Last updated: 2026-10-14
This Data Processing Agreement (DPA) supplements the Terms and Conditions and applies whenever the Customer ("Controller") uses Agent8Ai Organization to process personal data in the context of providing services to its end users ("Data Subjects"). It is concluded in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Parties
- Controller: the Customer using the Agent8Ai Organization platform.
- Processor (commercial operator): Muse Layer LLC — 5203 Juan Tabo Blvd, Ste 2B, Albuquerque, NM 87111, USA — EIN 30-1474701.
- EU Representative and technology operator (Art. 27 GDPR): Screen Art S.L. — B57029415 — Carrer Rosari 47, 07420 - Sa Pobla, Illes Balears, España.
For Customers established in the European Economic Area, technical processing within the EEA is performed by the EU Representative on behalf of the Processor.
2. Subject matter and duration
The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Agent8Ai Organization service (creation and operation of conversational AI agents, channel integrations, conversational analytics, billing). Processing lasts for the duration of the service contract and ends with deletion or return of the data.
3. Categories of data and data subjects
- Data subjects: end users interacting with the Customer through the platform; the Customer's staff with access to the dashboard.
- Categories: identifiers (name, email, phone), conversation content, audio (when voice channels are used), metadata (timestamps, IP, channel, device).
- Excluded categories: the platform is not intended to process Article 9 special-category data; the Customer must avoid such processing or apply additional safeguards.
3.bis Module-specific processing
- Messaging and webchat: messages, channel identifiers, attachments and metadata needed to deliver conversations and allow human takeover.
- Tickets: subject, description, priority, status, attachments, replies, history and public tracking token.
- Calendars: appointment data, resources, availability, confirmations, cancellations and reminders.
- Voice: CLI, called number, timestamps, duration and textual transcript. Audio is not stored unless an expressly enabled feature requires it and prior information is provided.
- AI and multimodal: prompts, responses, documents, images, audio or attachments submitted by the Controller or Data Subjects to provide the configured service.
- Knowledge base: text of the web pages and documents that the Controller points to or uploads, split into passages, and their numeric vectors (embeddings) so that agents can consult it. Private documents are stored encrypted and the original uploaded file is deleted once processing ends.
- Billing and payments: customer identifiers, plan, usage, credits, invoices and payment references, without storing full card data.
Where the Controller uses the native calendar and ticketing modules, the Processor handles that data within the MuseRelay platform and hosts it on European infrastructure, providing an option with reduced exposure to external subprocessors compared with third-party scheduling or support tools.
Knowledge base content. The Controller is solely responsible for the content it points to or uploads to the knowledge base, and warrants that it has the right to use it and that, unless necessary and with a legal basis, it does not include personal data of third parties or special categories of data (GDPR art. 9). The Processor processes that content only on the Controller's instructions (its consultation by the configured agents), does not review or validate it, and may suspend or delete a source on reasonable grounds of unlawfulness or risk to third parties or to the platform. Deleting a source or a knowledge base removes its passages and vectors.
4. Obligations of the Processor
- Process data only on documented instructions from the Controller.
- Ensure persons authorised to process data are bound by confidentiality.
- Implement appropriate technical and organisational security measures (Art. 32 GDPR) — see Annex II.
- Engage subprocessors only with prior general written authorisation, maintaining the published list at /subprocessors; notify changes with reasonable advance notice and allow the Controller to object.
- Assist the Controller in handling Data Subjects' requests.
- Notify the Controller of personal-data breaches without undue delay (within 72 hours of awareness).
- Upon termination, return or delete personal data, except where Union or Member State law requires storage.
- Make available all information necessary to demonstrate compliance with Art. 28 GDPR.
5. International transfers
Where personal data is transferred outside the EEA, transfers rely on Chapter V GDPR safeguards (Standard Contractual Clauses approved by the European Commission, adequacy decisions and/or supplementary technical measures such as encryption in transit and at rest).
6. Sub-processors
The current list of sub-processors is published at /subprocessors. Notable sub-processors include: AWS EMEA SARL, Google LLC / Vertex AI, Telnyx, Deepgram, Sweego, Stripe Payments Europe, Meta Platforms Ireland, the EU Representative Screen Art S.L. as technology operator.
7. Audits
The Controller may, with reasonable notice and no more than once a year, request information demonstrating compliance with this DPA. Audits requiring on-site access shall be conducted by an independent auditor under confidentiality and at the Controller's cost, except where they reveal a material breach.
8. Liability
Each party shall be liable for the damage caused by processing only where it has not complied with its specific obligations under the GDPR or has acted outside or contrary to lawful instructions of the Controller (Art. 82 GDPR).
9. Annex I — Description of processing
Purposes, categories of data and data subjects are described in sections 2 and 3 of this DPA and in the Privacy Policy.
10. Annex II — Technical and organisational measures
- Encryption in transit (TLS 1.2+). Encryption at rest (AES-256) of stored attachments and integration credentials, using dedicated keys.
- Role-based access control with multi-factor authentication for administrative roles.
- Audit logging of access and operational events.
- Hardening of infrastructure (firewalling, automatic patching, vulnerability scanning).
- Backups with retention policy and incident-recovery procedures.
- Documented incident-response procedures and breach notification within 72 hours.
- Main processing infrastructure located in Alemania (UE) y Bélgica (UE).
11. Contact
Privacy/GDPR: [email protected] · DPO: [email protected] · EU Representative: [email protected].