1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the Botsmith Terms of Service between the customer ("you", the controller) and AZINOVE SAS (Société par actions simplifiée), RCS Strasbourg 897 432 324, 13 Rue de Dahlenheim, 67200 Strasbourg, France ("Azinove", the processor). It applies whenever Azinove processes personal data on your behalf through Botsmith. If this DPA and the Terms conflict on data protection, this DPA prevails.
2. Subject matter, nature and duration
Azinove processes personal data to provide Botsmith: an AI chatbot on your website that answers your visitors from the content you provide, records the conversations and collects the contact details visitors choose to leave. The processing consists of collecting, storing, organising, displaying, exporting and deleting the data you put into the service, and, only when you use them, the AI features of a paid plan. Processing lasts as long as your account, plus the deletion period in section 10.
3. Personal data and data subjects
Categories of personal data you may store:
- Chat messages written by your website visitors and the chatbot’s answers
- Contact details visitors leave in the chat: name, email address, phone number, message
- A random visitor identifier stored in the visitor’s browser, and the page the chat was opened from
- Personal data contained in the documents and web pages you add to the knowledge base
Categories of data subjects:
- Visitors of your website who use the chat
- People named in the documents you add to the knowledge base
You must not store special categories of data (Article 9 GDPR) or data about criminal convictions unless the service is configured for it and you have a legal basis.
4. Your instructions
Azinove processes the data only on your documented instructions: these Terms, this DPA and the settings and actions you take in Botsmith. If Azinove believes an instruction infringes data protection law, it will tell you. If EU or French law requires other processing, Azinove will inform you first unless the law forbids it.
5. Confidentiality
Everyone at Azinove authorised to access the data is bound by confidentiality and accesses it only to run, support or secure the service.
6. Security (Article 32)
- All traffic is encrypted in transit (HTTPS/TLS).
- Every record is tied to your workspace or account, and every query is scoped to it, so other customers cannot read your data.
- Data is hosted with providers that encrypt it at rest and keep backups (see the subprocessors below).
- Production access is limited to the people who need it, with individual accounts and multi-factor authentication.
- Where IP addresses are only needed for abuse protection, they are stored hashed.
7. Subprocessors
You give Azinove general authorisation to use the subprocessors below. Azinove imposes data protection obligations on them equivalent to this DPA and remains liable for them. Azinove will announce any new subprocessor at least 30 days in advance on this page; you may object on reasonable data protection grounds and, if no solution is found, close your account with a pro-rata refund of prepaid fees.
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Clerk Inc. | User authentication, session management, organization management | US | Standard Contractual Clauses (SCCs) |
| Stripe, Inc. | Payment processing, subscription billing, invoice management | US/IE | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Application hosting, edge runtime, CDN, cookieless aggregate audience measurement (Vercel Web Analytics) | US | Standard Contractual Clauses (SCCs) |
| Neon Inc. | Managed PostgreSQL database hosting | US/EU (Frankfurt) | Standard Contractual Clauses (SCCs) |
| OpenAI, OpCo, LLC | Large language model inference (ChatGPT, GPT-4, DALL-E) | US | Standard Contractual Clauses (SCCs) |
| Anthropic, PBC | Large language model inference (Claude) | US | Standard Contractual Clauses (SCCs) |
| Google LLC | Large language model inference (Gemini), AI services | US | EU-US Data Privacy Framework |
| Mistral AI | Large language model inference (Mistral) | FR | EU/EEA |
| xAI | Large language model inference (Grok) — routed via AI Gateway | US | Standard Contractual Clauses (SCCs) |
| DeepSeek | Large language model inference (DeepSeek) — routed via AI Gateway | CN | Standard Contractual Clauses (SCCs) |
| Groq, Inc. | Low-latency LLM inference — routed via AI Gateway | US | Standard Contractual Clauses (SCCs) |
| Cerebras Systems | Low-latency LLM inference — routed via AI Gateway | US | Standard Contractual Clauses (SCCs) |
| Fireworks AI | LLM inference (open-weights models) — routed via AI Gateway | US | Standard Contractual Clauses (SCCs) |
| Tavily Inc. | Real-time web search for AI answers (the shared web search tool) | US | Standard Contractual Clauses (SCCs) |
| Replicate, Inc. | Image/video model inference (Flux, SDXL, etc.) — used by Pixova | US | Standard Contractual Clauses (SCCs) |
| ElevenLabs Inc. | Voice synthesis (text-to-speech, voice cloning) — used by Pixova | US | Standard Contractual Clauses (SCCs) |
| Fal.ai | Image/video model inference — used by Pixova | US | Standard Contractual Clauses (SCCs) |
| GitHub, Inc. (a Microsoft company) | Source-code and repository access on the user's behalf — OAuth sign-in, and reading repository content for products that import documentation from a repository (GitDoc). Only reached with a token the user has explicitly authorized. | US | Standard Contractual Clauses (SCCs) |
| Postmark / ActiveCampaign LLC | Transactional email delivery (account, billing, notifications) | US | Standard Contractual Clauses (SCCs) |
8. Transfers outside the EU
When a subprocessor processes data outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, as shown in the table.
9. Assistance and breach notification
- The service lets you view, correct, export and delete the data, so you can answer data subject requests yourself. Azinove forwards any request it receives directly and helps you if you need more.
- Azinove helps you with security, impact assessments and consultations with a supervisory authority (Articles 32–36) as far as its role allows.
- Azinove notifies you of a personal data breach affecting your data without undue delay, and at the latest within 48 hours of becoming aware of it, with the information you need for your own notification.
10. Deletion at the end of the service
You can export your data at any time from the account page. When you delete a conversation, a lead, a knowledge source or your bot, the data is deleted from the live database at once and from backups within 30 days. When you close your account, all your bots and their data are deleted the same way. Data that the law obliges Azinove itself to keep (for example its own invoices to you) is kept only for that purpose and period.
11. Information and audits
Azinove makes available the information needed to show compliance with this DPA. You may audit compliance once a year, on 30 days' written notice, at your cost, by yourself or an independent auditor bound by confidentiality, preferably by questionnaire and documentation.
12. Contact
Data protection questions: dpo@cleverai.ai. This DPA follows the liability and governing-law clauses of the Terms of Service.