genfleet

Data Processing Agreement

Last updated: 15 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Genfleet LLC (in formation), Nasr City, Cairo, Egypt ("GenFleet", "Processor") and the customer that accepted them ("Tenant", "Controller").

It applies when GenFleet processes personal data on the Tenant's behalf to provide the Service.

1. Definitions

  • Applicable Data Protection Law means every data protection law that applies to the processing, including, where relevant:
    • Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations ("Egyptian PDPL");
    • the EU General Data Protection Regulation 2016/679 ("GDPR");
    • the UK GDPR and Data Protection Act 2018.
  • Controller, processor, data subject, personal data, processing, personal data breach have the meanings in the Applicable Data Protection Law. Under the Egyptian PDPL, "personal data breach" includes a "breach or violation" of personal data.
  • Customer Personal Data means personal data the Tenant, its users, its agents, or its end customers put into the Service, and that GenFleet processes on the Tenant's behalf.
  • Subprocessor means a third party GenFleet engages to process Customer Personal Data.

2. Roles

  1. The Tenant is the controller of Customer Personal Data. GenFleet is its processor.
  2. GenFleet is a separate controller for its own account, billing, security and website data. That processing is covered by the Privacy Policy, not this DPA.
  3. Where the Tenant is itself a processor for another controller, GenFleet is its subprocessor, and the Tenant confirms it is authorised to appoint GenFleet.

3. Details of processing

Annex 1 describes the subject matter, nature, purpose, duration, data categories and data subjects.

4. Tenant's obligations

The Tenant:

  1. has a lawful basis for the processing and for its instructions, including any consent the Egyptian PDPL requires;
  2. gives its end customers the notices the law and each channel require, including that an AI agent and service providers are involved;
  3. obtains any licence, permit or registration it needs from Egypt's Personal Data Protection Center, including for cross-border transfers;
  4. does not send sensitive personal data, or children's data, through the Service without a separate written agreement with GenFleet;
  5. configures its agents, tools and the list of sites each agent may contact so they only process and send data it is entitled to;
  6. turns on agent memory about its end customers only after accepting the agreement shown in the Service, which confirms that it has a lawful basis to keep that information, has told its end customers, and will act on their requests. Turning the setting on or off is an instruction under section 5.1. Facts an agent saves go into the agent's general memory and are not linked to one end customer, so the Tenant must not let agents save end customers' personal details that way.

5. GenFleet's obligations

GenFleet will:

  1. Instructions. Process Customer Personal Data only on the Tenant's documented instructions, including instructions on transfers to third countries (section 7) (GDPR Art. 28(3)(a)). The Terms, this DPA, and the Tenant's configuration of the Service (its agents, tools, channels and settings) are those instructions. GenFleet will tell the Tenant if it believes an instruction breaks the law. GenFleet may process data without instructions only where the law requires it, and will tell the Tenant first unless the law forbids it.
  2. No other use. Not sell Customer Personal Data, and not use it for its own purposes, including not to train AI models. The Tenant instructs GenFleet to do two things as part of securing and improving the Service:
    • keep a security message log (message text, sender ID and time) for 12 months, encrypted and open only to authorised staff, to investigate attacks, abuse and incidents;
    • keep short excerpts of conversations as safety examples, after removing names, phone numbers and other identifiers, to write and test the Service's safety rules. Safety examples are never taken from Meta channels and never used to train AI models. The Tenant may opt out of safety examples by emailing privacy@genfleet.ai.
  3. Confidentiality. Ensure that staff and contractors who can access Customer Personal Data are bound by confidentiality.
  4. Security. Apply the measures in Annex 2.
  5. Records. Keep a record of processing activities as Article 5 of the Egyptian PDPL and Article 30(2) GDPR require.

