Data processing agreement

Last updated: 3 November 2026

This agreement is part of our terms and is accepted with them. It sets out how we handle your guests' details for you, as the GDPR (article 28) requires.

Who is who

You, the business using Ruvi, are the data controller: you decide why and how your guests' details are used. [Company legal name] is the data processor: we handle them only to provide Ruvi to you.

What we handle and why

• Whose data: your guests and anyone who contacts your business through the channels you connect.
• What data: names, phone numbers, email addresses, the content of messages and calls (including call recordings or transcripts if you turn them on), booking details and anything a guest chooses to tell us.
• Why: to answer your guests, pass requests to your team, show conversations in your panel and send you reports.
• How long: while your contract lasts. When it ends we delete the data, or return it to you if you ask within 30 days.

What we promise

• We only act on your written instructions, which are these terms and your settings in Ruvi.
• Everyone on our team who can see the data is bound to keep it confidential.
• We protect it with suitable security: encrypted connections, access only for those who need it, and regular backups.
• We help you answer your guests when they ask to see, correct or delete their data.
• We tell you without undue delay, and within 48 hours of finding out, about any breach affecting your data.
• We give you the information you need to show you comply, and allow reasonable audits with notice.

Other companies we use

You authorise us to use these sub-processors, each bound by the same data protection duties:

• Telnyx: phone lines and calls.
• ElevenLabs: Ruvi's voice.
• Meta (WhatsApp Business): WhatsApp messages.
• Stripe: payments (your billing details only, not your guests').
• [Other providers: AI model and hosting, with their country]

We'll tell you at least 30 days before adding or replacing a sub-processor, and you can object or cancel. When data goes outside the European Economic Area, it is protected by the European Commission's standard contractual clauses or another safeguard the GDPR allows.

Your part

Make sure you can lawfully share your guests' details with Ruvi and that your own privacy notice tells guests about it, including that an automated assistant answers them.

Contact

[Contact email]