Last updated: October 15, 2026 · This DPA forms part of the QueryWing Terms of Service.
For personal data of your end users / website visitors processed through the QueryWing platform (including chatbot conversations, leads, and Session Insights session replays and heatmaps), you (the customer) are the data controller and QueryWing is the data processor / service provider. QueryWing processes this data only to provide the Service under your documented instructions and does not sell it or use it for its own purposes.
QueryWing processes personal data for the duration of your subscription and as needed to provide the Service. On termination, data is deleted or returned in accordance with Section 8.
Hosting and operating AI chatbots, capturing and scoring leads, and — where enabled — recording and analyzing visitor behavior (pages, clicks, scrolling, navigation, and a masked DOM session replay) to help you improve your website. All text input is masked by default; Do-Not-Track and Global Privacy Control signals are honored; visitors can opt out.
Data subjects are your website visitors and end users. Data may include online identifiers (anonymous visitor/session IDs, IP address, device/browser), behavioral and interaction data, page content as rendered (with inputs masked), and any contact details a visitor voluntarily submits (e.g. via forms). You must not use the Service to intentionally collect special-category or sensitive data, and should exclude sensitive pages/fields from recording.
As controller, you are responsible for having a lawful basis, providing notice in your privacy policy, and obtaining consent where required (e.g. EU/UK ePrivacy and GDPR, and as advisable in the US). QueryWing provides a consent gate (data-consent="required" + window.qwInsightsConsent()) and opt-out (window.qwInsightsOptOut()) to help you comply.
QueryWing maintains appropriate technical and organizational measures, including encryption in transit, access controls, input masking, and data sampling. Personnel with access are bound by confidentiality.
QueryWing uses vetted sub-processors (e.g. cloud hosting, storage, and AI model providers) to deliver the Service, under contracts with data-protection obligations consistent with this DPA. A current list is available on request.
QueryWing will assist you, taking into account the nature of processing, in responding to data-subject requests (access, deletion, etc.), in security and breach notification, and in deleting or returning personal data at the end of the Service. You can delete session recordings and related data from your dashboard at any time.
Where personal data is transferred across borders, QueryWing relies on appropriate safeguards (such as Standard Contractual Clauses) where required by applicable law.
For a signed DPA, the sub-processor list, or any privacy question, contact support@querywing.com.