Data Processing Agreement (DPA)

For personal data that a customer studio submits to EVA AI for WhatsApp conversations and booking operations, the customer is generally the controller and Giuseppe Martini acts as processor to provide the service. This DPA does not change situations where the operator processes data for its own independent purposes, such as account security or billing administration.

Processing covers message delivery, conversation handling, booking administration, support and security activities required by the service. Data may include contact identifiers, message content, booking details, language preferences and associated technical metadata. The customer instructs EVA AI through the product configuration and lawful use of the service.

• Process controller data only to provide, secure and support the service or as otherwise required by law.
• Limit access to personnel and systems that need it for authorized purposes.
• Maintain reasonable technical and organizational safeguards appropriate to the service.
• Provide reasonable assistance with verified data-subject requests and compliance obligations.
• Inform the customer without undue delay after becoming aware of a personal-data breach affecting controller data, to the extent required by applicable law.

Current application controls include tenant-scoped authorization, password hashing, session invalidation/revocation controls, webhook authentication, security and delivery audit records, atomic booking protections, and authenticated encryption for tenant WhatsApp provider access tokens at rest. Transport and infrastructure security additionally rely on the configured hosting, database and provider platforms.

Services that may process data for EVA AI include Meta/WhatsApp, MongoDB Atlas, Anthropic and/or OpenAI, Resend and the configured hosting provider (Emergent). Stripe processes subscription/payment information for billing. Exact production arrangements and locations must match the operator's live configuration.

Configured processing-location information: Switzerland, European Economic Area, and United States, depending on the configured subprocessors.

If personal data is transferred across borders, the parties will rely on the safeguards required by the applicable data-protection law and the relevant provider arrangements. This DPA intentionally does not assert a particular adequacy decision, SCC coverage, regional hosting location or certification unless it is verified for the actual production deployment.

The customer remains responsible for verifying the identity and legal entitlement of its data subjects. EVA AI will provide reasonable assistance using the data and tooling available to the service. No fixed seven-day deletion or thirty-day export SLA is promised by this DPA unless separately agreed.

At termination, controller data will be returned or deleted as required by the applicable agreement and law, subject to legitimate retention needs and technically necessary backup lifecycles. Until automated export/deletion tooling is available, requests are coordinated through support@eva-ai-assistant.com.

EVA AI will provide information reasonably necessary to demonstrate the obligations in this DPA and will cooperate with proportionate audit requests, subject to confidentiality, security and third-party restrictions.

This DPA applies while EVA AI processes controller data for the customer's active service. If this DPA conflicts with general Terms on processor-specific data-protection duties, this DPA controls for those duties, subject to mandatory law.