Version française faisant foi — French version prevails — this translation is provided for convenience. Version française

Data Processing Agreement (DPA)

Annex to the Terms and Conditions — compliant with article 28 of the GDPR · Version 1.2 of 05/09/2026

This agreement (the "DPA") forms an integral part of the Terms and Conditions. It applies automatically, accepted when the account is opened by a time-stamped acceptance checkbox, without a separate signature. On request to contact@parlyo.io, a signed version (PDF) can be drawn up for your supplier records. For customers established in Morocco, the same commitments apply under Law No. 09-08 (CNDP).

1. Parties and roles

Processor: ANATOMY of AI — Majd Hakim, sole trader (entrepreneur individuel), SIREN 521 179 150, 16 rue Pierre Mendès France, 77200 Torcy, France ("Parlyo").
Controller: the customer holding the account (the "Customer").

For the data of visitors to the Customer's site processed via the agent (conversations, contact requests), the Customer is the controller and Parlyo acts exclusively as processor, on the Customer's documented instructions. For the data of the Customer's own account (credentials, invoicing), Parlyo is the controller — see the privacy policy.

2. Subject matter, nature and purpose of the processing

Subject matterProvision of the conversational agent (chat + voice), capture of contact requests, usage statistics.
NatureCollection, recording, consultation, transmission to AI engines for answer generation, erasure.
Data subjectsVisitors and users of the Customer's site(s)/application(s).
Categories of dataContent of conversations (text; transcriptions), contact details voluntarily provided (name, e-mail, telephone), minimal technical metadata (language, timestamp, truncated IP).

Telephone calls (Parlyo Phone plan): audio recording of the call and its transcription, number called, calling number when transmitted, timestamps and duration. The caller is informed of this before speaking: the agent's first sentence states that they are talking to an automated assistant, that the call is recorded and transcribed, and that the number does not handle emergencies. Retention: 30 days for the audio, never more than 90, automatic daily purge; the transcription and the call log are kept for the duration of the contract. On the web channel, the audio remains processed as a stream and is not retained.
Sensitive dataNone by design. The agent is instructed never to ask for any (medical reason, symptom, diagnosis, treatment, religion, opinions, orientation, origin) and not to rephrase, repeat or record any that a person might volunteer. The Customer for its part undertakes not to solicit such data via the agent.
DurationDuration of the contract; deletion by the Customer at any time (dashboard) and purge upon account closure (§8).

3. Obligations of Parlyo (processor)

  1. Process the data only on the Customer's documented instructions (use of the service constitutes the instruction), including with regard to transfers.
  2. Ensure confidentiality: persons authorised to process the data are bound by an obligation of confidentiality.
  3. Implement the technical and organisational measures of Annex A (art. 32 GDPR).
  4. Comply with the conditions of §4 (sub-processors).
  5. Assist the Customer, taking into account the nature of the processing, in responding to requests for the exercise of data subjects' rights (access, rectification, erasure, objection, portability, restriction).
  6. Help the Customer ensure compliance with its obligations regarding security, breach notification and impact assessment.
  7. Notify the Customer without undue delay (target: within 48 h) after becoming aware of a data breach concerning it, with the information useful for its own notification.
  8. Delete or return all data at the end of the contract (§8).
  9. Make available the information necessary to demonstrate compliance, and allow for reasonable audits (§7).
  10. Never use the data of the Customer or of its visitors to train AI models, nor sell, rent or exploit it for advertising purposes.

4. Sub-processors

The Customer gives general authorisation for the use of the sub-processors listed below. Parlyo will inform the Customer (by e-mail or public page) of any change at least 15 days in advance, and the Customer may object on legitimate grounds.

Sub-processorRoleLocation / safeguards
Contabo GmbHHosting (VPS)European Union — "Hub Europe" region; company incorporated under German law (Welfenstraße 22, 81541 Munich)
LiveKit, Inc.Real-time voice gateway and telephony (SIP)European Union — processing in the Frankfurt region (Germany), observed on the service in operation
Zadarma / IP Telecom BulgariaProvision of the French number and routing of inbound callsEuropean Union — exact location to be confirmed in writing with the provider
Google LLC — Gemini API (Google AI for Developers)AI engine (generation of text/voice answers); for voice on the site, the audio connection is established directly between the visitor's browser and the API, with an ephemeral token — the audio is neither relayed nor stored by ParlyoEU/US — standard contractual clauses + API commitments: data not used for training
CloudflareProxy/CDN (transit only)Worldwide — standard contractual clauses
Tavily, Serper or DuckDuckGoWeb search — enabled solely on the Customer's initiative, by supplying a key or, failing that, through the fallback engine. The query transmitted is the visitor's rephrased question; neither the conversation history, nor the knowledge base, nor any account data leavesEU/US — standard contractual clauses
Stripe (or CMI in Morocco)Card payment (PCI-DSS) — Customer invoicing data onlyEU / Morocco
SMTP providerTransactional e-mailsEU

5. Transfers outside the EU

The data is hosted in the European Union. Where a sub-processor involves a transfer outside the EU (AI engine, proxy), that transfer is governed by standard contractual clauses (art. 46 GDPR) and supplementary measures (encryption in transit, minimisation, truncated IPs).

6. Security (Annex A)

7. Audit

Upon reasonable written request (max. once a year, 30 days' notice, business hours, without access to other customers' data), Parlyo provides the compliance documentation and answers in writing the security questionnaires of the Customer or its DPO.

8. End of the contract

Upon account closure: immediate deletion of the data of the Customer and of its visitors (conversations, contacts, knowledge base, documents). Only invoices are kept for 10 years (legal obligation). The Customer may export its data (conversations, contacts) from the dashboard before closure.

9. Liability and precedence

Each party's liability is governed by the T&Cs. In the event of any conflict between this DPA and the T&Cs regarding data protection, the DPA prevails.

Version 1.2 — 05/09/2026 (1.1 of 29/08/2026, 1.0 of 23/07/2026). Earlier versions are available on request.