Version 2.0 - Effective Date: 08 May 2026
Replaces all previous versions. Includes Schedule 1: Data Processing Agreement.
Legal Notices: These Terms explain how the dottyanddash.ai Service works, what you are agreeing to when you subscribe, and how data and security are handled. Schedule 1 below constitutes the Data Processing Agreement between the parties and forms an integral part of these Terms.
dottyanddash.ai provides an AI-driven property enquiry response system that:
The Service works 24/7 and is designed to help your agency respond faster than competitors, increasing viewings, conversations, and instructions.
Monthly plan. Your subscription is rolling month-to-month. Billing begins from the date agreed at sign-up. You may cancel at any time with 30 days' written notice. Cancellation takes effect at the end of the billing period following the 30-day notice window.
Annual plan. Annual subscribers commit to an initial 12-month term, billed annually from the agreed start date. After the initial 12-month term, the subscription continues on a rolling annual basis and may be cancelled with 90 days' written notice. Cancellation takes effect at the end of the annual billing period following the 90-day notice window.
Pricing Notes: The standard subscription fee applies regardless of a reduced feature scope. In good faith we may offer promotional discounts, but pricing is fixed once agreed.
You are responsible for connecting and providing access to your email account and social channels used with the Service, including but not limited to:
You are also responsible for ensuring:
We act as a data processor for data you supply; you are the data controller. We do not accept responsibility for compliance or consent issues arising from your data. The formal allocation of responsibilities between the parties as controller and processor is set out in Schedule 1 (Data Processing Agreement) below.
To deliver the Service, greetAI Ltd engages third-party sub-processors who may access, store, or process personal data on our behalf. By agreeing to these Terms you provide general written authorisation for us to engage these sub-processors, in accordance with Schedule 1, Clause 5. We will give you 30 days' written notice before adding any new sub-processor that processes personal data relating to your clients or leads.
| Sub-Processor | Purpose | Transfer Mechanism |
|---|---|---|
| High Level (GoHighLevel) | CRM, automated messaging, pipeline management, and workflow automation used to manage leads and communications on your behalf. | UK Addendum to EU SCCs |
| Cloudflare (Pages, Workers, KV) | Content delivery network, edge computing (Workers), key-value storage (KV), and application hosting infrastructure. Processes traffic including personal data in transit. | UK IDTA; EU adequacy where applicable |
| Anthropic (Claude) | AI language model powering intelligent conversation, lead qualification, and automated response generation within the Service. | UK IDTA |
| AI voice provider | AI voice synthesis used to generate natural-sounding voice responses for voice agent interactions. Processes conversation content including caller details where voice channels are active. | UK IDTA |
| Application hosting (Replit) | Cloud application platform used to host and run the dottyanddash.ai application and securely store associated data. | UK IDTA |
| Property data extraction | Automated property data extraction from agency websites and email. Used to parse and import property listings and enquiry data into the Service. | EU adequacy decision (UK-EU) |
| Rightmove extraction | Automated extraction of property listings from Rightmove. Used to sync live property data from Rightmove into the Service on your behalf. | EU adequacy decision (UK-EU) |
| Lead email parser | Automated parsing of incoming lead notification emails. Used to extract structured lead data from property portal and agency email notifications. | EU adequacy decision (UK-EU) |
We ensure that all sub-processors operate under appropriate data processing agreements and comply with UK GDPR requirements. A full sub-processor list including location, purpose, and transfer mechanism is maintained in Annex B to Schedule 1 below.
greetAI Ltd is committed to protecting the privacy of our clients and the individuals whose data flows through the Service. The full terms of our data processing obligations are set out in Schedule 1 (Data Processing Agreement) below, which forms a binding part of these Terms. The following is a summary of key principles. You should read this section alongside Schedule 1 and our Privacy Policy, and seek independent legal advice if you require further guidance on your own obligations.
What is the UK GDPR? The UK GDPR is the retained version of Regulation (EU) 2016/679 as incorporated into UK law following Brexit. It applies to the processing of personal data and gives individuals greater control over how their data is used. UK businesses must comply with its provisions, supplemented by the Data Protection Act 2018.
