Data processing agreement for AI chatbots and Mira

1. Parties and subject matter

The controller is the customer who uses an AI chatbot from their SPEKTRA account on the website SPEKTRA built and operates for them, or the AI phone voice Mira. The processor is SPEKTRA – Raul Tatzber, Feldgasse 70/3, 2232 Deutsch-Wagram, Austria.

The subject matter is operating the AI chatbot: messages that visitors to the customer's website type into the chat window are received, answered with the help of an AI model, and the answer is sent back.

If the customer instead or additionally operates Mira, the subject matter also covers: receiving incoming calls on the phone number the customer has set, answering them with the help of an AI language model and a voice output, and — only where the caller expressly asks for it — noting down a callback appointment.

If the customer uses the workshop (changes to the website made with AI, terms section 8e), the subject matter also covers processing the website files needed for a commissioned change — insofar as they contain personal data, such as names, photos or contact details of staff — in order to generate, check and preview the change.

2. Term

This agreement applies as long as the customer operates at least one AI chatbot or Mira with SPEKTRA or can use the workshop. It ends when the last bot, Mira, the last care plan for the website or the account ends or is deleted.

3. Types of data and data subjects

Data subjects are the visitors to the customer's website who use the chat, and — for Mira — the people who call.

For the chat, processed are: the content of the messages and of the conversation so far (only while answering), the IP address (to prevent abuse; only a non-reversible check value that changes daily is stored, for no more than two days), and the time. SPEKTRA does not store the content of conversations. Per bot and day only counts are stored: number of messages, tokens used and cost.

For Mira, processed are: the spoken content, only while it is being answered (no recording — the audio is turned into text, acted on and discarded), the time and length of the call, and at the end a structured summary without names or numbers. If the caller expressly asks for a callback, the contact and enquiry details given for that are added. (The free demo on spektra-sites.com additionally limits calls per visitor per day through its own counters, described there — that does not affect the customer's own Mira.)

Neither the chat nor Mira is intended for special categories of personal data (Art. 9 GDPR). The chat window tells visitors not to enter sensitive data.

For the workshop, data subjects are people whose data the customer publishes on the website. Only the website files needed for the commissioned change are processed; they are kept in the website's version control. The workshop does not process visitors' data.

4. Instructions

SPEKTRA processes the data only on the customer's documented instructions. The bot's settings in the account (knowledge, behaviour, limits, domains) are these instructions. Further instructions are given in text form (email is enough). If SPEKTRA considers an instruction unlawful, SPEKTRA says so without delay.

5. SPEKTRA's obligations

SPEKTRA commits everyone with access to the data to confidentiality, takes the technical and organisational measures in section 7 (Art. 32 GDPR), assists the customer in answering requests from data subjects (Art. 12–22 GDPR) and with the obligations under Art. 32–36 GDPR, reports a personal data breach without delay, provides all information needed to demonstrate compliance and allows audits, and deletes all personal data from the processing after the agreement ends, unless the law requires it to be kept.

6. Sub-processors

The customer agrees to the following sub-processors: Anthropic PBC (USA) — generating answers with the AI model, for chatbots and for Mira, and generating and pre-checking website changes in the workshop; Vercel Inc. (USA) — hosting and running the customer website, the chat window or Mira's interface and the respective API, and building the workshop preview; GitHub, Inc. (USA) — version control of the customer website's source code (workshop); Neon Inc. (USA) — database for counts and settings (no conversation content); ElevenLabs Inc. (USA) — voice output for Mira.

Transfers to the USA are safeguarded by the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) and, where the provider is certified, by the EU-U.S. Data Privacy Framework. SPEKTRA binds every sub-processor to equivalent data protection obligations.

SPEKTRA announces a new or changed sub-processor by email at least 30 days in advance. The customer may object for good reason; if no agreement is reached, they may end the bot or Mira at no cost.

7. Technical and organisational measures

Encrypted transmission (TLS) throughout. No storage of conversation content. IP addresses only as a non-reversible check value (HMAC) that changes daily, deleted after two days at the latest. The chat window can only be embedded on the domains the customer has approved (enforced by the browser). Limits on messages per visitor per day, per IP address, and on daily cost per bot. A separate access key for the AI connection. Access to the account and administration only after sign-in; passwords are stored only as a hash.

For Mira, in addition: there is no function that stores audio or a raw transcript persistently — the audio is streamed, acted on and discarded. Before each call, the highest possible cost is set aside from the customer's own credit; if the credit does not cover it, Mira does not take the call (section 8b/8d of the terms).

8. The customer's obligations

The customer is responsible for the lawfulness of the processing, informs the visitors of their own website or the callers of their own Mira about it in their own privacy policy (a text block is available in the account), and does not ask for sensitive data in the chat or on the phone. They do not put personal data of third parties into the bot's knowledge, or into what they give Mira, that is not meant for it.

9. Booking module

If the customer uses the booking module on their own website built by SPEKTRA, the subject matter additionally covers: appointment management for the business — receiving appointment requests from visitors to that website, managing them (confirming, declining, marking done) by the customer, and an optional calendar subscription for the customer's own calendar app.

Data subjects are the business's customers who request an appointment. Processed: name, phone number, optionally an email address, service address and location, vehicle details, chosen services, the appointment (date, time), and an optional message, plus, to prevent abuse, a non-reversible check value of the IP address that changes daily (HMAC).

Personal fields are automatically deleted or anonymised six months after the appointment; only the appointment data itself (date, time, services, status) remains for the customer's statistics. On the customer's express instruction, SPEKTRA deletes earlier.

Sub-processors for the booking module are the same named in section 6 for hosting and database (Vercel Inc., Neon Inc.) plus — for the content-free notification emails to the customer and the status emails to their customers — Google Ireland Limited (Google Workspace). No new sub-processor not already named there is added.

The calendar subscription link (webcal://…) is the customer's own secret — whoever has it can see their appointments. SPEKTRA does not pass it on and shows it in the account only once, right after it is generated.

10. Liability and final provisions

Liability is governed by Art. 82 GDPR and otherwise by SPEKTRA's terms. Austrian law applies. Where this agreement and the terms conflict, this agreement prevails for the processing of personal data.