05Data processing agreement

• You (the business that buys the dashboard or the build) are the controller of your store's data.
• Bottari Studio is the processor: it provides a data processing service on your behalf (art. 25 of Ley 25.326).

This agreement is part of the terms and of the service conditions. It applies while you have a plan or a build in progress and, after that, until the deletion described in the When it ends section is complete.

We do not process card numbers: if your store takes payments online, the payment provider you choose does that. Do not enter sensitive data (health, religion, political opinions) in the dashboard or in the AI.

If you use dashboard features that record what your team does, tell each person what is recorded and what for before they start using it (art. 6 of Ley 25.326).

We process the data only to provide the service, under this agreement and what you ask us through the dashboard or in writing. We do not use it for anything else (art. 25, item 1, of Ley 25.326). If an instruction seems to us to go against the law, we tell you before doing anything.

In your accounts: Clerk (sign-in), Convex (database), Cloudflare R2 (photos and files), PostHog (visit statistics), Sentry (error log), Resend (automatic e-mails), Vercel (the published site). Your business signs up for those services: the contract is between you and each one. We set them up in the most data-protective way each service allows.

Several of those services store data outside Argentina. As the controller, that is your responsibility, but we do not leave you on your own: we gather the data agreements of each service for you and explain what to sign.

The only thing that leaves your accounts is what you send to Bottari IA and Estudio IA: it goes through our AI server and the model provider, only to answer you (see sub-processors).

To provide the service we use these providers, which process data on our behalf:

We require them by contract to meet the same obligations as this agreement and, if they are outside Argentina in a country without adequate protection, to sign the model clauses approved in Argentina (Disposición 60-E/2016 or Resolución AAIP 198/2023, the Argentine rules on sending personal data abroad).

If we add or change a sub-processor, we tell you 30 days in advance. If you do not agree, you can end the service at no cost before the change takes effect.

We take the technical and organizational measures needed to protect the data (art. 9 of Ley 25.326):

• Separate accounts for each client: your business's data is not mixed with anyone else's.
• Two-step verification on the admin accounts.
• Encrypted connections (HTTPS).
• Access only for the people who work on your store, and only to what they need.
• We remove access that is no longer needed.

Everyone at Bottari Studio who processes your data has a duty of confidentiality, which continues after their work ends (art. 10 of Ley 25.326). Anyone who does not work on your store does not see your data. We never show it to another business, not even to another of our clients.

If something happens that affects your store's data (unauthorized access, a loss, a leak), we tell you within 72 hours of finding out: what happened, which data it affects, what we did and what we recommend. We help you notify your buyers if needed.

If a buyer or someone on your team asks us to see, correct or delete their data, we pass the request on to you within 2 business days. We help you answer within the legal deadlines: 10 calendar days for access and 5 business days to correct or delete (arts. 14 and 16 of Ley 25.326).

What you send to Bottari IA may include data about your buyers (for example: “how much does Ana owe me?”). That data is used only to answer you. It is not used to train models, neither ours nor the providers'.

If you upload photos of people to Estudio IA, you need their permission (art. 53 of the Civil and Commercial Code). See Bottari IA and Estudio IA.

• The data stays in your accounts: you do not have to ask us for a copy.
• We remove our access within 10 business days.
• We delete whatever we have of your store on our side within 30 days (art. 25, item 2, of Ley 25.326) and, if you ask us, we send you proof of the deletion.
• We only keep something if you authorize us in writing because you plan to hire us again, and never for more than 2 years (the same article).

You can ask us in writing for the information you need to check that we comply with this agreement: what measures we take, who has access and which sub-processors we use. We reply within 10 business days. Write to us at legal@bottaristudio.com.