6. Subprocessors

  1. The Tenant gives general authorisation for GenFleet to use subprocessors of the types described on the Subprocessors page (Annex 3). GenFleet will send the Tenant the current named list, with each subprocessor's location, on request to privacy@genfleet.ai. The Tenant will keep that list confidential.
  2. GenFleet will give at least 30 days' notice of a new or replacement subprocessor by email to account owners. The notice names the subprocessor and says what it will do and where. The Tenant may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Tenant may end the affected part of the Service and get a pro-rata refund of prepaid fees for it.
  3. GenFleet will bind each subprocessor to data protection terms that protect Customer Personal Data. Where a subprocessor offers only its standard terms, those terms apply. The Subprocessors page summarises the data terms by type of provider, and GenFleet will share the details on request.
  4. GenFleet remains responsible for its subprocessors' performance.
  5. Services the Tenant chooses. When the Tenant connects a messaging channel (for example WhatsApp, Messenger, Instagram, Telegram, Slack or Discord), the channel provider processes messages under its own terms with the Tenant (or with the Tenant's end customer). Those providers are not GenFleet's subprocessors for that processing.
  6. The Tenant's own model provider keys. When the Tenant uses its own key for an AI model provider, that provider processes data under the Tenant's own agreement with it, and is not GenFleet's subprocessor for that processing.

7. International transfers

  1. Customer Personal Data may be processed outside the country where it was collected, including where subprocessors operate (see Annex 3). AI model providers in particular mostly operate outside Egypt.
  2. Egypt. Under PDPL Art. 14, transfers outside Egypt require a licence or permit from the Personal Data Protection Center, and the destination must give protection at least as strong as Egyptian law. Art. 15 allows exceptions, including with the data subject's explicit consent, for listed purposes. Art. 16 covers transfers to another controller or processor abroad.
  3. EU/UK. GenFleet does not offer the Service to people in the EU or the UK. Annex 4 sets out what happens if a Tenant needs to transfer EU or UK personal data.

8. Data subject requests

  1. GenFleet will tell the Tenant without undue delay if it receives a request from a data subject about Customer Personal Data, and will not respond itself except to direct the person to the Tenant.
  2. GenFleet will help the Tenant respond to access, correction, deletion, restriction and objection requests, taking into account the nature of the processing. Under PDPL Art. 10 and 32, a request must be answered within 6 working days of receipt. A refusal must give reasons, and silence counts as refusal under Art. 10.
  3. The Tenant can itself delete:
    • a dashboard conversation, or messages in it;
    • a single fact saved in an agent's memory;
    • an agent, which deletes all of that agent's conversation memory, reference documents and task progress;
    • a channel connection, which deletes its stored contact list and message records. Meta channels (WhatsApp, Messenger, Instagram) are disconnected by GenFleet on request, under section 8.4.
  4. To delete one end customer's data across an agent, the Tenant emails GenFleet at privacy@genfleet.ai, giving the channel and the end customer's identifier on it. GenFleet staff carry out the request within 30 days of receipt. This deletes the end customer's conversation history, task progress, channel records and approval records. Facts in an agent's general memory and content in reference documents are not linked to one person; until this is automated, GenFleet staff search them for the identifiers given, delete what clearly relates to the end customer, and tell the Tenant what they found.

9. Personal data breaches

  1. GenFleet will notify the Tenant without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
  2. The notice will include what GenFleet knows at the time: the nature of the breach, categories and approximate numbers of people and records, likely consequences, measures taken or proposed, and a contact point. GenFleet will add information as it becomes available.
  3. The Egyptian PDPL requires the controller and processor to notify the Personal Data Protection Center within 72 hours and the affected data subjects within 3 working days of that notice. GDPR requires the controller to notify the supervisory authority within 72 hours where required. The parties will cooperate to meet these deadlines. Where GenFleet must notify the Center itself, it will tell the Tenant first, unless the deadline does not allow it.

10. Assistance

GenFleet will help the Tenant with its data protection impact assessments, prior consultations, and licence applications, as far as they relate to the Service. Standard help is free of charge. It covers answers to written questions about the Service, this DPA and its annexes, the subprocessor list, a security summary, copies of records GenFleet holds about the Tenant's data, and reasonable answers to a regulator's questions about the Service. Other help is charged at rates agreed in writing in advance. It covers drafting the Tenant's own DPIA, preparing its licence applications, on-site audits, and custom contract changes.

