Data processing agreement (DPA)

1. Parties and version

The customer who registers the account is the controller of their visitors’, customers’ and operators’ data. NeoAI is the processor. This text is version 2026-10-27. Registration stores the date and version on the account.

2. Subject matter, duration and purpose

NeoAI hosts the assistant chat and voice, stores messages, leads and tickets, and sends the text to the AI model the controller configured. Processing lasts for the life of the account and for the technical backup and legal period after closure.

The controller acts as deployer under the EU AI Act toward end users; NeoAI provides the software only. Chat and voice always show that the user is interacting with artificial intelligence; that label cannot be disabled.

3. Data and data subjects

Data: chat messages, voice transcripts, lead name phone and email, consent text, technical logs, and WhatsApp identifiers when that channel is connected. Data subjects: the controller’s visitors, customers and staff. NeoAI does not use this data for its own purposes.

4. Instructions

The instructions are this agreement and the panel configuration: privacy URL, consent text, retention days, model, channels. A different instruction goes to the privacy contact and applies once confirmed in writing.

5. Sub-processors

Infrastructure: Contabo GmbH, Munich. The only data center named in its Art. 28 DPA is Contabo France SAS, Lauterbourg, France. Contabo covers physical security and anti-DDoS. The operating system, backups and traffic encryption on the VPS stay with NeoAI.

Models and voice chosen by the controller (OpenAI, Anthropic, Google, DeepSeek, ElevenLabs, OpenRouter, and others): NeoAI routes text or audio to the API the controller enabled. A platform-managed API key and a bring-your-own-key (BYOK) configuration are both treated as the controller’s choice of provider. NeoAI is not party to a separate Art. 28 DPA with those model vendors; the provider’s published API terms apply when the integration is on. DeepSeek is available only via BYOK.

Meta Platforms Ireland Ltd. when WhatsApp is connected: NeoAI uses the WhatsApp Cloud API; Meta’s WhatsApp Business Data Processing Terms and business platform terms apply (no separate NeoAI signature). Backblaze B2 for media files when configured: governed by Backblaze’s Terms of Service and published DPA addendum for the storage account. OVHcloud for transactional SMTP when the instance sends service email, under OVH’s published terms.

A new sub-processor is published on /sub-processors with a version number. If the controller objects on legitimate data-protection grounds within the notice period, NeoAI will work in good faith; unresolved objections may lead to termination of the affected services under the Terms of Service.

6. Data subject rights, breaches and retention

From the panel the controller exports a session or forgets it. Forget deletes messages, summaries and reviews for that session. Leads and tickets remain until the controller deletes them. The first WhatsApp message is not checkbox consent; marketing consent remains separate.

If NeoAI becomes aware of a breach of the controller’s personal data processed under this agreement, NeoAI notifies the account email without undue delay with the information available at that time.

If chat retention days are configured, expired sessions are deleted automatically. At account closure, deletion follows the offboarding flow in the owner Legal area and backup cycles described in the Privacy Policy.

7. Security and confidentiality

NeoAI ensures that persons authorised to process the controller’s data are bound by confidentiality.

NeoAI implements appropriate technical and organisational measures: HTTPS/TLS for websites and APIs, logical separation of tenants in the application layer, encryption of integration secrets at rest where supported, access control for owner and admin roles, configurable conversation retention, and export or scheduled deletion from the owner Legal area.

The controller remains responsible for credentials, staff training, and lawful basis for end-user data.

8. Assistance to the controller

NeoAI assists the controller, insofar as possible, with data subject requests by providing session export and forget tools in the owner panel.

NeoAI assists with security of processing and breach notification obligations by informing the account email without undue delay when NeoAI becomes aware of a personal data breach affecting the controller’s data processed under this agreement.

9. International transfers

Primary application hosting is on a Contabo Cloud VPS; the Art. 28 agreement for that server names Contabo France SAS, Lauterbourg, France, for data-centre operations. Physical security and anti-DDoS at the facility are Contabo’s responsibility; VPS operating system, backups, tenant separation and encryption in transit on that server are NeoAI’s responsibility.

When the controller enables an AI, voice, messaging, storage or payment provider, personal data may be processed outside the European Union under that provider’s terms. NeoAI does not state that standard contractual clauses are in place unless the controller’s chosen provider contract provides them and the controller has activated that provider.

10. Audits and documentation

NeoAI makes available information necessary to demonstrate compliance with Article 28 GDPR and allows for audits mandated by the controller, subject to reasonable notice, confidentiality, and frequency limits that protect other customers and security.

The public sub-processor list at /sub-processors, with version number, forms part of the transparency obligation. Material changes are announced to business customers by email and in the owner panel.

11. End of processing

At the end of the account, the controller may export workspace data and schedule permanent deletion from the owner Legal area, subject to a grace period before purge. After purge, application data for that tenant is removed from the live database as described in the Privacy Policy, subject to backup cycles and legal retention duties.

Upon written request to the privacy contact, NeoAI deletes or returns personal data processed on the controller’s instructions, unless applicable law requires storage.