Skip to content
Get started free

GDPR

Data Processing Agreement

A GDPR-compliant agreement covering personal-data processing performed by Aihio on behalf of customers.

Last updated: May 20, 2026

This Data Processing Agreement ("DPA") forms part of the Aihio AI Terms of Service and is entered into between the data controller ("Customer") and the data processor ("Aihio AI"). This agreement governs the processing of personal data that Aihio AI performs on behalf of the Customer in connection with the chatbot service.

This agreement uses the definitions set out in the EU General Data Protection Regulation (GDPR, 2016/679):

  • "Personal data" means any information relating to an identified or identifiable natural person.
  • "Processing" means any operation performed on personal data, such as collection, storage, use, and deletion.
  • "Controller" means the Customer who determines the purposes and means of the processing of personal data.
  • "Processor" means Aihio AI, which processes personal data on behalf of the Controller.

Aihio AI processes personal data for the following purposes:

  • Processing and storing chatbot conversations
  • Indexing and retrieving knowledge base materials (RAG)
  • Usage analytics and reports
  • User account and team management

The types of personal data processed may include:

  • End-user chat messages and related metadata (timestamps, session identifiers)
  • Materials provided by the Customer to the chatbot, which may contain personal data
  • Customer dashboard user information (name, email, role)

Aihio AI commits to the following obligations:

  • Process personal data only on documented instructions from the Customer
  • Ensure that persons authorized to process personal data have committed to confidentiality
  • Implement appropriate technical and organizational security measures (GDPR Art. 32)
  • Assist the Customer in fulfilling data subject rights requests
  • Delete or return all personal data upon termination of the service, at the Customer's choice
  • Make available to the Customer all information necessary to demonstrate compliance with GDPR obligations

Aihio AI uses the following sub-processors to provide the service:

  • Supabase (EU West, Ireland): Database, user management, and file storage
  • Vercel (EU region): Application hosting and CDN
  • Mistral AI (France, EU): Language model APIs for generating chat responses. The only language model sub-processor; all inference runs in the EU.
  • Stripe: Payment processing (does not store chat data)
  • Sentry (EU, Germany): Error tracking and performance monitoring
  • Resend (EU, Ireland): Email communications (transactional messages)
  • Crawl4AI (Railway, EU region, Ireland): Web crawling and content collection for customer chatbot knowledge bases. Self-hosted on Railway infrastructure within the EU — collected content remains inside the Aihio stack and is not transferred to a third party. Railway (platform infrastructure) is already covered by the existing sub-processor list.
  • Twilio (United States) — only with the BYO SMS channel: Delivery of SMS messages when the Customer activates their own Twilio account for the Aihio BYO SMS channel. The Customer brings their own credentials (Account SID + Auth Token) and acts as the direct controller toward Twilio — Aihio does not relay or bill Twilio usage. Processes the Customer's inbound SMS messages and Aihio-generated reply messages. Twilio EU customer data is handled via its subsidiary Twilio Ireland Limited under SCCs. This sub-processor is not in use for customers who have not activated the SMS channel on their chatbot.
  • Upstash (Redis, EU region): Rate-limit counters and response cache. Keys are short-lived (minutes) and may contain a visitor IP address; no chat message content.
  • PostHog (EU, Frankfurt): Product analytics and usage metrics. Collects only on explicit cookie consent; autocapture disabled.

We will notify the Customer of any changes to sub-processors in advance. The Customer has the right to object to the change.

Personal data is stored within the EU. Language model APIs run in the EU (Mistral AI, France) – conversation data is not transferred outside the EU for inference. Web crawling runs on a self-hosted Crawl4AI service on Railway infrastructure within the EU. Two sub-processors are US companies: Upstash (Redis), whose instance is EU-region and which stores short-lived rate-limiting counters, and Twilio, used only on the BYO SMS channel a Customer explicitly activates. In both cases the transfer relies on EU Commission Standard Contractual Clauses (SCCs).

The Aihio AI chatbot service utilizes general-purpose AI models (GPAI). In accordance with the EU AI Act (2024/1689), we comply with the following transparency obligations:

  • Chatbot responses are clearly identified as AI-generated
  • Customers are provided with information about the AI models used and their providers
  • AI-generated content is not presented as human-produced
  • Customers are assisted in meeting their own AI Act obligations

Aihio AI implements the following technical and organizational security measures:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Row-level security (RLS) at the database level — customers cannot access each other's data
  • Role-based access control (RBAC) at the team level
  • Regular security updates and vulnerability assessments
  • Logging and monitoring for anomaly detection

Aihio AI will notify the Customer of a data breach without undue delay, no later than 48 hours after becoming aware of it. The notification will include a description of the breach, its likely consequences, and the corrective measures taken.

Aihio AI will assist the Customer in fulfilling the following data subject rights:

  • Right of access to personal data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability

This DPA remains in effect for as long as Aihio AI processes personal data on behalf of the Customer. Upon termination of the service, Aihio AI will delete all personal data within 30 days, except for log data retained for up to 90 days for security purposes, backup copies required for disaster recovery, and data where retention is required by law. Such retained data remains subject to the confidentiality and security obligations of this Agreement.

For questions related to this Data Processing Agreement, contact:

privacy@aihio.ai