Data Processing Agreement

1. Parties and scope

This agreement is between the owner of a workspace in Exylia Tickets (the "Customer", controller) and Cristobal Aranda, domiciled in Chile (the "Processor"). It applies to the personal data the Processor processes on the Customer's behalf through the Service, mainly data about the Discord users who open tickets, write in them, apply or work as staff in the Customer's servers ("Customer Personal Data"). It is accepted together with the Terms of Service and lasts as long as the Customer has a workspace, plus the time needed to delete its data.

Data about the Customer's own account and the accounts of its dashboard members is processed by the Processor as controller under the Privacy Policy, not under this agreement.

The same applies to usage analytics. If a User accepts them, Google Analytics and Microsoft Clarity measure how Users use the dashboard: that is usage data about Users, which the Processor processes as controller under the Privacy Policy. Clarity masks the text inside the dashboard and on transcript pages, and analytics never load on transcript links, so recordings do not contain Customer Personal Data. Page addresses and titles may include workspace or server names, ticket numbers and Discord user IDs; they are used only to measure and improve the Service, never sold or used for advertising. Google and Microsoft are therefore not sub-processors of Customer Personal Data.

2. Details of the processing

• Subject matter and purpose: running the Customer's ticket, application and support system on Discord and in the dashboard, and the optional functions the Customer enables (AI assistant, translation, learning, reports, account lookups, integrations).
• Nature: receipt of Discord events and messages, storage, display, relay between the ticket channel and direct messages, translation and analysis by language models when enabled, transmission to the systems the Customer connects, and deletion.
• Data subjects: Discord users who open tickets, write in them or apply in the Customer's servers, the Customer's staff acting in Discord, and people mentioned in those conversations.
• Categories of data: as listed in sections 3 and 4 of the Privacy Policy: Discord user IDs, usernames, display names and avatar addresses; the content of messages written in ticket channels and in direct messages tied to a ticket or application, with their edits and attachment details (and copies of attachments when the platform's storage is on); form and application answers; ticket metadata, notes, ratings and comments; detected language; staff roles, languages, time zone and activity; blocklist entries; AI conversations, summaries and records; account lookup results.
• Special categories: none are expected. Free text written by members may nonetheless contain them; the Customer must not request them.
• Duration: while the workspace exists, unless deleted sooner at the Customer's request; specific shorter periods are listed in section 8 of the Privacy Policy.

3. Processor obligations

The Processor will:

• Process Customer Personal Data only on the Customer's documented instructions, which are these terms and the configuration the Customer makes in the Service, unless the law requires otherwise; in that case it will inform the Customer first, unless the law forbids it. It will tell the Customer if it believes an instruction infringes data protection law.
• Ensure that anyone authorised to process the data is bound by confidentiality. Platform administrators access a workspace's content only to provide support the Customer asks for, to investigate abuse or a security incident, or when the law requires it.
• Apply the security measures of section 5.
• Not use Customer Personal Data for its own purposes, sell it, use it to train AI models, or combine it with data of other Customers, except for aggregate figures that identify no person or Customer and are used only to operate and improve the Service.
• Assist the Customer, taking into account the nature of the processing, in answering data subjects' requests, in security, in breach notification and in any data protection impact assessment or prior consultation.
• Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits, as described in section 8.

4. Customer obligations

The Customer is responsible for the lawfulness of the processing: it will have a legal basis, inform its members (for example with the notice in section 11), enable only the functions it needs, not request sensitive data, and respond to its members' requests. It guarantees that its instructions comply with the law. Connecting its own AI provider, data provider, webhook, API key or another app is an instruction to disclose the data that connection receives to that third party, for which the Customer is responsible. When the Customer runs its own Discord application through the Service, the Customer is the owner of that application before Discord.

5. Security measures

• Encryption in transit (TLS) between Discord, the network provider, the Processor's servers and the dashboard.
• Secrets (custom bot tokens, AI and integration keys, webhook secrets, Discord access tokens) encrypted with AES-256-GCM with keys derived per workspace or purpose.
• Session, invitation and API tokens stored only as hashes; sign-in through Discord OAuth with PKCE.
• Logical separation of each Customer's data by workspace in every table and query; role-based permissions within each workspace, including a specific permission to read transcripts; internal notes never shown to ticket openers.
• A database reachable only from the Service's internal network, never exposed to the internet.
• Only messages in ticket channels and direct messages tied to a ticket or application are stored; other messages the bot receives are discarded without being read.
• Outgoing requests to destinations configured by Customers (webhooks, their own AI provider, account lookups) blocked from private network addresses, with timeouts and size limits; API rate limiting; an audit log of changes in each workspace and of platform administrator actions.

