What we do with your company's data.

1. Parties and scope

This agreement is part of the Terms of service between the company that uses Clemali, which is the controller, and Clemali which is its processor. It applies on every plan to the personal data Clemali processes on the company's behalf: what its connected sources, its document index and its conversations contain. For the accounts of its people, billing and the website, Clemali is the controller, as the privacy policy describes. Where this agreement and the Terms differ on personal data, this agreement prevails.

2. What is processed, and why

• Subject and purpose. Running the assistants and developer URLs the company sets up: answering the questions of the people it allows, from the sources it connects, and carrying out the actions they confirm.
• Nature. Reading the connected sources with the authorizations the company gives; for the document folders an admin chooses, extracting the text of the files, splitting it into passages, computing embeddings and keeping them in a search index; sending the questions and what was read to the model provider, which writes the answers; showing the answers in the app, posting them in Slack or Microsoft Teams, and returning tool results to the agents people connect; keeping conversations; deleting all of it as section 8 describes.
• Duration. As long as the company uses the service, then the deletion times of section 8.
• Data. What the company's sources hold and its people ask: for example emails with their senders and recipients, calendar events and their participants, documents and their text, spreadsheet and database rows, questions, answers and the documents they cite, and the names and email addresses of the company's people. The company decides what it connects; special categories of data are processed only if its sources hold them.
• Data subjects. The company's members, and the people who appear in its sources: colleagues, customers, suppliers, correspondents.

3. Instructions

Clemali processes this data only on the company's documented instructions: the Terms, this agreement and the settings its admins choose in the console (sources, folders, access, retention). Where EU or French law requires otherwise, Clemali tells the company first, unless that law forbids it. Clemali tells the company when it believes an instruction infringes data protection law.

4. Confidentiality

The people at Clemali who can reach this data are bound by confidentiality. They do not read customer content except to investigate a security incident or at the company's request. Staff screens show counts, not the text of indexed documents; staff sign in with two-factor authentication, and their actions on a company are recorded.

5. Security

Clemali keeps the measures described on the security page, among them:

• encryption in transit (TLS) between people and Cloudflare, and between Cloudflare and Clemali's servers;
• credentials and authorizations encrypted with AES-256-GCM, one data key per assistant, wrapped by a master key kept outside the database and its backups, and never shown back through the product;
• a separate tenant for each company, and each assistant's sources and folders served only to the people allowed to use it, checked at every read;
• passwords hashed with Argon2id, optional two-factor authentication, and, on Team and Enterprise, sign-in that owners can restrict to Google, Microsoft or GitHub;
• a call log that keeps neither arguments nor results, and an audit log of changes made in the console;
• a daily database backup, kept 14 days on the same servers, without the document index.

6. Sub-processors

The company authorizes Clemali to use the sub-processors listed on the sub-processors page, each bound by data protection terms as a processor. Clemali emails the owners of every company at least 30 days before adding or replacing one. The company may object during that time, in writing to [email protected]; if Clemali cannot meet the objection, the company may cancel before the change takes effect. Some sub-processors may process data outside the EU, as the list shows: those transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified providers, or on the Commission's standard contractual clauses. Clemali remains responsible to the company for its sub-processors.

7. Assistance

• People's rights. Admins remove sources, folders, members and access in the console, and each person deletes their own conversations; the index follows the sources, so a file changed or deleted there changes or leaves it at the next sync. For anything else, Clemali helps on request at [email protected].
• Security, impact assessments, the authority. Clemali gives the company the information it has about its processing, to help it secure the data, assess the impact of its processing and consult the CNIL where needed.
• Breaches. Clemali notifies the owners of the company without undue delay after becoming aware of a personal data breach affecting its data, with what is known at that point, and follows up as it learns more.

8. End of the service

The company ends the service by deleting its assistants, or by removing its members and deleting the last account, which deletes the company and cancels its subscription at once. At its choice, Clemali deletes its data or, on a request to [email protected] before the end, returns its conversations and settings in a machine-readable format; the documents themselves stay in the company's own sources, which Clemali only reads. Deletion follows these times, unless EU or French law requires Clemali to keep something longer:

• Document index: out of search at once, and deleted within 24 hours, when its folders or its source are removed or its assistant is deleted; 14 days after its authorization stops working; 7 days after the plan stops including document search. After a downgrade to a smaller plan, the text of the documents beyond its limits is deleted after 7 days.
• Credentials and authorizations: unreadable at once when their assistant is deleted, whose vault key is destroyed.
• Conversations: as the company's retention setting says (90 days by default); with “Keep”, Clemali deletes them on request. A conversation someone deletes is deleted within a day.
• Unanswered questions: 30 days at most.
• Call log and audit log: as the plan sets, and 30 days after the company is deleted.
• Backups: 14 days after the data left the database.

9. Audits and information

Clemali makes available the information needed to show that it meets its obligations under Article 28 of the GDPR: this agreement, the sub-processors list, the security page and answers to the company's questions. It allows and contributes to audits by the company, or by an auditor it mandates who is bound by confidentiality, on 30 days' notice and at most once a year, unless a breach or an authority requires otherwise.

10. Language

This agreement exists in French and in English; if they differ, the French version prevails.