In the event of any discrepancy, the Italian version prevails. Read the Italian version
In brief
- We process your data only on your instructions and only to provide you with Graphorum.
- One instance per customer: no data shared with others.
- Data breaches: we notify you within 48 hours of discovery.
- New sub-processors: 30 days' notice and the right to object.
- At the end you download everything and delete it yourself; we remove any remaining copies.
Parties and subject matter
This agreement is part of the terms of service and applies to every Graphorum Customer (“Controller”). AM Solutions di Vera Alexandru Nicolae (“Processor”) processes the personal data contained in the Customer Data on behalf of the Controller, pursuant to art. 28 of Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code.
- Controller
- AM Solutions di Vera Alexandru Nicolae
- Legal form
- Sole proprietorship
- Registered office
- Via Potenza 12, 25125 Brescia (BS)
- VAT number
- 04419500980
- Tax code
- VRELND86B24Z129Y
- [email protected]
- Website
- www.amsolutionsbs.it
Nature, purpose and duration of processing
- Nature: hosting, storing, processing with artificial intelligence, synchronising with connected channels, backing up, exporting and deleting Customer Data; training the Customer's model; providing support and maintenance.
- Purpose: solely to provide Graphorum to the Controller, in the Local PC or Cloud plans, and the related support services.
- Duration: that of the contract, plus the period allowed for downloading and deleting the data.
Data subjects and categories of data
- Data subjects: the Controller's customers, suppliers, collaborators, employees and other contacts; the users of its Platform; people who write to the Controller on the connected channels.
- Data: identification and contact details; content of emails, chats and social media messages; documents and attachments; accounting and commercial data; voice recordings and transcripts, if the Controller uses voice; access and activity logs.
- Special categories (art. 9 GDPR) and criminal-offence data (art. 10): Graphorum is not designed to process them. If the Controller enters them, it assesses the legal basis and appropriate measures and informs the Processor.
The Controller's instructions
The Processor processes data only on the Controller's documented instructions. Instructions include the contract, this agreement, the settings the Controller chooses in the Platform (for example which channels to connect, which external AI services to switch on, how much autonomy to give the agents) and written support requests. If an instruction seems to it to infringe the law, the Processor reports it immediately.
Obligations of the Processor
- Ensure that the persons authorised to process the data are bound by confidentiality and properly instructed.
- Adopt the security measures under art. 32 GDPR described below and keep them up to date.
- Not use Customer Data for its own purposes, in particular to train artificial intelligence models other than the Controller's model, whether for other customers or for third parties.
- Help the Controller respond to data subjects' requests (arts. 15–22), with the Platform's functions (search, export, “Forget”, deletion) and, if needed, with support.
- Help the Controller meet its obligations under arts. 32–36: security, breach notification, impact assessment, prior consultation.
- Notify the Controller of any personal data breach without undue delay and in any event within 48 hours of discovering it, with the information available, so that the Controller can meet the 72-hour deadline towards the supervisory authority (art. 33).
- Keep a record of the processing activities carried out on behalf of controllers (art. 30(2)).
- Make available the information needed to demonstrate compliance with this agreement.
Sub-processors
The Controller gives the Processor general authorisation to use the sub-processors listed below. The Processor imposes on each of them the same data protection obligations as in this agreement and is liable to the Controller for them. Before adding or replacing a sub-processor, the Processor notifies the Controller 30 days in advance; the Controller may object on reasonable grounds and, if no solution is found, terminate at no cost.