6. Sub-processors

The Customer gives general authorisation for the Processor to use sub-processors. The current ones are:

• Cloudflare, Inc. (United States; global network): DNS, TLS termination and network protection for all traffic to the dashboard and transcript pages.
• Language model providers, only for workspaces with the AI assistant or translation on and only while the platform's model connection points to them: Anthropic PBC, OpenAI, L.L.C. or OpenRouter, Inc. (United States; OpenRouter forwards each request to the model provider it routes it to). They receive the content described in section 4 of the Privacy Policy: the ticket's recent messages and form answers, attached images when image reading is on, the server's name, the Customer's instructions and knowledge, and filtered account facts. The Processor uses one connection at a time; while the platform's model runs on the Processor's own servers, no sub-processor receives this content.

The Service, its database, its file storage and the text classifier (Decider) are hosted on infrastructure operated by the Processor itself in Chile. Discord Inc. is not a sub-processor: the Customer chose to run its community on Discord and Discord processes that data as its own controller. Services the Customer chooses to connect (its own AI provider, data provider, webhooks, API clients or other Exylia apps) act on the Customer's instructions and are not sub-processors of the Processor.

The Processor will impose on each sub-processor data protection obligations equivalent to these and remains responsible for their compliance. It will announce any new sub-processor in the dashboard or by email at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, turn off the affected function or end its use of the Service.

7. Data subject requests and erasure

Staff with the right permissions can read every ticket, transcript and application of the workspace in the dashboard to answer access requests. The Customer can turn off transcripts, attachment copies, the AI assistant and other functions at any time to stop that processing going forward. To erase a member's tickets and messages, or any other Customer Personal Data, the Customer writes to [email protected] from the Discord account that owns the workspace, and the Processor completes the erasure within 30 days. If a data subject contacts the Processor directly, the Processor will pass the request on to the Customer without undue delay and will not answer it on its own unless the Customer instructs it to.

8. Breaches and audits

The Processor will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting Customer Personal Data, with the information available at the time: its nature, the categories and approximate number of people and records affected, likely consequences and the measures taken or proposed. It will supplement the information as it becomes available.

On written request, no more than once a year unless there has been a breach or an authority requires it, the Processor will answer reasonable questionnaires about its compliance and provide the relevant documentation. On-site audits, if necessary, will be agreed in advance, at the Customer's expense and subject to confidentiality.

9. End of processing

Removing the bot from a server stops new processing for that server but does not by itself delete stored data. When the Customer asks for its workspace to be deleted, the Processor deletes all Customer Personal Data, including copies of attachments in its file storage, within 30 days from its active systems and within a further 30 days from backups, unless the law requires it to be kept. Before that, the Customer can consult in the dashboard the data it needs. Workspaces that were never used (the bot never joined their server and no ticket was opened) are deleted automatically a week after their creation.

10. International transfers and law

The Processor is in Chile, a country without an adequacy decision of the European Commission. For Customer Personal Data subject to the GDPR, the parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor), or Module Three (processor to processor) when the Customer is itself a processor. For those clauses: clause 7 (docking) applies; in clause 9 option 2 (general authorisation) applies with the notice period of section 6; the optional wording of clause 11 does not apply; in clauses 17 and 18 the law and courts of Ireland apply; Annex I is completed with sections 1 and 2 of this agreement, Annex II with section 5 and Annex III with section 6. For data subject to UK law, the International Data Transfer Addendum issued by the ICO is incorporated in the same way. In case of conflict, the clauses prevail over this agreement.

In all other respects this agreement is governed by the law and courts set out in the Terms of Service, and the liability limits of those terms apply to it to the extent the law allows.

11. Notice template for your members

Customers can publish this text, adapted to the functions they use, in their rules, ticket panel or website:

"This server uses Exylia Tickets for support tickets [and applications]. When you open a ticket, what you write in it (and in direct messages to the bot about it), your form answers, your Discord name and avatar, and the files you attach are stored as the ticket's transcript, which our staff can read. [An AI assistant may answer first: your messages and attached images are processed by a language model to answer you, translate and summarise the ticket; you can always ask for a person.] We are responsible for this data; Exylia Tickets processes it on our behalf. To access or delete your tickets, contact [server contact]. More information: https://tickets.exylia.net/privacy"