Data processing agreement

Parties

The customer (controller) and NS Corp, SIREN 919 978 825, publisher of Ablyos.ai (processor). This agreement forms part of the contract upon purchase of a Team plan or campus licence; a signed copy is provided on request at [email protected].

Subject and duration

Providing the Ablyos.ai service to the members designated by the customer, for the duration of the subscription.

Data and data subjects

Customer members: identity, email address, content entered (messages, documents, images), technical logs. No special category is requested; the customer only enters such data when necessary.

Instructions

The processor only processes data to provide the service. It never uses content to train a model, never sells it and only shares it with the sub-processors below.

Sub-processors

OpenRouter : Routing messages to models (United States (standard contractual clauses))

Anthropic, OpenAI, Google, Mistral AI, xAI : Model providers, no retention for training (United States and European Union)

Stripe : Payments and invoicing (Ireland and United States)

Resend : Account emails (United States (standard contractual clauses))

Neon : Database (European Union)

Hostinger : Server hosting (European Union)

Cloudflare : Network, bot protection, encrypted backups (European Union and worldwide)

Any addition is announced on the Trust page at least 30 days in advance; the customer may object and cancel at no cost.

Security

Measures described in the security sheet: EU hosting, encryption in transit, encrypted backups, two-factor authentication for admin access, account isolation, audit log.

Transfers outside the EU

To model providers and vendors established outside the European Union, on the basis of the European Commission's standard contractual clauses.

Data breach

Notification to the customer without undue delay and no later than 72 hours after becoming aware, with the information available.

Assistance and data subject rights

Export and deletion are available to each member in settings; the processor helps the customer answer requests within one month.

End of contract

When the subscription ends, members keep their own accounts; at the customer's request, seats are removed and their data erased. Invoices are kept for ten years (legal requirement).

Audit

On written request, once a year, the processor provides the information needed to demonstrate compliance with this agreement.