Controller & Processor Roles.
Data Retention & Deletion (Data Retention Schedule):
To request a data export or erasure, contact us. We will respond within 5 business days.
International Data Transfers. Some sub-processors operate infrastructure outside the UK, including in the United States. Where such transfers occur, we utilise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable. Full details are set out in Annex B to Schedule 1.
Data Security.
We implement reasonable technical and organisational measures to protect your data against accidental loss, unauthorised access, destruction, or disclosure. However:
We may allocate phone numbers, messaging channels, or other identifiers to help the Service work. You agree that:
Cancellation Notice Periods:
All cancellation notices must be submitted in writing by email. Verbal or in-app cancellations are not accepted. We will confirm receipt of your notice in writing within 5 business days.
We (and our licensors) own all rights to the dottyanddash.ai technology, software, and platform. You retain all rights to your data and content but grant us a limited licence to use it solely for the purpose of delivering the Service. Neither party may use the other's intellectual property outside of this agreement without prior written consent.
To the maximum extent permitted by law:
Carve-outs - the 12-month cap does not apply to:
These Terms (including Schedule 1) are governed by the laws of England and Wales and disputes shall be resolved exclusively in the courts of England and Wales.
We may update these Terms (including Schedule 1) to reflect changes in law, our services, or our data processing practices. We will notify you of material changes in writing with at least 30 days' notice before the changes take effect. Where changes are required to comply with applicable law, shorter notice may be given. Continued use of the Service after the effective date of any updated version constitutes acceptance of the new terms.
For general questions about these Terms or the Service, or for data & privacy queries, contact us.
Address: 59b Halliford Street, Islington, N1 3EQ
Version 1.0 - Effective Date: 08 May 2026
This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between greetAI Ltd ("Processor") and the subscribing agency ("Controller") and governs the processing of personal data by the Processor on behalf of the Controller in connection with the dottyanddash.ai Service. It is intended to satisfy the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR").
In this DPA, the following terms have the meanings given below. Terms not defined here have the meanings given to them in the UK GDPR and the Data Protection Act 2018.
2.1 Subject matter. The Processor shall process personal data on behalf of the Controller for the purpose of providing the dottyanddash.ai Service as described in these Terms and further detailed in Annex C.
2.2 Duration. This DPA commences on the date the Controller accepts these Terms and continues for the duration of the Service subscription. Upon termination or expiry of the subscription, the Processor shall continue to hold personal data for the retention periods set out in Section 5 of the main Terms, after which it shall delete or return personal data in accordance with Clause 8 of this DPA.
2.3 Nature of processing. The processing activities are further described in Annex C (Description of Processing).
3.1 Types of personal data processed include:
3.2 Categories of data subjects include:
The Processor shall comply with all obligations imposed on a processor under Article 28(3) UK GDPR. In particular:
4(a) - Documented Instructions. The Processor shall process personal data only on documented instructions from the Controller, as set out in these Terms and any written instructions provided by the Controller during the term. If the Processor is required to process personal data by applicable law, it shall notify the Controller before carrying out that processing unless prohibited by law. The Processor shall promptly notify the Controller if, in its opinion, any instruction infringes Data Protection Laws.
4(b) - Confidentiality. The Processor shall ensure that persons authorised to process the Controller's personal data are subject to binding written confidentiality obligations (whether under their employment contract or a separate agreement) and are made aware of the confidential nature of the data. The Processor shall limit access to personal data to those personnel who need access to carry out their duties in connection with the Service.
4(c) - Security. The Processor shall implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to individuals. The Processor's current TOMs are set out in Annex A to this DPA.
4(d) - Sub-Processors. The Processor shall not engage any new sub-processor without giving the Controller at least 30 days' prior written notice, identifying the sub-processor and the nature of the processing. The Controller may object to the engagement of a new sub-processor on reasonable, documented grounds relating to Data Protection Laws by notifying the Processor in writing within the 30-day notice period. Where the Controller objects and the parties cannot resolve the objection within a further 30 days, either party may terminate the affected portion of the Service on written notice without penalty. The Processor shall impose equivalent data protection obligations on all sub-processors by way of written contract and shall remain fully liable to the Controller for the performance of any sub-processor's obligations. The current list of sub-processors is maintained in Annex B to this DPA.
