Data Processing Agreement

DPA · Version of 12 October 2026 · Courtesy translation: the French version prevails.

This agreement supplements the terms of use. It applies as soon as you use WhatzAI to talk with your own customers on WhatsApp. It describes what we do with their data, on your behalf.

1. Who is who

• You (the customer business) are the data controller: you decide why and how you contact your customers.
• WhatzAI, a service published by DIFISOL TECHNOLOGIES, is your processor: we process this data only to provide the service, according to your settings.

2. The data concerned

• Data subjects: your customers and prospects who write to you on WhatsApp, and the contacts you import.
• Data: phone number, name, email if given, message content, files exchanged (photos, documents, voice messages), appointments, notes and tags you add.
• Purpose: replying to messages, by an AI agent or by your team, keeping the conversation history, booking appointments, sending your campaigns to contacts who consented.
• Duration: as long as your account is active, then according to section 8.

3. Our commitments

• Process the data only on your instructions, that is, to run the service you have configured.
• Never sell this data, nor use it for our own advertising.
• Not use it to train an artificial intelligence model.
• Limit access to the people who need it to operate and troubleshoot the service, who are bound by confidentiality.
• Help you answer your customers' requests (access, correction, erasure).

4. Your commitments

• Inform your customers that an automated assistant may reply to them, and comply with the laws that apply to your activity.
• Send campaigns only to people who agreed to receive your messages.
• Follow the WhatsApp Business rules.
• Not entrust us with sensitive data (health, banking data) without discussing it with us first.

5. Security

• Encrypted exchanges over HTTPS. WhatsApp and Google access tokens and OpenAI keys are encrypted (AES-256) in our database.
• Strict separation: one account never accesses another account's data.
• WhatsApp messages accepted only with Meta's signature; payments re-verified with the payment provider.
• Request rate limiting, automatic blocking of attacking addresses, an administration action log, two-factor authentication for the administrator.
• Files kept in a private space, accessible through temporary links.

In full transparency: message content is stored in a database whose disks are encrypted by our host, but it is not encrypted a second time by our application. No external security audit has been carried out yet.

6. Sub-processors

You authorise us to use the following providers. We will notify you by email before adding a new one that processes your customers' data.

7. Transfers outside your country

Most of these providers host data in the United States. By using WhatzAI, you accept this transfer. We have not yet signed a specific agreement with them on your behalf: if your activity requires it (customers in the European Union, regulated sector), write to us before committing.

8. Retention and erasure

• You can delete a contact at any time: their conversations, messages, received files and appointments are erased.
• You can delete your account from Settings: all your data is erased. Payment records are kept for our accounting obligations.
• After a subscription ends, your data is kept for 30 days so you can come back, then erased.

9. In case of an incident

If we find a leak or unauthorised access affecting your customers' data, we notify you by email within 72 hours, with what we know: nature of the incident, data concerned, measures taken.

10. Oversight

On written request, we answer your questions about our security measures. An on-site audit can be discussed, at your expense and with reasonable notice.

11. Contact

For any question, or to receive a signed version of this agreement: difisoltech@gmail.com