This agreement applies automatically between you (the customer) and Kalmly from the moment you accept the terms of service. It covers the personal data of your customers that passes through Kalmly, as required by article 28 of the GDPR. You do not need to sign anything; if your company needs a signed copy, email hello@kalmly.io.
1. Roles
For the data about your customers that you connect (order lines, bookings, lead records), you are the controller and Kalmly is your processor. For your own account data (your email, settings, chat), Kalmly is the controller, and the privacy policy applies.
2. Subject matter, duration, nature and purpose
Kalmly processes the data on your instruction, for as long as your account exists, for one purpose: to judge your advertising on your real results and to write the first look, the morning update, the chat answers and the actions. Nothing else.
3. Types of data and people concerned
From your shop, booking tool or lead source: the date, the amount, the product, service or form name, and, for leads, the fact that a lead arrived and from which ad. The people concerned are your customers and the people who enquired with you. We do not request names, addresses, emails, phone numbers or payment details, and where a source sends more than we asked, we keep only the fields above.
4. Your instructions
Your instructions are these terms, the settings on your page and the connections you make. We process the data only on those instructions, unless EU or Dutch law requires otherwise, in which case we tell you first where the law allows it. If we think an instruction breaks the law, we tell you.
5. Confidentiality
Only the people who run Kalmly can access the servers, each bound to confidentiality, and only when it is needed to run or support the service.
6. Security
Encryption at rest for keys and settings; encryption in transit for all traffic; hosting in the EU; access limited to named people with two-factor login; separation between customers so one can never see another's data; daily backups; logs kept for 30 days. We tell you without undue delay, and at the latest within 72 hours of learning about it, if a breach affects your data, with what we know and what we are doing.
7. Sub-processors
You authorise the providers listed in the privacy policy: our EU hosting provider, Anthropic (the words of each check; no training on your data), Stripe (payments), Resend (email), Telegram (only if you link it). Each is bound by a written agreement with at least these obligations. We email you 30 days before adding or replacing one; if you object on reasonable grounds and we cannot resolve it, you can end the service and we refund any prepaid period beyond that date.
8. Help with your obligations
If one of your customers asks you about their data, we help you find, correct, export or delete it within 10 working days. We help you with data protection impact assessments and with the authorities, as far as it concerns Kalmly's processing.
9. Transfers outside the EU
Your customers' data is stored in the EU. Anthropic (US) receives the numbers of each check, not individual order or lead lines, under the EU standard contractual clauses and, where it applies, the EU–US Data Privacy Framework.
10. Deletion and return
Disconnect a source and its key is revoked immediately. Delete your account and the data is removed within 24 hours and from backups within 30 days. On request before deletion, we export your data in a common format.
11. Audits
Once a year, on 30 days' written notice, you may ask us for the information needed to show we meet this agreement, or have an independent auditor bound by confidentiality review it at your cost, in a way that does not disrupt the service or expose other customers' data.
12. Liability and law
The liability limits, the law and the court in the terms of service apply to this agreement. It is governed by Dutch law and the GDPR.
Processor: WOGO Amsterdam B.V., Oude-IJsselstraat 32-2, 1078 CP Amsterdam, the Netherlands. Chamber of Commerce (KvK) 92237347, VAT NL865949323B01. Contact: hello@kalmly.io.