4(e) - Assistance with Data Subject Rights. The Processor shall provide reasonable assistance to the Controller in responding to DSARs and other data subject rights requests (including rights of access, rectification, erasure, restriction, portability, and objection), taking into account the nature of the processing. Where the Processor receives a DSAR directly from a data subject relating to personal data processed under this DPA, it shall: (i) notify the Controller within 5 business days; and (ii) not respond to the data subject directly without the Controller's written authorisation, unless required to do so by law. The Processor shall action the Controller's instructions in relation to any DSAR within the timeframes required by applicable law.
4(f) - Assistance with Security, Breaches, DPIAs, and Prior Consultation. The Processor shall provide reasonable assistance to the Controller in ensuring compliance with its obligations under Articles 32-36 UK GDPR, including in relation to: (i) security of processing; (ii) notification of personal data breaches to the ICO and affected data subjects; (iii) data protection impact assessments; and (iv) prior consultation with the ICO where required. In the event of a Personal Data Breach affecting personal data processed under this DPA, the Processor shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of the breach. The notification shall include, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences of the breach, and the measures taken or proposed to address it.
4(g) - Deletion or Return at End of Contract. Upon termination or expiry of the subscription, and at the Controller's choice, the Processor shall either: (i) return all personal data processed under this DPA to the Controller in a commonly used machine-readable format; or (ii) securely delete all personal data processed under this DPA, in each case within the timescales set out in Section 5 of the main Terms. The Processor shall also instruct its sub-processors to delete or return personal data in accordance with this clause. The Processor shall provide the Controller with written confirmation of deletion upon request. This obligation does not apply to personal data that the Processor is required to retain by applicable law.
4(h) - Audit Rights. The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor, subject to the following conditions: (i) the Controller shall give the Processor at least reasonable prior written notice of an intended audit; (ii) audits shall be conducted no more than once per calendar year unless there has been a confirmed Personal Data Breach or a regulatory requirement for more frequent inspection; (iii) audits shall be conducted during normal business hours and in a manner that minimises disruption to the Processor's operations; and (iv) the Controller's right to audit may, at the Processor's option, be satisfied by the Processor providing its current TOMs document (Annex A) together with written responses to reasonable compliance questions from the Controller or its auditor.
The Controller provides general written authorisation for the Processor to engage the sub-processors listed in Annex B as at the effective date of this DPA. The Processor may not add new sub-processors that process personal data relating to the Controller's clients or leads without complying with the 30-day notice requirement in Clause 4(d). The Processor shall impose data processing terms on all sub-processors that are no less protective than those set out in this DPA and shall remain liable for any breach of this DPA caused by a sub-processor's acts or omissions.
Where the processing of personal data involves a transfer of that data outside the UK to a country not benefiting from a UK adequacy regulation, the Processor shall ensure such transfer is made under an appropriate transfer mechanism as set out in Part 3 of the UK GDPR and the Data Protection Act 2018. The Processor shall use, where applicable, the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses (as updated by the ICO from time to time). The specific transfer mechanism applicable to each sub-processor is identified in Annex B to this DPA. Transfers within the EEA or to countries benefiting from an EU or UK adequacy decision are governed by the applicable adequacy framework.
In the event of a confirmed or suspected Personal Data Breach, the Processor shall:
The Controller is responsible for notifying the ICO within 72 hours of becoming aware of a notifiable breach, where required by Article 33 UK GDPR. The Processor's breach notification is intended to give the Controller sufficient time to assess and, where necessary, notify the ICO within the required window.
This DPA is governed by the laws of England and Wales. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales. In the event of any conflict between this DPA and the main Terms, the provisions of this DPA shall prevail in relation to the processing of personal data.
As referenced in DPA Clause 4(c) and 4(h). These measures represent the Processor's current security posture as at the effective date of this DPA.
