Data Processing Agreement
Last updated: 31 July 2026
Version 1.0 · Effective 31 July 2026
When your business uses BookMe AI, we process your customers' personal data on your behalf — you are the controller, Mythril-Tech S.R.L. is the processor. This Data Processing Agreement (DPA) governs that processing under GDPR Article 28.
The DPA consists of our Cover Page and the Common Paper DPA Standard Terms v1.1, incorporated by reference. It is accepted electronically when you create a BookMe AI account — no signature required. We record the accepting account, timestamp, and version.
Summary of key terms
Processor: Mythril-Tech S.R.L., Str. Rapsodiei nr. 7, Sc. 1, Et. 4, Ap. 10, Cluj-Napoca, Cluj County, Romania, CUI 47085909, trade registry J2022006613129. Governing law: Romania. Supervisory authority: ANSPDCP.
What we process: your customers' names, phone numbers, WhatsApp messages, and appointment details; your staff account data; and the credentials needed to run the service (WhatsApp Business tokens, Google Calendar OAuth tokens).
Health data: if you are a healthcare provider, the existence and type of an appointment may reveal health information (GDPR Art. 9). Our assistant is designed to collect scheduling data only and never to ask for symptoms or diagnoses. You remain responsible for your lawful basis under Art. 9(2).
AI processing: message text is processed by Google Gemini or OpenAI solely to generate scheduling replies; it is not used to train models. You should tell your customers an automated assistant is in use — it also identifies itself as automated.
Subprocessors: listed at /subprocessors; 10 business days' notice before changes, 30-day objection right.
Security: the measures at /security form our Security Policy under the DPA. Breach notification within 72 hours of awareness.
Deletion: account deletion removes data from production immediately; termination triggers deletion or return within 30 days; backups are purged within 90 days. Events already written to your own Google Calendar stay in your calendar.
Data subject requests: if your customer contacts us directly, we notify you within 5 business days and assist on your instruction; responding to your customers remains your responsibility.