Data Processing Agreement

Last updated: 2026-10-15.

This Data Processing Agreement ("Agreement") is part of the Terms and Conditions between you (the "Customer") and Business Creatives LLC, a Delaware limited liability company doing business as ISMIRO at www.ismiro.com ("we" or "us"). It applies when you use the Sales Agent or the Cloud Quoter and, in doing so, entrust us with personal data about your own customers or prospects. You accept it when you sign up for those products, with no separate signature needed.

1. Roles

For the personal data of your end customers (for example, the name, phone number and messages of someone who writes to your agent, or a customer's details on a quote), you are the controller and we are your processor. You decide what it's used for; we process it only to provide the Service to you. For your own account data, we are the controller and our Privacy Policy applies.

2. Subject matter, duration and purpose

We process the data to: reply to your customers on your behalf over the channels you connected, record leads and quotes in your dashboard, send you lead alerts, generate and share quotes, and keep backups and the Service secure. Processing lasts while you have the product, plus the deletion periods in Section 9.

3. Categories of data and data subjects

Data subjects: your customers and prospects, and your team members. Data: name, phone number, email, messaging channel identifier, message content (text, photos and audio), quote data, and the technical data those conversations generate. We don't need or ask for sensitive data; if your customers send it on their own, it gets the same safeguards and you decide what to do with it.

4. Only on your instructions

We process the data only on your documented instructions: these Terms, this Agreement and the configuration you set in your dashboard or ask us for through support. If an instruction seems unlawful to us, we'll tell you. We don't sell your customers' data, don't use it for our own advertising and don't use it to train AI models.

5. Confidentiality

Only the people on our team who need it to provide the Service or support you have access to the data, and all of them are bound by confidentiality.

6. Security

We apply the measures described in Section 10 of the Privacy Policy and Section 38 of the Terms: encryption in transit, data separated by company, session and role-based access, key-derived password hashing, logging of administrative access, and encrypted backups in private storage.

7. Subprocessors

We rely on the providers listed in Section 25 of the Privacy Policy, with the country where each one processes: Cloudflare (infrastructure, and the Agent's photo description and audio transcription), DeepSeek (the Agent's primary AI model, which processes in the People's Republic of China), OpenAI (fallback model), Meta (message delivery), Stripe (payments) and Resend (email). We make sure each one is bound to protect the data. We'll give you at least 30 days' notice before adding or changing a subprocessor that handles your customers' data; if you disagree, you can cancel before that date.

8. International transfers

Data may be processed outside your country, in the United States and, for the Agent's and the support assistant's conversations, in the People's Republic of China (DeepSeek), as listed in Section 25 of the Privacy Policy. Where your country's law requires it, this Agreement serves as the transfer contract or contractual clauses covering that transfer, and we'll give you the information you need for your own privacy notice.

9. Deletion and return

You can export your data at any time from your dashboard. When you cancel a product or close your account, we keep the data for 30 days in case you change your mind and then delete it; backups overwrite themselves within 35 more days. If you ask for immediate deletion, we do it within 15 days. We keep only what the law requires, such as billing records.

10. Data subject rights

If one of your customers asks us directly to access, correct or delete their data, we pass the request to you, because you are the controller. We help you respond with what we have in the Service: exporting, correcting or deleting their conversations and data, within timeframes that let you meet yours.

11. Security incidents

If we confirm an incident affecting your customers' personal data, we notify you without undue delay and, where possible, within 72 hours, with what we know: what happened, which data was affected, what we did and what we recommend. We help you with any notices you have to give to an authority or to the people affected.

12. Audit

On reasonable request, once a year, we answer a security and privacy questionnaire and give you the information needed to show we comply with this Agreement. An on-site audit is agreed separately and at your cost.

13. Your obligations

You are responsible for having a legal basis to process your customers' data and for telling them, in your privacy notice, that you use an AI virtual assistant operated by a provider. The Agent lets you set a link to your privacy notice so it mentions it when asking for contact details.

14. Liability and order of precedence

The limitations of liability in the Terms apply to this Agreement. If anything in this Agreement conflicts with the Terms on data protection, this Agreement prevails. Governing law and dispute resolution are those in Section 22 of the Terms (the State of Delaware, United States).

15. Contact

For anything about this Agreement, email us at soporte@ismiro.com. If your company also needs a signed copy, ask at that same address.