Data protection policy

1. Principles

We handle data according to these principles:

• Purpose: only to provide the service the client hired.
• Minimization: we connect and use only the information each agent needs.
• Confidentiality: access is limited to the people working on the project, under confidentiality agreements.
• Security: technical and organizational measures proportionate to the risk.
• Transparency and control: the client knows what data is processed, where and with which providers, and approves every agent before it goes live.
• Accountability: we document what we do and answer for it.

2. Who answers for each piece of data

• When we build and run agents for a company, the client company is the controller of the data of its customers, patients, applicants or employees, and Qovant acts as a processor: we process that data only on the client's documented instructions and to provide the service.
• Qovant is the controller of the data from its own business relationships (contacts, billing and communications), as explained in the Privacy policy.
• The client is responsible for having a legal basis to process the data it gives us and for informing the people concerned; we support it with any technical information it needs.

3. Your data is yours

The data, knowledge bases, workflows and configurations of each project belong to the client. We don't use them for our own purposes, we don't sell them and we don't share them with other clients. If the service ends, we deliver a full export in commonly used formats and, once delivered, delete the information from our systems within 30 days, unless the law requires us to keep it.

4. Responsible use of artificial intelligence

• Agents answer only with the client's information and rules. If something isn't there, they say so instead of making it up, and hand the conversation to a person with full context.
• We choose the model for each task among leading providers (such as Anthropic, OpenAI or Google) and open-source options, under terms that don't allow the client's data to be used to train models.
• We don't use agents to make decisions with legal or similarly significant effects on people without human involvement. In hiring, healthcare or credit, for example, the final decision always rests with a person on the client's team.
• Nothing goes live without the client's approval, and every month we review the agents' performance with real data.

5. Security measures

• Encryption of data in transit and at rest in our infrastructure and our providers'.
• Role-based access with least privilege, revoked when each project ends.
• Protected credentials: integration keys are stored as server-side secrets, never in code or in the browser.
• Activity logs and agent monitoring.
• Separation by client and, on the Ecosystem plan, a dedicated environment.
• Confidentiality agreements with our team and our providers.
• Provider assessment before we bring any provider on board.

6. Providers and subprocessors

To deliver the service we use specialized providers, who act as subprocessors under confidentiality and security obligations equivalent to ours. Depending on the project, they may include AI model providers (for example, Anthropic, OpenAI or Google), cloud infrastructure and databases (for example, Supabase), process automation (for example, n8n), messaging (WhatsApp Business, by Meta) and the client's own systems that we integrate. We provide the current list of subprocessors for each project on request and notify the client of relevant changes.

7. International transfers

Some providers process data outside the client's country, including in the United States. We disclose this in each project and back it with contractual data protection obligations. If the client needs data hosted in a specific region, we assess it and, where possible, set it up that way.

8. Security incidents

If we detect an incident affecting a client's data, we contain it, assess its scope and notify the client without undue delay and, where possible, within 72 hours of becoming aware of it, with the information available and the measures taken. We work with the client on any notifications it must make to authorities or affected people.

9. Requests from data subjects

If someone asks us to exercise their rights over data we process on behalf of a client, we forward the request to the client and help it respond on time.

10. Retention and deletion

We keep each project's data only while the service is active or as the client instructs. When it ends, we apply the export and deletion described in section 3.

11. Data processing agreement

Together with the service contract, we sign a data processing agreement that sets out instructions, security measures, subprocessors and timelines. If you need it before hiring us, ask for it at hello@qovant.ai.

12. Contact

For data protection questions, write to us at hello@qovant.ai with the subject "Data protection".