11. Deletion and return at the end

  1. When the Service ends, the Tenant may request an export of its Customer Personal Data within 30 days. GenFleet will prepare the export and send it to the Tenant.
  2. After that, GenFleet will delete Customer Personal Data within 30 days, except where the law requires it to keep some.
  3. Backups are kept for up to 14 days and are overwritten on that cycle. Deleted data disappears from backups when they expire.
  4. GenFleet keeps the audit trail of workspace actions, usage records, the record of which terms were accepted, and the Tenant's legal name after the workspace is deleted, for the periods on the Data Retention and Deletion page.

12. Audits

  1. GenFleet will make available the information needed to show compliance with this DPA.
  2. The Tenant may audit GenFleet once a year, with at least 30 days' notice, during business hours, at its own cost, and under confidentiality. The Tenant should first rely on documents and written answers. On-site audits are allowed where the law requires or after a breach.
  3. GenFleet will also allow inspections by the Egyptian Personal Data Protection Center as the law requires.

13. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where Applicable Data Protection Law does not allow those limits.

14. Order of precedence

On personal data, this DPA prevails over the Terms. The Standard Contractual Clauses, where they apply, prevail over this DPA.

Annex 1: Details of processing

Item Details
Subject matter Hosting and running the Tenant's AI agents and connecting them to messaging channels and AI models
Nature Collection, storage, retrieval, transmission to AI model providers, generation of responses, sending of messages, security logging, de-identification of safety examples, deletion
Purpose Providing and securing the Service for the Tenant under the Terms, including the security log and safety examples in section 5.2
Duration For the term of the Terms, then until deletion under section 11
Data subjects (a) The Tenant's end customers who message its agents on connected channels; (b) the Tenant's staff who use the dashboard or talk to agents as operators; (c) any person named in content the Tenant uploads (for example, reference documents)
Categories of personal data Channel identifiers (WhatsApp phone number, and the IDs that Messenger, Instagram, Telegram, Slack and Discord assign to a person or chat); display or profile names; message text; references to media (media files are not downloaded); ad-referral data attached to a message; conversation history and facts stored as agent memory; progress of agent tasks; details of tool requests and their results; content of reference documents; dashboard chat messages
Sensitive data None by default. Only under a separate written agreement (section 4.4). Sensitive data may still appear in messages by accident; the Service does not filter it out.
Frequency Continuous
Retention As described in the Data Retention and Deletion page

Annex 2: Technical and organisational measures

These describe what the platform does today. GenFleet will not reduce the overall level of protection during the term.

Isolation

  • Each tenant's agent code runs in a separate sandbox.
  • Data is kept separate per tenant, and the platform checks which tenant a request belongs to rather than trusting the caller.
  • Each agent can only reach the external sites on its allow-list.

Access control

  • Role-based access within each workspace (owner, admin, developer and member roles).
  • Passwords are stored only as one-way hashes. Invitation, password-reset and re-confirmation codes are also stored as hashes and expire.
  • Sensitive admin actions and tool approvals require the user to confirm their identity again.
  • Limits on repeated sign-in attempts.
  • Production databases are not exposed to the internet. Admin tools are reachable only over a private network.

Encryption

  • Encrypted connections (TLS) for all public traffic.
  • Channel, connector and model-provider credentials are encrypted at rest.

Logging and monitoring

  • A tamper-resistant audit trail of security-relevant tenant actions.
  • An encrypted security message log, kept 12 months, open only to authorised staff.
  • Operational logs and metrics, kept 7 days (logs), 3 days (traces) and 15 days (metrics). Logs may be archived for up to 24 months. Summary statistics that identify no one are kept indefinitely.

Resilience

  • Nightly backups of the platform's databases, kept 14 days.

Model providers

  • On GenFleet's AI gateway, every call through the model router goes only to model hosts that do not collect data and keep no copy of it, from a fixed list GenFleet approves, with no fallback outside it. Hosts that keep or train on prompts can only be configured for internal test workspaces.
  • Other model calls go directly to the providers in Annex 3, under the terms listed there.

People

  • Access to production systems and Customer Personal Data is limited to staff who need it for their role.

Annex 3: Subprocessors

See the Subprocessors page, which forms part of this DPA.

Annex 4: Standard Contractual Clauses

Not used at present. GenFleet does not offer the Service to people in the EU or the UK. A Tenant that needs to transfer EU or UK personal data to us should contact us first, and we will agree the EU Standard Contractual Clauses and the UK Addendum before any such transfer.