Legal · DPA
Data Processing Agreement
Lithi Data Processing Agreement covering processing scope, data categories, subprocessors, security, and retention.
On this page
Data processing terms
Last Updated: August 12, 2026
This public agreement source describes proposed processing terms between a customer and Lithi. It covers scope, data categories, suppliers, security measures, retention, rights, transfers, and breach notification. The product, provider, security, and timing statements still require legal and operational reconciliation. Review the complete agreement with your legal adviser and request the current customer-specific terms before relying on this source, because an executed agreement governs the parties.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Battery Department LLC, trading as Lithi Technologies ("Processor") and you ("Controller").
Contents
- Definitions and scope
- Data categories
- Sub-processors
- Security measures
- Retention and rights
- Transfers and breach notification
- Contact and related policies
- Reconciliation status
- Primary action
Reconciliation status
| Field | Record |
|---|---|
| Scope | This public DPA source and the processing terms it describes. |
| Status | Legal and operational reconciliation is required before publication or customer reliance. |
| Owner | Lithi legal and privacy |
| Evidence | The current source, product authority, provider register, security evidence, and executed customer agreement. |
| Last reviewed | 2026-08-11 |
| Limitation | This public draft is not an executed agreement and does not establish current customer-specific processing. |
1. Definitions and Scope
“Personal Data” means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller through the Lithi platform. The Processor processes Personal Data solely to provide Lithi platform services, including chatbot conversation data, blog content publishing to the Controller’s CMS platforms, and analytics data such as widget interactions and page views.
2. Data Categories
- Visitor Data: Name, email, and phone number voluntarily provided via chatbot.
- Conversation Data: Chat messages, timestamps, and session identifiers.
- CMS Credentials: OAuth tokens and Application Passwords encrypted at rest.
3. Sub-Processors
The predecessor DPA lists Supabase Inc. (database hosting and authentication), Vercel Inc. (application hosting and CDN), Anthropic PBC (AI model inference and content generation), Twilio Inc. (SMS and voice), ElevenLabs Inc. (voice AI agents), Mapbox Inc. (geolocation), Google LLC (analytics and workspace), and Stripe Inc. (payment processing), each in the United States.
4. Security Measures
Security measures include AES-256 encryption at rest and TLS 1.3 in transit, Row Level Security on database tables, HMAC-SHA256 webhook signature validation, OAuth2 with scoped CMS permissions, and automatic credential revocation on disconnect.
5. Retention and Data Subject Rights
Conversation data is retained for 12 months and then anonymized. Lead data is retained for 24 months and then anonymized unless the Controller requests earlier deletion. CMS credentials are deleted immediately upon disconnection. Blog content is retained until the Controller deletes it through the admin portal. The Processor shall assist the Controller in fulfilling data subject requests (access, rectification, erasure, portability, objection) within 30 days of receipt.
6. Cross-Border Transfers and Breach Notification
Data is processed in the United States. For EU and UK data subjects, transfers are governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission. The Processor shall notify the Controller within 72 hours of becoming aware of a personal data breach.
7. Contact and Related Policies
Battery Department LLC, 68 Harrison Avenue, Suite 605, Boston, MA 02111. Email privacy@lithi.ai. To request a signed copy of this DPA, contact privacy@lithi.ai. Related policies: Privacy Policy, Terms of Service, and Cookie Policy.