Data Processing Addendum

Roles

For the enquiry data an agency's AI front desk captures (the names, contact details and messages of people who contact the agency), the agency is the data controller and Mintleaf is the data processor. We process that data only on the agency's documented instructions, to deliver the service.

Our obligations

• Process captured enquiry data only to operate the agency's front desk and route leads to the agency.
• Keep data confidential and apply appropriate technical and organisational security.
• Use only the sub-processors needed to run the service, under contract — currently our hosting provider, Stripe (payments), and the language-model provider used to generate replies (Anthropic, or an OpenAI-compatible provider such as Groq).
• Assist with data-subject requests, and delete or return the data at the end of the engagement.
• Notify the agency without undue delay of any personal-data breach affecting its data.

Security

Data is held on access-controlled UK/EU infrastructure with encryption in transit. We collect only what is needed to capture and route an enquiry. Conversations are not used to train any model.

A signable DPA is provided as part of every engagement; this page summarises its terms.