Data Processing Agreement
Controller: the customer subscribing to InvokeAgent (the "Customer").
Processor: Jesús Lacera Cortiñas (SEO-Invoke), NIF 55847836H, Calle Carlos Vázquez 7, 13001 Ciudad Real, Spain, info@seo-invoke.com.
1. Subject matter and duration
The Processor processes personal data on behalf of the Customer solely to provide the InvokeAgent service: answering visitors to the Customer's website, transcribing voice notes and passing contact and appointment requests to the Customer. This agreement lasts as long as the subscription.
2. Data and data subjects
| Data subjects | Visitors to the Customer's website who use the assistant. |
|---|---|
| Data | Chat messages, voice notes (only during transcription), name, email and phone when provided by the visitor, preferred appointment time and the consent timestamp. Each contact or booking request also stores a short AI-generated summary of the conversation (without contact or health details), a request score and the source of the visit: campaign parameters (UTM), landing page and referring website (domain and path only). Daily activity counters without personal data are kept for the dashboard statistics. |
| Operations | Receipt, AI answer generation, transcription, automatic summary and scoring of requests, recording of the visit source, storage of contact requests and delivery to the Customer (dashboard, email, Telegram or CRM webhook). |
The service is not designed to process special categories of data (for example, health data). The Customer will not configure the assistant to request them, and the assistant is instructed not to ask for them. The online service is not provided to healthcare providers or professionals (section 2 of the Terms of Service). If a visitor shares health data on their own initiative, the Processor processes it only to pass their request to the Customer, within the periods in section 7.
3. Processor obligations
- Process data only on the Customer's documented instructions, which are these terms and the settings the Customer makes in the dashboard.
- Ensure that people authorised to process the data are bound by confidentiality.
- Apply appropriate security measures (Article 32 GDPR): encryption in transit (HTTPS), encryption at rest of integration credentials, database access restricted to the server, isolation between customers with automated tests, dashboard access only with a verified email, immediate deletion of audio after transcription, encrypted and tested backups, access control and activity logs.
- Assist the Customer in responding to data subject requests and in meeting its security, impact assessment and prior consultation obligations where applicable.
- Notify the Customer without undue delay, and at the latest within 48 hours of becoming aware, of any personal data breach affecting its data.
- Make available the information needed to demonstrate compliance and allow reasonable audits with 30 days' prior notice.
- On termination, delete the Customer's data within 30 days of the final cancellation (deletion is automatic) unless the Customer requests an export beforehand or the law requires retention.
4. Customer obligations
- Have a lawful basis for the processing and inform its website visitors about the assistant in its privacy policy.
- Not include unnecessary third-party personal data in the assistant's configuration.
- Handle data subject requests, with the Processor's assistance.
5. Sub-processors
The Customer gives general authorisation for the following sub-processors. The Processor will email any change 15 days in advance; the Customer may object by cancelling the subscription.
| Provider | Function | Location |
|---|---|---|
| Supabase | Database | European Union (Ireland) |
| Railway | Server hosting | United States |
| Cloudflare | Content delivery and security; anti-bot verification (Turnstile) | Global |
| OpenAI | Answer generation, request summaries and voice transcription | United States |
| Google (Gemini API) | Backup AI provider, only if OpenAI does not respond | United States |
| TypeSafe | Message classification for quick answers | United States |
| Resend | Service emails | United States |
| Telegram | Alerts to the Customer, only if enabled | United Kingdom / United Arab Emirates |
| Cal.com | Bookings, only if the Customer connects a calendar | United States |
| Sentry (Functional Software) | Technical error logging for the service | European Union (Germany) |
| Microlink | Reading the public pages of the Customer's website during sign-up; receives no visitor data | Per its DPA (GDPR) |
| GitHub (Microsoft) | Storage of the weekly backups, encrypted before leaving the service (GitHub cannot read them) | United States |
6. International transfers
Where a sub-processor processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, an adequacy decision or the European Commission's standard contractual clauses, depending on the provider.
7. Retention
- Voice notes are deleted as soon as they are transcribed.
- The conversation is kept in the visitor's browser for the session. The server keeps the last turns of each conversation in memory only (never on disk or in the database) for up to 2 hours to give context to the answers.
- Contact details a visitor leaves in a request are removed from the technical workflow as soon as they are delivered to the Customer (dashboard, email, Telegram or webhook).
- Contact and appointment requests, with their summary, score and visit source, are kept for the duration of the subscription or until the Customer deletes them.
- OpenAI may keep technical safety logs for up to 30 days under its terms. Google, when acting as backup provider, may keep them for a limited period under the paid Gemini API terms, which do not allow using the data to train its models.
- Backups: daily backup by the database provider (kept for 7 days) and encrypted weekly backup (kept for 90 days), with automatic restore testing. Deleted data disappears from the backups when they expire, at the latest after 90 days. Backups are only used to restore the service after a failure.
8. Liability and governing law
The liability regime of the Terms of Service, Spanish law and the courts of Ciudad Real apply.