Data processing agreement

This agreement governs the processing of personal data under Article 28 GDPR, where the customer acts as the controller and AI Customer Care as the processor. Its subject matter is the operation of the AI assistant, the inbox and related features for the customer.

We process the content of conversations and contact identifiers of the customer's end customers solely in order to provide the service, for the duration of the subscription.

We process data only on documented instructions from the customer, ensure confidentiality of the people with access, apply technical and organisational measures (encrypted transport, access control, audit records), assist with data subject rights and report security incidents without undue delay.

The customer grants general authorisation for these categories of sub-processors: the application hosting, database and file storage provider; the AI gateway and language and embedding model providers (answers, translations, search index); providers of web reading services used when a website cannot be read directly; the social messaging platform (Facebook, Instagram, TikTok); Meta (WhatsApp Business); the payment provider; and the e-mail delivery provider. By name: Lovable (application hosting, the Lovable AI Gateway, e-mail sending); Supabase (database, sign-in and file storage within Lovable Cloud); Cloudflare (server runtime and DNS resolution when checking website addresses); Google (Gemini language model via the AI gateway – answers and translations); OpenAI (text-embedding-3-small via the AI gateway – search index); Zernio (Facebook, Instagram and TikTok connection); Meta Platforms (WhatsApp Business Cloud API, Facebook, Instagram); Stripe (payments); Firecrawl and Jina AI (reading websites that cannot be read directly). The processing region and data processing agreements with the individual providers are not yet documented; we will add them to this list once documented. We inform customers about changes to sub-processors.

Where data is transferred to third countries (typically with AI models and Meta services), it takes place under standard contractual clauses or another valid mechanism under the GDPR.

The workspace owner can export the data and request irreversible deletion in the workspace settings; deletion starts after a 7-day cancellation period. Deletion removes conversations, messages, contacts, attachments, the knowledge base including search indexes and related queues from our database and storage. Deletion after termination is scheduled manually by the platform administrator for 90 days after termination; the scheduled deletion is then carried out automatically by a background job. Cancelling the subscription alone does not trigger deletion. If you only want your data deleted, the workspace owner requests it in the workspace settings (it starts after a 7-day cancellation period); deletion does not end the subscription or billing – cancel those separately. Database backups held by the hosting provider cannot be edited individually and expire according to its retention period, which is not yet documented. Copies held by third parties (social networks, Meta, payments, web reading): on a deletion request we disconnect the channels and ask the providers to delete the data where their interface or support allows it, and we inform you of the result; for content in the customer's own account with a provider (e.g. its Facebook page) we provide assistance. Accounting records are kept as required by law. We confirm the deletion on request. Checks and audits can be carried out through documentation and written answers.

Contact point for this agreement: info@aicustomercare.app. A signed copy is available on request.