| Sub-processor | What it does | Where | Warranties | When |
|---|---|---|---|---|
| Hetzner Online GmbHGermany (EU) | Cloud plan servers: computing, storage and backup of customer instances | Data centres in Germany and Finland (EU) | Processing in the EU | Cloud plan |
| Cloudflare, Inc.United States | Network and security: DNS, site protection and an encrypted tunnel to the local PC or the cloud instance | Global network, with points of presence in the EU | EU-U.S. Data Privacy Framework and standard contractual clauses (EU Decision 2021/914) | Both plans |
| Stripe Payments Europe, Ltd.Ireland (EU) | Card payments and SEPA direct debit, subscription management | EU; transfers to Stripe, Inc. (United States) | EU-U.S. Data Privacy Framework and standard contractual clauses | Payments |
| E-invoicing intermediary (default: Fatture in Cloud, TeamSystem group)Italy | Issuing and sending electronic invoices to the Exchange System (SdI) and legally compliant archiving | Italy | Processing in the EU | Billing |
| Meta Platforms Ireland Ltd.Ireland (EU) | WhatsApp Business, Facebook and Instagram, only if the customer connects these channels | EU; transfers to Meta Platforms, Inc. (United States) | EU-U.S. Data Privacy Framework and standard contractual clauses | Only if the customer connects the channels |
| External AI model providers chosen for the customer (e.g. Anthropic, OpenAI, Google, Mistral AI)EU or United States, depending on the provider | Processing of individual requests when an external AI service is switched on; never to train their models | Shown in the console for each active provider | Adequacy decision, EU-U.S. Data Privacy Framework or standard contractual clauses; contracts that rule out training on the data | Only if activated |
| Transactional email provider (to be defined, e.g. Brevo or Postmark)To be defined | Sending invoices, notices, reminders and replies to tickets | To be defined | To be defined before activation | Service communications |
With the Local PC plan, Customer Data stays on the Controller's PC: Hetzner is not involved and Cloudflare only carries the tunnel's encrypted traffic. For payments and invoices (Stripe and the SdI intermediary), AM Solutions acts as controller of the Customer's billing data: we list them here for completeness.
Transfers outside the European Union
The cloud plan's servers are in the European Union. If a sub-processor processes data outside the European Economic Area, the transfer takes place only with the safeguards of Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified providers) or standard contractual clauses (Decision (EU) 2021/914), with the necessary supplementary measures.
Technical and organisational measures
| Area | Measures |
|---|---|
| Isolation | One instance per customer, with separate database, brain, files and model; no shared component containing Customer Data. |
| Encryption | Access from outside the office only via HTTPS through the encrypted tunnel; backups encrypted with AES-256-GCM and a password-derived key (scrypt); credentials and API keys encrypted at rest in the platform's vault. |
| Access | Personal username and password, stored only as a hash (salted scrypt); two-step verification with an Authenticator app (TOTP) or by email; 15-minute lockout after too many attempts; session in an HttpOnly, SameSite=Strict cookie; permissions per person and per agent; API keys shown only once. |
| Support | Processor access only through a time-limited, signed link, recorded in the instance log and visible to the Controller. |
| Traceability | Log of the operations of users, agents and API keys, which the Controller can filter and export as CSV. |
| Incoming messages | Sorting that recognises spam, scams and phishing; the content of received messages cannot change the Controller's rules and permissions. |
| Network | Local PC plan: outbound Cloudflare tunnel, no open ports on the router; cloud plan: instances behind a tunnel, with no directly exposed services. |
| Continuity | Regular, verified backups; a restore procedure onto a new PC or a new instance. |
| External AI services | Off by default; switched on only by choice, for individual jobs; providers' keys stay on AM Solutions' server and are never sent to instances; contracts that exclude use of the data to train the provider's models. |
| Development and updates | Updates tested before release; automatic check every 5 minutes with a notification; security fixes published as a priority. |
| People | Access to data only for those who need it; confidentiality undertaking; privacy and security training. |
| Local PC plan | Data on the Controller's PC, reachable from outside only through the encrypted tunnel with no open ports; physical custody of the PC is the Controller's responsibility. |
Audits
The Controller may verify compliance with this agreement by requesting information and documents or, with at least 30 days' notice, through an inspection carried out by itself or by an auditor bound by confidentiality, during working hours and without compromising the security of other customers. The costs of the inspection are borne by the Controller, unless breaches by the Processor come to light.
End of processing
At the end of the contract, the Controller downloads all Customer Data, including its model, and deletes it itself with the Platform's functions, receiving a deletion certificate. The Processor deletes any remaining copies (including backups) within 30 days of the end of the download period, unless the law requires them to be kept.
Liability and precedence
Each party is liable in accordance with art. 82 GDPR. In the event of conflict between this agreement and the other contractual documents, this agreement prevails as regards data protection.
Version 1.0 of 9 October 2026 · AM Solutions di Vera Alexandru Nicolae. Earlier versions can be requested by email.