01Subject and duration
The processor operates SOULGHOST for the controller: it receives fan messages from connected Telegram accounts and bots, generates and sends replies, delivers vault media and keeps a memory of each fan. This agreement runs as long as the controller uses the service and ends with the last processing of controller data.
02Data and people concerned
- People concerned: the controller's fans and contacts on connected accounts, and the controller's team members.
- Data: Telegram IDs, names and usernames; message text, images, stickers and voice messages; replies sent; facts the AI extracts about each fan (e.g. preferences, mood, purchases); media delivered and purchase history.
Conversations may reveal data about sex life or sexual orientation (Art. 9 GDPR). The controller is responsible for having a legal basis for this processing and for informing fans.
03Instructions
The processor processes controller data only on documented instructions: these terms, and the settings the controller makes in the dashboard. Processing is allowed otherwise only where EU or member state law requires it; the processor then informs the controller beforehand unless that law forbids it. If the processor believes an instruction infringes data protection law, it tells the controller.
04Confidentiality
Everyone authorised to process controller data is bound to confidentiality, by contract or by law.
05Security measures
The processor takes the technical and organisational measures required by Art. 32 GDPR, in particular:
- encryption of all connections (TLS) and of stored data at rest;
- access to production systems only for authorised people, with individual accounts and least privilege;
- logical separation of each controller's data, enforced on every request;
- private media storage without public links; media is shown only through short-lived signed URLs;
- secrets kept in the hosting providers' encrypted secret stores, not in code;
- backups by the storage provider, and regular review of these measures.
06Sub-processors
The controller generally authorises the use of sub-processors in these categories. The processor sends the current list with each sub-processor's name and location to the controller on request to syntex.interactive@gmail.com.
| Sub-processor | Task |
|---|---|
| Hosting providers (USA) | Hosting of the dashboard, the API and the messaging service |
| Database and storage provider (USA) | Database and file storage |
| AI providers (USA) | Generating replies, classifying messages, analysing images and voice messages |
The processor imposes the same data protection obligations on each sub-processor. It announces new or replaced sub-processors to the controller by email at least 14 days in advance; the controller can object on reasonable data protection grounds and, if no solution is found, terminate. Transfers outside the EU rely on an adequacy decision or the EU Standard Contractual Clauses.
07Assistance
The processor helps the controller, as far as possible, to answer requests from fans exercising their rights (Art. 12–22 GDPR) and to meet its obligations under Art. 32–36 GDPR. If a fan contacts the processor directly, it forwards the request to the controller without delay.
08Data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach affecting controller data, with the information the controller needs for its own notifications.
09Deletion at the end
When the service ends, the processor deletes all controller data within 30 days, unless the law requires it to keep data. On request before that, the controller can receive an export of its data.
10Information and audits
The processor makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows audits by the controller or an auditor it appoints, with reasonable notice and without disrupting operations. Requests go to syntex.interactive@gmail.com.