown in Schedule 2. A copy of the relevant clauses for a specific sub-processor is available on request to privacy@razaq.ai.

10. Data Subject Requests

Requests from customers — access, rectification, erasure, restriction, portability or objection — should be made to the Controller, who is responsible for answering them. If a data subject contacts Razaq Ltd directly, Razaq Ltd will not respond on the merits; it will tell the person to contact the business and, where it can identify the Controller, pass the request on without undue delay.

Razaq Ltd will assist the Controller by locating, exporting, correcting or deleting the relevant data on written request to privacy@razaq.ai, without undue delay and in time for the Controller to meet its own one-month deadline under UK GDPR.

Two honest limits apply. First, self-service covers erasure and a customer list, not yet a full copy of one customer's data: the Controller can erase a customer from that customer's page in the admin, or delete a single conversation from the Conversations page, each with a preview of what will be erased first, and can download every customer record (name, contact details, visits, notes, preferences and tags) with Export CSV on the Customers page; an access or portability request for one customer's full record is produced by the Confirmed team, so please send those as early in the month as you can. Second, SMS opt-out records cannot be erased — they are the suppression list that stops a person being messaged again, and deleting an entry would cause the very contact the person asked to stop. Razaq Ltd retains opt-out records on the basis that this is necessary to comply with the person's objection.

11. Personal Data Breaches

Razaq Ltd will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's Personal Data, and in any event in time to allow the Controller to meet its own 72-hour notification deadline to the ICO.

The notification will describe, to the extent known at the time: the nature of the breach and the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed. Further information will follow as the investigation progresses.

Razaq Ltd will not notify the ICO or affected individuals on the Controller's behalf unless the Controller asks it to in writing.

12. Retention, Deletion and Return

Some records are deleted automatically after a fixed period. The rest are kept while the account is open, and deleted on request or when the account ends. The table below matches the retention table in the Privacy Policy.

"While the account is open" means the data is kept until the Controller asks for it to be deleted, or until the account ends. The automatic rules above are configured per environment; where a rule is not yet switched on in the environment serving a Controller's account, the affected records are covered by the position above rather than deleted on the shorter timetable. Razaq Ltd will confirm the position for a specific account on request.

On termination of the Terms of Service, or on written request, Razaq Ltd will delete the Controller's Personal Data within 30 days and confirm the deletion in writing if asked. The Controller may request an export of its data within those 30 days. After that, deletion is final and cannot be reversed.

Razaq Ltd may retain Personal Data beyond this period only where required by law — for example booking and payment references kept for tax purposes — and will tell the Controller what has been retained and why.

13. Anonymised Aggregate Statistics

The Controller agrees, as part of the documented instructions in Clause 4, that Razaq Ltd may create anonymised, aggregated statistics from use of the Platform and use them to operate, benchmark and improve the service, including after termination. This mirrors clause 8.4 of the Terms of Service, which contains the substantive grant.

Such statistics must not identify the Controller, any individual, or any of the Controller's customers, and must not be capable of being used to re-identify them. Once anonymised, the statistics are no longer personal data and are the property of Razaq Ltd.

As things stand today, the Platform writes one aggregate record per account per day — utilisation rate, no-show rate, repeat-client rate, confirmed revenue and total bookings. It contains no customer data and stays inside the Controller's own tenant. No aggregation across accounts is currently performed.

14. Audits and Inspections

Razaq Ltd will make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA. In the first instance this obligation is met by written information: answers to a security questionnaire, a description of the measures in Clause 6, and the sub-processor and transfer details in Schedule 2 and Clause 9. Razaq Ltd holds no third-party certification or audit report and so cannot offer one in place of answering.

Where written information is genuinely insufficient — because a supervisory authority requires it, or following a personal data breach affecting the Controller — the Controller may audit Razaq Ltd's processing relevant to this DPA on 30 days' written notice, at its own cost, no more than once a year, during business hours and without disrupting the Platform or the data of other customers.

15. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of UK GDPR obligations that cannot be limited by contract.

16. Governing Law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

17. Acceptance

By using the Confirmed platform, the Controller confirms they have read, understood, and agreed to this DPA. No separate signature is required. The Controller's account creation or continued use of the Platform constitutes acceptance.

Schedule 1 — Details of Processing

Schedule 2 — Approved Sub-processors

This list matches the sub-processor table in the Privacy Policy. "USA / global" means the service is US-based or served from global infrastructure, with no UK or EEA residency commitment.

Anthropic is not currently a sub-processor: an adapter exists in the Platform but no live feature sends data to it. It will be added under Clause 8.2, with notice and a right to object, before any Controller data is sent to it.

© 2026 Razaq Ltd. All rights reserved. | privacy@razaq.ai | razaq.ai