Data Processing Agreement (DPA)
Last updated: 4 October 2026
In short. We process your customers' conversations and contact records only on your instructions and only to operate the service. This agreement describes what exactly we do with such data, who we involve and what we must do at your request. It is part of the terms of use and applies from the moment of registration, including on the free plan.
1. Parties and subject matter
This agreement is made between the customer of the dmhive service (the "customer", "you") and Individual Entrepreneur Valentin Nazarenko, registration number 300421933, Georgia, Tbilisi, Nadzaladevi District, Tsotne Dadiani Street, N34, Building N7, Block N10, Commercial Space (the "we", "processor"). Subject matter: processing personal data of the customer's contacts and other individuals whose data the customer submits to the service, in the course of providing the services under the terms of use.
2. Roles
With respect to contact data (people who write to the customer in messengers) and data from conversation archives uploaded by the customer, the customer is the operator (controller) and we are the processor: we process this data on your instructions and on the basis of this agreement. You determine the purposes and means of processing. With respect to your own account data, we act as an independent operator, see the privacy policy.
3. Customer instructions
We process data only on your documented instructions. Instructions include this agreement, the terms of use, your account settings, the bot scenario you publish, operator actions in the inbox and your support requests. By accepting this agreement you also instruct us to use an uploaded archive within its retention period to check and improve the quality of analysis (section 8). If, in our view, an instruction infringes the law, we will tell you before carrying it out.
4. Categories of data subjects and data
- the customer's contacts in messengers: messenger identifier and name, username, avatar, message text and attachments, message timestamps, the state of the dialogue with the bot;
- individuals mentioned in uploaded conversation archives: message content to the extent it remains after automatic cleanup of known fields (phone numbers, emails, links, long numbers, participant names); free-form addresses and names within the text may remain;
- the customer's staff replying in the inbox: the text of their replies and timestamps;
- the customer's buyers who sent a payment receipt: images and PDFs of payment documents (the payer's and recipient's names, part of an account number, amount, date). Purpose: checking payment for an order on the customer's instructions. Only images and PDFs sent in reply to a payment request in the customer's bot chat are stored; we do not store other attachments.
The service is not intended to process special categories of data (health, religion, political views and similar); if such data ends up in a conversation, the customer is responsible for the lawful basis for processing it.
5. Retention period
For as long as your account is active. An uploaded archive is kept for no longer than 7 days from upload, on the server and on a dmhive work computer, and is then deleted automatically. A payment receipt file is kept while the order is open and for 30 days after it is closed (paid or cancelled), but no longer than 90 days from receipt; a receipt without an open order is kept for 30 days. The file is encrypted, stored on a server in Germany, not included in backups, and visible only to the customer's account owner. Inbox conversations are kept for 90 days from the message date. When an account is deleted, data is removed from production systems immediately, and backups are overwritten within 35 days.
6. Our obligations
- confidentiality: only people bound to keep it, and only to the extent needed to operate the service, have access to the data; conversations are not read manually, except when you have asked us for help, an incident is being investigated, the law requires it, and for spot checks of quality-check results within the archive retention period (section 8);
- security: transmission over secure channels, messenger access tokens stored encrypted, passwords stored only as an irreversible hash, customer workspaces isolated from each other, access granted on the principle of least privilege;
- incidents: we notify you of a security breach affecting your data without undue delay and no later than 72 hours from when we became aware of it, describing the nature of the incident, the data affected and the measures taken;
- data subject requests: we help you fulfil contacts' requests for access, correction and deletion using the app's tools (deleting a contact from the inbox, a copy of the data, deleting the account) and by email to privacy@dmhive.io; requests received directly by us are forwarded to you;
- end of processing: when an account is deleted, data is deleted as described in section 5 and on the "Data deletion" page; before deletion you can download a copy of your data in the app;
- audit: on request we provide the information necessary to confirm compliance with this agreement, within a reasonable time and without disclosing other customers' data.
7. Subprocessors
You give general authorisation to engage the following subprocessors:
| Provider | What it does | Country |
|---|---|---|
| Hetzner Online GmbH | servers and database storage | Germany |
| Cloudflare, Inc. | site delivery network, protection, storage of early-access form submissions; daily database backups in R2 (EU jurisdiction), encrypted with our key before upload | USA, EU |
| OpenAI, L.L.C. | building the scenario from an anonymised extract of the archive, processing the owner's note text and reviewing inbox conversations the owner marked, after anonymisation; under its API terms does not use data for training, retains abuse logs for up to 30 days | USA |
| Google LLC (Gemini API) | AI-node replies only in the public demo simulator on the free plan; Google may use the input to improve its services; simulator conversations in customer projects and customer bots in messengers do not run through Gemini | USA |
| Zoho Corporation (Zoho Mail) | sending app emails: address confirmation, password recovery, notifications | EU |
| Telegram | delivering bot messages and owner notifications; an independent platform with its own terms | per platform rules |
We notify you of any change to this list in the app's interface and on this page, noting the revision date. If you object, you may stop using the service and delete your account before the change takes effect. The payment provider Paddle is not a subprocessor: it is an independent operator of payment data.
8. Additional purposes
Within the retention period (section 5) we use an uploaded archive to check and improve the quality of analysis: we measure how fully the service finds questions, prices and facts, spot-check the results and adjust our own analysis instructions. This is part of providing the services on your instructions (section 3). Once the archive is deleted, only anonymised findings remain: statistics and typical questions without names, contact details or other data that could identify a person. You can opt out by email to privacy@dmhive.io; this does not affect the provision of the services.
Training models on your archives and conversations, publishing case studies and any purpose other than providing the services require your separate written consent. Such consent is given for a specific purpose, may be withdrawn by email to privacy@dmhive.io, and withdrawing it does not affect the provision of the services.
9. Cross-border transfer
Data, including receipt files, is stored in Germany. A copy of an uploaded archive used for quality checks is processed on a dmhive work computer in Georgia and deleted within the period in section 5. Subprocessors in the USA receive only what is described in section 7. Transfer is carried out on the basis of contractual data protection safeguards required by applicable law, including standard contractual clauses where they apply.
10. Customer obligations
- have a lawful basis for processing contacts' data and notify them to the extent required by law, including that a bot is communicating with them;
- upload to the service only conversations you are entitled to submit for processing; authorisation is confirmed with every upload;
- do not enter contacts' personal data into the AI-node simulator of the public demo;
- fulfil contacts' requests using the app's tools or forward them to us.
11. Term and acceptance
This agreement is accepted at registration, at first sign-in through an external service and with every archive upload; we record the version of the agreement and the moment of acceptance. It applies for as long as the account is active and terminates on its deletion, except for obligations that by their nature survive. We notify you of changes in the app's interface and on this page; the next time you sign in you will see the new version and can accept it or delete your account. Continued use means acceptance of the new version.
12. Contacts
Personal data: privacy@dmhive.io
General questions: support@dmhive.io
Phone: +995 591 06 95 19