Subject matter and duration
| Item | Description |
|---|---|
| Subject matter | Providing Advisable.AI: connecting to the business's systems, AI answers, files, Projects, Routines, access through MCP. |
| Nature and purpose | Storage, reading from the connections, processing by an AI model, creating files, and writes to systems only when a user confirms them. |
| Types of data | Whatever the connected systems and files contain: customer, supplier and employee details, invoices, orders, emails, account transactions, messages. Special categories only if the business brings them. |
| Data subjects | The business's users, and its customers, suppliers, employees and contacts. |
| Duration | For as long as the business uses the service and until the data is deleted under End. |
Advisable's obligations
- We process the data only on the business's instructions, as given by the Terms, the service settings and its users' actions, unless the law requires otherwise.
- We tell the business at once if, in our view, an instruction infringes the GDPR or other law and, before processing, about any legal requirement that obliges us to process otherwise, unless the law forbids it.
- Anyone on our team with access is bound by confidentiality and has access only as needed for support, security or running the service. Signing in to a customer account for support is logged.
- We take the technical and organisational measures in the Annex.
- We help the business answer data subjects' requests and with impact assessments and consultations with the authority, with the information we have.
- We notify the business of a personal data breach without undue delay and, where possible, within 48 hours of becoming aware of it, with the information we have.
- We do not use the data for our own purposes, nor to train AI models.
- We provide the information needed to show compliance with this agreement and allow audits by the business or its auditor, with reasonable notice and under confidentiality.
Sub-processors
The business approves the sub-processors on the Sub-processors page. We bind them by written contract to the same protection obligations and remain responsible for them. For a new sub-processor we email the business at least 15 days in advance; if it objects on reasonable grounds and we find no solution, it may cancel without charge for the remaining period.
Transfers
The application, the database and the AI model run in the EU. Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision (for example the EU-US Data Privacy Framework) or the Standard Contractual Clauses.
End
The business can export chats and files while it has access. When it asks us to delete the account or the business, we delete the data within 30 days, except what the law requires us to keep (for example invoices). Backups are rotated and old ones deleted on their cycle.
Annex: security measures
- Encryption in transit (HTTPS) and AES-256-GCM encryption of connection access details, with the key only on the server.
- Passwords with bcrypt, signed sessions that expire, all sessions ended when the password changes.
- Origin checks on every request that changes data, protection against framing by other sites, rate limits.
- Roles (owner, admin, member) and access per connection. The database is reachable only from the application server.
- Protection against requests to internal networks (SSRF) in the connections.
- Writes to systems only after user confirmation: in most connections through a preview that expires in 10 minutes; in Freshdesk, Zendesk, Strapi and SoftOne's general write command after the AI asks the user. Read-only connections where changes are not needed.
- Uploaded files are treated as untrusted data. Previews run in an isolated environment without scripts.
- Every sign-in by our team to a customer account for support is logged; it cannot add, delete or share connections.