Data Processing Agreement

You are the controller of the personal data contained in your customers’ conversations. Vaelto (ICC CONSUL LLP) is the processor and processes that data only to provide the service described in the Terms.

Details of the processing — subject matter, duration, nature, purpose, categories of data and of data subjects — are set out in Annex I.

This agreement applies for as long as we process personal data on your behalf.

We process personal data only on your documented instructions, including on transfers to third countries, unless required to do otherwise by law that applies to us; in that case we will inform you before processing, unless the law prohibits it on important grounds of public interest.

Your instructions are: the Terms, this agreement, the settings you choose in the workspace (including whether attachments are sent to the AI model, which AI model is used, and whether auto-send is enabled), and any further written instruction you give us.

We will inform you if, in our opinion, an instruction infringes data protection law. We may refuse to act on an instruction that is unlawful.

Everyone we authorise to process your data is bound by a written confidentiality obligation and is instructed to process the data only as needed to run the service and support you.

Access by our staff to an office workspace happens only through a time-limited support visit: it is recorded, visible to the office in its team list, and expires automatically after 24 hours.

We implement appropriate technical and organisational measures under Article 32. The measures in force are listed in Annex II.

We review the measures as the service changes and may replace a measure with one that provides an equivalent or higher level of protection.

You give general authorisation for us to engage the subprocessors listed in Annex III.

We will give you at least 30 days’ notice before adding or replacing a subprocessor. You may object on reasonable data-protection grounds within that period; if we cannot accommodate the objection, you may terminate the affected part of the service without penalty.

We impose on each subprocessor data protection obligations no less protective than those in this agreement, and we remain fully liable to you for their performance.

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection).

The service provides export and deletion tools you can use directly. If a data subject contacts us about data we process for you, we will not respond on your behalf; we will pass the request to you without undue delay.

We will notify you without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting personal data processed for you.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, and the measures taken or proposed. We will provide the further information you reasonably need to meet your obligations under Articles 33 and 34.

We will not notify supervisory authorities or data subjects on your behalf unless you instruct us to do so.

We assist you, taking into account the nature of processing and the information available to us, in complying with Articles 32 to 36 — in particular with data protection impact assessments and prior consultation with a supervisory authority.

On termination of the service, you may export your data from the workspace for 30 days. After that period we delete personal data processed on your behalf, unless retention is required by law that applies to us.

Deleted data may remain in encrypted backups for up to 56 days, after which it is destroyed. During that period it is not accessible in the service and is used only for disaster recovery.

Retention periods that apply during the life of the account are described in our Privacy Policy.

We make available the information necessary to demonstrate compliance with Article 28 and allow for audits, including inspections, conducted by you or an auditor you mandate.

In practice, we will first provide our security documentation and answer a written questionnaire. Where that is not sufficient, an on-site or remote audit may be carried out no more than once a year, on 30 days’ notice, during business hours, subject to confidentiality, and without disrupting the service or affecting other customers. You bear your own costs; we bear ours unless the audit reveals a material breach on our side.

Personal data is stored in the European Union, and message delivery through our default aggregator also stays within the EU. Some subprocessors operate outside the EU and the UK — principally the AI provider — see Annex III, which names each one and its country.

Where personal data is transferred outside the EU or the UK, the transfer is made under the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module Three (processor to processor), and, for UK transfers, the UK International Data Transfer Addendum. A copy of the safeguards is available on request at vaeltoai@gmail.com.

Delivery of messages inherently involves the messaging platforms your customers use; that transfer follows from your choice of channel.

The liability provisions of the Terms of Service apply to this agreement.

In case of conflict between this agreement and the Terms as regards the processing of personal data, this agreement prevails. In case of conflict between this agreement and the Standard Contractual Clauses, the Clauses prevail.

Subject matter: provision of an AI-assisted messaging inbox — drafting replies from your knowledge base, translation, transcription of voice messages, reading of document images, delivery of messages, and storage of the resulting conversation history.

Duration: for the term of your use of the service, plus the retention and deletion periods set out in section 9.

Nature and purpose: collection, recording, storage, retrieval, use, transmission to the channels you connect, and erasure, all for the purpose of handling your customer communications.

Categories of data subjects: your customers and other people who write to your connected channels; your operators and administrators.

Categories of personal data: the content of messages, including any personal data your customers choose to send (names, contact details, and — depending on your business — images of identity or other documents); voice messages and their transcripts; attachments; phone numbers and messenger identifiers; conversation metadata (timestamps, statuses, tags, notes); operator account data.

Special categories: the service is not designed for the routine processing of special categories of personal data (Article 9). If your business means such data may appear in conversations, you must assess this before use and instruct us accordingly.

Encryption in transit: all connections use TLS 1.2 or higher, including connections to messaging providers and to the AI provider.

Encryption at rest: data is encrypted at rest at the storage layer by our infrastructure providers (managed database and object storage, application hosting). Backups are encrypted with AES-256 and retained for 56 days.

Tenant isolation: each office is a separate tenant. Database access is enforced by row-level security so that one office cannot read another office’s data, and each office has its own knowledge base, prompt and channel credentials.

Access control: access to production data is limited to a small number of authorised persons. Staff access to a customer workspace is possible only through a time-limited support visit that is recorded, visible to the customer, and expires after 24 hours.

File access: customer attachments are served only through signed links with a limited lifetime; permanent public links are not used.

Logging discipline: message content and attachments are not written to application logs; logs contain identifiers, sizes and statuses only. This is enforced by automated tests.

Secrets management: credentials for external services are held in the hosting platform’s secret store and are not exposed to the front end or written to logs.

Resilience: automated backups of the production database with documented restore procedure; the service runs on managed infrastructure in the European Union.

Change control: all changes go through version control, automated tests, and review before deployment.

OpenAI, L.L.C. (United States) — generating reply drafts, translation, transcription of voice messages, reading document images when you enable it, and storage of your knowledge base in a per-office vector store.

SIA Wazzup (Latvia, European Union — registration no. 40203253201, Ganibu dambis 26A, Riga, LV-1005) — messaging aggregator: connection to WhatsApp, Telegram and other channels, and delivery of messages to and from your customers. Used when you connect a channel through the aggregator.

Meta Platforms (United States / Ireland) — delivery of WhatsApp messages, where you use the official WhatsApp Business Platform.

The channel provider is not fixed: we can connect you through the aggregator above, through the official WhatsApp Business Platform, or through another provider you ask for. If your setup uses a provider not listed here, it acts as an additional subprocessor for your workspace and we will tell you which one before connecting.

Supabase (European Union, Frankfurt) — managed database and object storage for conversations, attachments and account data.

Fly.io (European Union, Amsterdam) — hosting of the application and API.

Resend (United States / European Union) — transactional email (invitations, notifications, sign-in emails).

Apple Inc. (United States) and browser push services (Google, Mozilla) — delivery of push notifications to operators’ devices; the notification body may contain a message preview.

Stripe (United States / European Union) — payment processing, once paid plans launch. Not used until then.