Data Processing Agreement (DPA)
Last updated: October 13, 2026
1. Parties and roles
This Data Processing Agreement ("DPA") is part of the FalaAI Terms of Use. The Customer is the Controller of the personal data processed; Action Tec Brasil (FalaAI API) acts as the Processor.
2. Object
To govern the processing of personal data carried out by the Processor to provide the FalaAI API services (transcription, diagnosis and conversation risk audit), under the subscribed plans. The FalaAI API does not store conversation content (Zero-Storage).
3. Nature and purpose
Processing is solely to execute the Controller's instructions for API use. The Processor does not use the data for its own purposes.
4. Personal data and data subjects
May be processed: uploaded audio, transcripts, conversation text, usage metadata and account/billing data. Data subjects: customers, employees and conversation participants. In the FalaAI API, conversation content is processed and discarded (Zero-Storage), leaving only usage/audit records without content.
5. Controller instructions
The Processor processes data strictly in accordance with the Controller's instructions and applicable law (LGPD, Law 13.709/2018, Art. 39).
6. Security measures
Encryption in transit (TLS) and at rest; per-account isolation (multitenancy); access and API key controls; Zero-Storage of conversation content in the FalaAI API (processed and discarded); usage and audit records without content.
7. Sub-processors
Hosting: Hetzner (ISO/IEC 27001:2022, BSI C5 Type 2). Database/Auth: Supabase (SOC 2 Type 2). Payments: Stripe. Email: Resend. The Processor keeps the list updated and is responsible for the sub-processors.
8. International transfer
Some sub-processors may process data outside Brazil (e.g., data centers in Germany/Finland and Supabase regions), with contractual safeguards and appropriate security measures.
9. Security incidents
The Processor will notify the Controller without undue delay about relevant incidents, with the information needed to comply with legal obligations.
10. Data subject rights
The Processor supports the Controller in handling data subject rights (LGPD, Art. 18). When data appear in a customer's conversations, the request must be directed to the Controller.
11. Return and deletion
Upon termination, data is deleted or returned in accordance with law and the retention policy, subject to legal and tax obligations. In the FalaAI API, conversation content is already discarded during processing.
12. Audit and evidence
The Processor provides information to demonstrate compliance and accepts audits under the contract and law.
13. Responsibilities
Each party is responsible under the LGPD. The Processor is responsible for processing carried out contrary to the Controller's instructions.
14. Contact
Data Protection Officer (DPO): contato_falaai@action.tec.br.