Personal data processing agreement

This agreement, entered into under Article 28 of the General Data Protection Regulation (GDPR), forms an integral part of the terms and conditions. It applies from the creation of the account.

1. Roles

• Controller: the Customer, a company subscribing to Tilavo.
• Processor: [To be completed: company name], publisher of Tilavo.

2. Description of the processing

• Purpose: providing a conversational assistant on the Customer's website, recording conversations, leads and appointment requests, and sending notifications to the Customer's team.
• Duration: duration of the subscription, plus 30 days to allow data export.
• Data subjects: visitors to the Customer's website who use the assistant; members of the Customer's team.
• Data: messages exchanged; name, email, phone, company, industry, need and preferred appointment date when provided; proof of consent; technical visitor identifier stored in their browser.
• Sensitive data: none is requested; the assistant is configured not to ask for it.
• Retention: period set by the Customer in Settings (24 months by default), followed by automatic deletion.

3. Processor obligations

1. Process data only on the Customer's documented instructions (Service configuration and this agreement).
2. Ensure the confidentiality of the people authorised to process the data.
3. Implement the security measures described in section 5.
4. Only use a sub-processor under the conditions of section 6.
5. Help the Customer respond to data subject requests (export, rectification and deletion available in the customer workspace).
6. Notify the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information needed for its own notification to the supervisory authority.
7. Assist the Customer, where applicable, with impact assessments and prior consultation of the supervisory authority.
8. At the end of the contract, delete the data after the export period, unless legally required to keep it.
9. Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits (30 days' notice, at most once a year, at the Customer's expense).

4. Customer obligations

The Customer has a legal basis for the processing, informs visitors to its website (privacy policy, notice of the automated assistant), sets an appropriate retention period and does not have sensitive data processed.

5. Security measures

• Each company's data is isolated at database level, verified by automated tests.
• Encrypted communications (HTTPS); secret keys kept on the server only.
• Strong password authentication and secure sessions.
• Request rate limiting and bot protection on public endpoints.
• Log of sensitive actions.
• Exchanges with the AI provider are not kept by it to train its models.

6. Authorised sub-processors

• Vercel Inc.: Application hosting (United States and European Union).
• Supabase Inc.: Database, authentication and file storage (Region chosen at setup).
• OpenAI, L.L.C.: Generating the assistant's answers and searching documents (artificial intelligence) (United States).
• Anthropic PBC: Generating the assistant's answers (alternative provider) (United States).
• Resend Inc.: Sending transactional emails and notifications (United States).
• Twilio Ireland Limited: Receiving calls, speech synthesis and recognition, recap text messages (Jarvis Phone, only when enabled) (European Union and United States).

Transfers outside the European Union are covered by the safeguards provided in each provider's data processing agreement (European Commission standard contractual clauses or the EU–US Data Privacy Framework). The Customer is informed of any addition or replacement at least 30 days in advance and may object on legitimate grounds; failing a solution, it may terminate without penalty.