A.1 Access Control
A.2 Encryption
A.3 Network & Infrastructure Security
A.4 Data Integrity & Availability
A.5 Personnel Measures
A.6 Incident Management
A.7 Physical Security
As referenced in DPA Clauses 4(d) and 5. Current as at 08 May 2026. The Controller will be given 30 days' written notice of any additions or material changes.
| Sub-Processor | Purpose | Personal Data Accessed | Transfer Mechanism |
|---|---|---|---|
| High Level (GoHighLevel) | CRM, pipeline management, automated messaging, and workflow automation | Name, email, phone, conversation content, lead status | UK Addendum to EU SCCs |
| Cloudflare (Pages, Workers, KV) | CDN, edge computing, key-value storage, and application delivery infrastructure | IP address, request metadata, data in transit through edge network | UK IDTA; EU adequacy for EEA processing |
| Anthropic (Claude) | AI language model for conversation generation, lead qualification, and automated responses | Conversation content, property preferences, contact context | UK IDTA |
| AI voice provider | AI voice synthesis for voice agent interactions | Conversation content, caller context passed to voice synthesis engine | UK IDTA |
| Replit | Cloud application hosting and development platform | All personal data stored within the application database | UK IDTA |
| Property data extraction | Automated data extraction from agency emails and websites | Email content, property listing data, enquiry contact details | EU adequacy decision (UK-EU bridge) |
| Rightmove extraction | Automated extraction of property listings from Rightmove | Publicly listed property data (no lead personal data) | EU adequacy where applicable |
| Lead email parser | Automated parsing of lead notification emails from property portals | Lead email content including name, email, phone, enquiry details | EU adequacy where applicable |
This list will be updated when sub-processors are added or removed. The most current version is always the one attached to these Terms.
As referenced in DPA Clause 2. This Annex provides a formal description of the processing carried out by the Processor on behalf of the Controller.
C.1 Subject Matter of Processing. The provision of an AI-powered lead capture, qualification, response, and routing service for the Controller's estate agency, operating across the channels selected by the Controller at signup and as activated from time to time during the subscription.
C.2 Duration of Processing. The duration of the Controller's subscription, plus the applicable retention period following termination as set out in Section 5 of the main Terms and DPA Clause 2.2.
C.3 Nature and Purpose of Processing. The Processor carries out the following processing activities on behalf of the Controller:
C.4 Types of Personal Data. As set out in DPA Clause 3.1 above.
C.5 Categories of Data Subjects. As set out in DPA Clause 3.2 above.
C.6 Special Categories of Personal Data. The Service is not designed or intended to collect special categories of personal data as defined in Article 9 UK GDPR. The Controller must not input or cause to be processed through the Service any special category data without prior written agreement from the Processor. Where special category data is inadvertently received, the Processor will notify the Controller and delete such data promptly.
C.7 Controller's Instructions. The Processor's documented instructions are: to receive, store, process, and transmit personal data solely for the purposes set out in C.3 above, in accordance with the configuration settings established by the Controller within the Service, and in compliance with Data Protection Laws. The Controller may issue further written instructions via email during the term of the subscription.
For questions about this DPA, Annex A, B, or C, or for legal notices or cancellations, contact greetAI Ltd.
greetAI Ltd, 59b Halliford Street, Islington, N1 3EQ, Company No. 16393572.
This Privacy Policy explains how greetAI Ltd ("we", "us") collects, uses, stores, and protects personal data when you use the dottyanddash.ai service (the "Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
When you sign up or use our Service, we may collect:
We use your personal data to:
We process your data based on the following lawful grounds:
When you use the Service to handle property enquiries:
We may share your data with:
We do not sell your personal data to third parties.
We retain your data for as long as:
After account closure, we will delete or anonymise your data within a reasonable period, except where retention is required by law.
We implement appropriate technical and organisational measures to protect your data, including:
No system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact us. We will respond within 30 days.
We use essential cookies to keep you logged in and to ensure the Service functions correctly. We do not use third-party tracking or advertising cookies.
Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (such as the UK IDTA or UK Addendum to the EU Standard Contractual Clauses).