What a DPA actually is

A Data Processing Agreement (DPA) is a contract between your business and a company that handles personal data for you. You decide why the data is collected. They process it on your behalf. The contract says what they are allowed to do with it, how they protect it, and what happens when you want it deleted.

If you have customers in Europe, GDPR says you need this kind of contract when someone else processes personal data for you. Other privacy laws, including the CCPA in California, expect something similar even when they use a different name.

Where a chat message goes

A visitor's message can pass through your website, ChatNexus, and the AI company that writes the reply. ChatNexus uses Groq, OpenAI, and xAI. Each of those is another company in the chain. Your privacy policy should say that in normal language, and your DPA should name them too.

You can read the ChatNexus agreement on the Data Processing Agreement page.

What goes wrong if you skip it

Privacy regulators can fine companies that process personal data without the right paperwork. The headline numbers are large. The problem most small teams hit first is simpler: a customer asks for a signed DPA before they will use the bot, and you do not have one. If something leaks, you also have no written agreement about who was supposed to do what.

What to put in the agreement

1. What the other company is allowed to do

Be specific. "Take the visitor's message and return an AI reply" is clear. "Improve our services" is how arguments start later.

2. What might be in the chat

Free text can include a name, a health detail, or a card number, depending on what you ask people. Also mention session IDs, IP addresses, and files if you let people upload them.

3. Who else sees it

For a ChatNexus bot, that includes the model provider behind the agent you picked (Groq, OpenAI, or xAI). Check that provider's own data policy. Some AI companies use API chats to train models unless you are on a plan that turns that off. If they do, say so in your privacy policy.

4. How long chats are kept

Say how long conversation data is stored and how someone can ask for it to be deleted. Under GDPR, people can ask you to erase their data.

5. How it is protected

Cover the basics: encryption while data is moving and while it is stored, who on your team can open it, and how quickly you will be told if something goes wrong. GDPR's usual window for reporting a breach is 72 hours.

How this works on ChatNexus

You do not start a DPA from Settings. When you create an agent, ChatNexus asks five short questions. Most FAQ and support bots do not need a DPA. Agents built from the healthcare intake or property management templates are the ones most likely to need one.

You will be asked to complete one if you answer yes to any of these:

• The agent will handle health data
• It will handle tenant histories or tenancy screening
• It will handle bank details or card numbers
• You are a regulated organisation, such as a health provider, a tenancy database operator, or a government contractor

You also need one if the agent will collect personal information and you do not already have the visitor's consent. If the bot only answers public FAQs and never asks for personal details, choose Will not collect personal information and you can continue without a DPA.

If a DPA is required, you cannot finish creating that agent until it is approved. You can generate the PDF in the app and sign it there, or upload a signed file (PDF, JPG, PNG, or WebP, up to 10 MB). You can leave and come back later. The dashboard shows a banner until it is done. We review the request and email you.

A short checklist

• List every service that receives your visitors' chats, including ChatNexus and the model provider.
• Have a DPA with each of them when the law says you need one.
• Say in your privacy policy what the chat stores and who else sees it.
• Make sure people can ask you to delete their chat history.
• Look at it again when you change model providers or start collecting a new kind of data.

Business customers often ask for a signed DPA before they switch a bot on. The ChatNexus questions catch that while you are still setting the agent up. They do not replace advice from your own lawyer if the use case is unusual.