This Data Processing Agreement ("DPA") supplements the Aria Terms and conditions and applies whenever Aria processes personal data on your behalf (on behalf of the client business) in accordance with Art. 28 GDPR.
1. Roles
You (the client business) are the data controller of the data of your customers who interact with Aria. We (ARIA LABS S.R.L., which operates the Aria service) are the data processor, which processes that data only in accordance with your instructions and with these terms.
2. Purpose of the processing
We process personal data exclusively in order to deliver the Aria service to you: to receive messages from your customers, to reply on your behalf, to keep the context of the conversations, to escalate sensitive cases to your team, and to provide you with aggregated usage reports.
3. Categories of data
We process the following categories of personal data of your customers:
| Category | Examples |
|---|---|
| Identification data | Surname, first name (where provided) |
| Contact data | Telephone number, email |
| Conversation content | Text messages, voice transcripts, attachments |
| Metadata | Message time, channel, detected language |
| Transactional context | Details specific to your business (bookings, appointments, etc.) |
4. Duration of the processing
The duration of the processing is the same as the duration of your contract with us. On termination, the data is deleted from our systems within 30 days at the latest, or returned to you in a standard format, as you request.
5. Subprocessors
We use the following subprocessors. The list may be updated with 14 days' notice.
| Subprocessor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Hosting (servers, infrastructure) | Lauterbourg, France (EU) |
| Mistral AI SAS | Language model (processing of messages), through a proxy with retention opt-out | France (EU) |
| Soniox Inc. | Transcription of speech into text, on telephone calls | European access point (EU) |
| ElevenLabs Inc. | Synthesis of Aria's voice, on telephone calls | USA (SCCs) |
| Telnyx LLC | Transport of telephone calls (numbers and connectivity) | USA (SCCs) |
| Meta Platforms Ireland Ltd. | WhatsApp connectivity (the messaging channel) | Ireland (EU) / USA (SCCs) |
| MailerSend, Inc. | Email delivery: the alert sent to you when Aria escalates a conversation, which carries the customer's phone number and their message, plus two factor codes, invitations and password resets | USA (SCCs) |
| Stripe Payments Europe, Limited | Payment processing and billing of your business's subscription (identification and payment data of the business, not of your customers) | Ireland (EU), with transfer to Stripe, LLC in the USA (SCCs) |
| Google Ireland Limited | Reading your business's public Google listing and its reviews, during setup (Places API) | Ireland (EU) / USA (SCCs) |
| Jina AI GmbH | Rendering the public pages of your website, during setup, when our own server cannot read them | Berlin, Germany (EU) |
| GitHub, Inc. | Off site backup of the configuration and the knowledge base. The knowledge base can contain contact details written into it, for example phone numbers. | USA (SCCs) |
| Hetzner Online GmbH | Encrypted off site backup (databases and files, encrypted before they leave the server) | Falkenstein, Germany (EU) |
All subprocessors are covered by contracts with standard contractual clauses (SCCs) where these apply. One exception concerns the role, not the transparency: for the reading of your public Google listing (Places API), Google Ireland Limited does not act as our subprocessor but as an independent controller, under the Controller-Controller Data Protection Terms that the Google Maps Platform terms point to. We keep it in the table because it receives data about your business and you are entitled to know.
6. Security measures
The technical and organisational measures are described on the Security page. Each business runs in its own unprivileged container, with its own separate database file. Your data is not a set of rows in a table shared with other customers, and access to one business does not open another.
In transit: TLS 1.3 is supported and preferred, TLS 1.2 is accepted for compatibility, and TLS 1.0 and 1.1 are refused. Certificates are issued by Let's Encrypt and rotated automatically. Passwords are hashed with bcrypt, session tokens are random and stored hashed, and cookies are httpOnly, SameSite and Secure. Login attempts are throttled per account and per IP address. Two factor authentication, by a code sent to email, is on by default for every account created through checkout. Server access is by SSH key only, password authentication is disabled, and fail2ban is active.
Between the model and your customer sits a deterministic, rule based layer in the send path: it decides whether to answer at all, it can replace or suppress a reply, and concrete figures and policies in the text are checked against your own knowledge base before the message goes out. The model writes; it never decides whether to send. There are four independent ways to silence the assistant, plus a loop guard, all checked before any spend.
Every database is snapshotted nightly, kept on the same machine with 14 day retention, and an encrypted copy leaves the same night for a second provider in the European Union, its integrity verified at both ends and retained there for 30 days. Sign-ins, failed attempts, two-factor codes and password changes are written to an access log with the user, the time and the IP address. Conversations are never used to train models.
What we do not have, stated plainly: we hold no SOC 2 and no ISO 27001 certification, and data is not encrypted at rest. One thing is left on the list: encryption at rest. We do not have it yet and we do not sell it as if we did.
7. Assistance to you
We help you respond to the requests of your customers who exercise their GDPR rights. If a customer asks you for the deletion or the export of their data, we can do that within 5 working days at the latest from your request.
8. Incident notification
We notify you of any security breach that affects your data within 72 hours at the latest from the moment we detect it, in accordance with Art. 33 GDPR.
9. Audit
Upon written request 30 days in advance, we allow you (or an accredited third party auditor) to audit our data processing practices. The costs of the audit are borne by you, except where the audit uncovers material problems.
10. Transfer of data outside the EU
As a rule, your customers' personal data and the conversations are stored in the European Union: the hosting and the language processing (Mistral AI) take place in the EU, and so do the speech to text (Soniox, on its European access point) and the full encrypted backup (Hetzner, in Germany). There are exceptions, and every one of them is listed in the table in clause 5. For voice synthesis (ElevenLabs), for the transport of phone calls (Telnyx) and for WhatsApp connectivity, certain suppliers may also process data in the USA, covered by standard contractual clauses (SCCs). Telephony is switched on for a business only at its own request, so if you do not use phone calls the voice related transfers do not apply. Regardless of telephony, some of the recipients in the table in clause 5 are outside the European Union and receive data whether or not you use the phone. We do not count them and we do not list them here: a list kept in two places drifts apart, and a number written into a contract becomes false the day the table changes. The table in clause 5 is the list that governs, and it says, for each recipient, what it receives and where it is. About the GitHub copy, because it is the one people ask about: it holds no conversations and no passwords or keys; it holds the knowledge base, which can contain contact details written into it, for example phone numbers.
11. Changes
Changes to this DPA apply by notification at least 30 days in advance. The current version is dated at the top of the page.
12. Contact
For any question relating to data processing: hello@ariaknows.com.
Translation
This page is an English translation of the Romanian original. In case of any discrepancy between the two versions, the Romanian version at ariaknows.com/dpa prevails.