Data processing agreement (DPA)

The Customer, the professional holding a Woozi account, is the controller of the personal data of its own clients, prospects and contacts. Hashmi Tonmoy, sole trader (entrepreneur individuel, EI), trading name extrakt.app, brand Woozi, 54 Rue Diderot, 92600 Asnières-sur-Seine, France ("Woozi"), is its processor. The data of the account users themselves is processed by Woozi as controller, under the privacy policy.

Subject matter: providing the Customer with the Woozi service described in the CGV. Duration: that of the contract, then the time needed for the deletion or return set out below. Nature: collection through Meta's platforms and the booking page, storage, organisation, consultation, transmission, generation of automated replies, sending messages and erasure. Purpose: letting the Customer communicate with its clients and manage its appointments.

• Receiving, storing and sending WhatsApp, Instagram and Messenger messages, including media and voice messages.
• Managing contact records, tags, notes and the pipeline.
• Replies and drafts generated by Woozi AI from the conversation, the context the Customer provides and its knowledge base.
• Bookings: made, moved or cancelled by Woozi AI in the conversation or by the Customer's client on the public booking page, booking verification by WhatsApp or email, waitlist and offers of freed slots, attendance tracking.
• Appointment reminders 24 hours and 4 hours before, by email and on WhatsApp where the conversation allows it, confirmations and cancellations, sent in the Customer's name.
• Google review requests after an appointment, if the Customer turns them on.
• Automations and broadcasts the Customer configures.
• Notifications to the Customer's team members (in the app, by email and by push notification).
• Support and security, as set out under "Confidentiality and staff access".

Data subjects: the Customer's clients, prospects and contacts who message it or book with it.

• Identity and contact details: name or profile name, phone number, Meta identifier, email, company.
• Content: text messages, voice messages, images, videos, documents, button choices, dates and delivery statuses.
• Bookings: service, location, date and time, notes, booking code, verification method and status, language, attendance confirmation, no-show, cancellation intents, waitlist.
• Data the Customer adds: tags, custom fields, notes, pipeline stage, marketing consent.
• Booking page technical data: the visitor's IP address and the result of the Turnstile anti-bot check (rate limiting and abuse prevention).

Woozi is not a certified health data host (HDS). The Customer must not use the service to keep medical records or health data that would require such a host, and limits sensitive data to what is strictly needed to book appointments.

Woozi processes the data only on the Customer's documented instructions, including for transfers outside the European Union. The instructions are this agreement, the CGV and the actions the Customer takes in the service (settings, messages, automations, bookings). If an instruction seems to Woozi to breach the GDPR, Woozi tells the Customer. Woozi does not use this data for any other purpose, does not sell it and does not use it to train an AI model.

Only authorised members of the Woozi team access production systems, and they are bound by confidentiality. They can open a conversation's content only for support or security; every opening is recorded (who, when, which conversation), and the conversation does not open if recording fails.

• Account isolation at the database level (row-level security); every query is limited to the Customer's account.
• Meta access tokens and AI provider keys encrypted (AES-256-GCM) with a key held outside the database.
• Encrypted traffic (TLS); signature checks on Meta and payment webhooks.
• Private storage for conversation media.
• Public API keys stored as hashes; invitation links stored as a digest.
• Anti-bot check and rate limiting on the booking page.
• Logging of staff access to conversation content and of administration actions.
• Error tracking without users' names or emails.

The Customer authorises Woozi to use the following sub-processors:

• Supabase (Supabase Pte. Ltd., Singapore): database, authentication, file storage and sign-in emails. Data hosted in the European Union (Ireland). Any access from outside the EU covered by standard contractual clauses.
• Vercel (Vercel Inc., United States): application hosting and execution, technical logs. Data Privacy Framework or standard contractual clauses.
• Meta (Meta Platforms Ireland Ltd and Meta Platforms, Inc.): transmission of WhatsApp, Messenger and Instagram messages, and WhatsApp message templates. European Union and United States, Data Privacy Framework or standard contractual clauses. Meta also processes these messages under its own terms, which the Customer accepts directly.
• Anthropic (Anthropic PBC, United States): generating Woozi AI replies (default provider). Data Privacy Framework or standard contractual clauses.
• OpenAI (United States): generating replies when the Customer chooses OpenAI, and indexing the knowledge base and the latest message for search. Data Privacy Framework or standard contractual clauses.
• Resend (United States): sending emails to the Customer's clients (booking confirmations, verifications, reminders and cancellations) and to account users. Data Privacy Framework or standard contractual clauses.
• Cloudflare (Cloudflare, Inc., United States): Turnstile anti-bot check on the booking page (visitor IP address and a technical token). Data Privacy Framework or standard contractual clauses.
• Sentry (Functional Software, Inc.): technical error tracking, European Union region (Germany).
• Browser push services (Google, Apple, Mozilla): push notifications to the Customer's team members who turned them on (contact name and the start of the message, encrypted payload).

Woozi imposes on each one data protection obligations at least equivalent to those of this agreement and remains responsible for their compliance. Woozi tells the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; failing agreement, it may cancel its subscription before the change takes effect.

The database is hosted in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (notably the EU-US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.

The service gives the Customer the tools to answer people's requests: view and correct a contact record, export a contact's booking data (JSON) and the contact list (CSV), delete a contact with its conversations. If a person contacts Woozi directly, Woozi passes the request to the Customer without delay and helps it respond. For a request the tools do not cover (for example exporting conversations, or erasing the media files of a deleted contact), Woozi handles it at the Customer's request to tonmoy@woozi.cloud.

Woozi notifies the Customer of any personal data breach affecting its data without undue delay and at the latest 48 hours after becoming aware of it, at the account owner's email address. The notice describes, as far as possible, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. It is for the Customer to notify the CNIL and the people concerned where required; Woozi helps it do so.

Woozi helps the Customer, on request and as far as the information it holds allows, with its data protection impact assessments and prior consultations of the CNIL.

Before the contract ends, the Customer can export its data with the tools described above and ask Woozi to help with the rest. When the contract ends, the data is kept until the Customer deletes its account or asks Woozi to. Deleting the account immediately erases its contacts, conversations, messages, bookings, automations and files. Copies in the hosts' backups are erased on their normal cycle. Woozi then keeps only what the law requires and what the privacy policy describes.

Woozi makes available to the Customer, on request, the information needed to show compliance with this agreement. The Customer may have an audit carried out, at most once a year unless there is a proven breach, with 30 days' notice, at its own cost, during working hours, by an auditor bound by confidentiality and with no access to other Woozi customers' data.

The CGV's liability limits apply to this agreement, unless the law provides otherwise. This agreement lasts as long as Woozi processes the Customer's data. It is governed by French law, as set out in the CGV.

For any question about this agreement or about data protection: tonmoy@woozi.cloud.