Your customers’ data, in Europe and yours alone

Isolation between companies

Each company works inside its own organisation. On every request the server checks which organisation you belong to and what role you hold, and it trusts no identifier sent from the browser.

• Your agents, sources, conversations and leads are only accessible to the users in your organisation.
• The iAgentify admin panel uses accounts, sessions and keys that are separate from customers’.
• Any access to an account by our support team is logged.

Access and accounts

You decide who gets in and what they can do.

• Four roles: owner, admin, member and viewer. A viewer can only read; billing belongs to the owner.
• Short-lived sessions renewed with a cookie that the browser does not expose to page scripts.
• Temporary account lockout after several failed login attempts.
• Email verification at sign-up.
• An activity log for admins: who changed what, and when.

Channels and credentials

To connect WhatsApp and Instagram we store the credentials Meta gives us. They are stored encrypted and are never returned, in the dashboard or through the API.

• Notifications from Meta and from the payment gateway are verified by signature before they are processed.
• You can disconnect a channel at any time from the dashboard.

The chat on your website

The widget identifies itself with a public key, which by definition anyone can see. So the key alone is not enough: the server also checks which domain each request comes from.

• You list the authorised domains and, from then on, it only works on those.
• Each visitor receives a signed session that expires after 24 hours.
• Public endpoints are rate limited to curb abuse.

AI and your data

To write a reply we send the language-model provider (OpenAI) the customer’s message, the conversation context, your agent’s instructions and the relevant passages from your knowledge base. Nothing else.

iAgentify does not use your conversations or your documents to train AI models. Under OpenAI’s terms for its API, data sent that way is not used to train its models by default either.

A language model can make mistakes. That is why answers are grounded in your sources, you can see which one was used, and a person can take over any conversation.

Payments

Payments go through Redsys, the Spanish banks’ payment gateway. Card details are entered on the bank’s page; iAgentify neither receives nor stores them. We keep a reference for renewals and the last four digits so you can recognise the card.

A payment only counts once the bank confirms it to us with a signed notification.

GDPR

For your customers’ data, you are the data controller and iAgentify acts as the processor: we process it only to provide the service and on your instructions. For your account data, the controller is ACTUAL GRANOLLERS, S.L..

The contact forms in the chat and on this website ask for explicit consent. You can ask us for access to, correction of or deletion of your data at any time.

Providers involved

These third parties process data on behalf of iAgentify in order to provide the service.

The full detail is in the privacy policy.