Data Processing Addendum
This DPA forms part of the Terms of Service between you (the data controller) and Seny (the data processor) and reflects our commitments under GDPR and other privacy laws.
Subject matter
Seny processes personal data on your behalf solely to provide and improve the service. We process data in accordance with your documented instructions.
Sub-processors
We use the following sub-processors to deliver Seny:
- Vercel — application hosting
- Supabase — database, authentication, and file storage
- Google Cloud — hosts the conversation engine and site crawler
- Google Gemini — AI inference for voice and chat conversations
- Twilio — telephony and SMS delivery
- ElevenLabs — voice synthesis
- Resend — transactional email delivery
- Cloudflare — network-layer proxying for select integrations
- Stripe — billing and payments
We'll notify you of any changes to this list at least 30 days in advance.
Security
Data is encrypted in transit (TLS 1.2+) and at rest. Access is role-based, audit-logged, and limited to personnel who need it.
Data retention & deletion
You can request deletion of any individual conversation, transcript, or contact at any time, and we action it immediately. When an account is closed, we retain its data for 90 days (to allow recovery from an accidental closure) before permanently deleting it. Deleted data may persist briefly afterward in encrypted backups.
Breach notification
If we confirm a security incident affecting your data, we will notify you within 72 hours of that confirmation.
International transfers
Where data is transferred outside the EEA, we rely on the Standard Contractual Clauses approved by the European Commission.
Sign a copy
Need a countersigned DPA? Email legal@seny.ai with your company name and we'll send one over.