Data processing agreement

This page is the plain-English summary. The signed data processing agreement is the contract. We send it before onboarding, or on request at privacy@uniqproject.com.

Who decides

Your group decides what data UniqBot uses and who sees it, and remains responsible for it. Uniq Project processes it only on your instructions: the signed agreement and the settings you choose in the backoffice. You inform your staff and guests where the law requires it.

Where your data lives

Your business data sits in one database for your group, hosted in the EU, or in a database your IT hosts. UniqBot reads your systems only to answer your team, and never writes into them.

Nothing is shared between clients. Products are sorted into categories with a reference built from our own restaurants. Your product names stay in your database.

AI

An everyday phrase is turned into a command on our systems. Nothing is sent to an AI provider for that. A question for the ask command, a dataset, a PDF, or a brief composition is sent only after someone confirms, to AI models hosted in the EU, and never to train a model. Beyond the included usage, you bring your own key and your provider bills you.

A voice brief is transcribed, then the audio is deleted. Audio is not stored. The transcript and the brief stay in your database. You choose, role by role, who dictates and who reads.

Bot activity and messages

Bot activity stays in your database, at the level and for the time you choose, from 30 days to a year. An everyday phrase is stored as the command it became. The original words are kept only if you chose to keep content. Only the accounts you name can read it, and each reading is audited. We have no access to that text. Reports, files and camera images are not kept.

Messages travel through WhatsApp, Telegram or Slack, the chat your people already use. Answers can erase themselves from phones after 12 or 24 hours. A copy in your database exists only at the activity level you set.

Our commitments

• Sub-processors: listed on the sub-processors page. We tell you 30 days before adding or replacing one, and you can object.
• Incidents: we notify you within 48 hours of becoming aware of a breach affecting your data, so you can meet your own deadlines.
• Your requests: we help you answer the people who ask about their data.
• Audits: our security documentation is available, and you can audit us once a year.
• End of contract: you can export your data for 30 days. We keep an encrypted archive for 30 more days, then delete everything and give you a certificate of deletion. Backups roll over within 7 days.