The controller-to-processor terms for business customers, including transfer safeguards, security measures, breach timelines and the named subprocessor list.
For personal data a business customer puts into the platform — its own customers, leads, staff, chat transcripts and uploaded files — the customer is the controller and Characters as a Service is the processor.
For data we handle to run our own business — your account, billing, security logs, our own marketing — we are the controller and our Privacy Policy applies.
This Addendum is incorporated into the Terms of Service and takes effect when you start using the platform. No signature is required, though we will countersign a copy on request.
If a request reaches us about your customers, we will not answer it directly. We forward it to you within 5 business days and help you respond. Requests can be sent to privacy@charactersasaservice.com or through the deletion and opt-out pages in this Trust Center.
We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what happened, the categories and approximate numbers affected, the likely consequences and the steps taken. We keep an internal incident register and cooperate with your own notification duties.
Personal data may be processed in the United States and the European Union. For transfers out of the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum where the UK GDPR applies, plus a transfer impact assessment. Those clauses are incorporated here by reference, with Module Two (controller to processor) applying, and this Addendum supplying the required details.
The current list of subprocessors is published on this page and kept up to date. We will give notice of a new subprocessor before it starts processing your data; if you reasonably object on data-protection grounds you may terminate the affected service and receive a pro-rated refund for the unused period.
Personal data is kept while your account is active. After termination, customer records remain retrievable for 30 days, then are deleted within 90 days, except where we must keep records for tax, accounting or dispute purposes. Backups age out on their own cycle within 90 days.
On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the documentation we hold. Live access to production systems is not granted, because other customers' data sits in them.
Characters as a Service / Immersive Operating Layers, 9663 Santa Monica Blvd. #464, Beverly Hills, CA 90210
AI Your Business.™ Branded AI employees deployed 24/7 — guiding, engaging, educating & moving your business forward.
New character drops, industry stacks, and immersive launches — no spam, ever.