Skip to main content

PRIVACY AND DATA PROCESSING POLICY

1. Purpose​

This Policy describes how Customer Data may be collected, stored, processed, transferred, and protected when the Customer uses Akabot Products.

This Policy should be read together with the Terms of Use, the End User License Agreement, the AI Services and Data Processing Addendum, the applicable agreement, and any relevant data processing agreements. Capitalized terms not defined in this Policy have the meaning given in the Terms of Use.

2. General Principles​

Akabot follows these principles:

Customer ownership: Customer Data belongs to the Customer or its respective lawful owner.

Purpose limitation: Data is processed only for necessary purposes.

Data minimization: Only data necessary for the relevant function is processed.

Access control: Access is limited according to business need.

Security: Data is protected using appropriate technical and organizational measures.

Transparency: Material data flows are described to the Customer.

Akabot processes personal data on one or more of the following legal bases:

  • the consent of the data subject, or of the Customer on the data subject's behalf;
  • the necessity of processing to perform a contract to which the Customer is a party, or at the Customer's request before entering into a contract;
  • the necessity of processing for Akabot to comply with an applicable legal obligation; or
  • the legitimate interests of Akabot or a third party, provided those interests do not override the data subject's rights and legitimate interests.

For personal data that the Customer enters, uploads, or otherwise processes through a Product, the Customer is responsible for ensuring an appropriate legal basis before providing that data to Akabot, as set out in Section 7 (Personal Data).

4. Data Categories​

Depending on the use case, Products may process:

4.1. Account Data​

Examples include:

  • username;
  • display name;
  • email;
  • role;
  • organization;
  • authentication information.

4.2. Configuration Data​

Examples include:

  • workflow configuration;
  • Agent configuration;
  • connection information;
  • environment configuration;
  • asset configuration.

4.3. Business Data​

This includes data read, created, transformed, or transferred between systems by a workflow.

4.4. Documents and Files​

These may include:

  • PDF;
  • spreadsheet;
  • image;
  • document;
  • email;
  • structured/unstructured data.

4.5. AI Data​

This may include:

  • prompts;
  • system instructions;
  • context;
  • documents;
  • images;
  • extracted data;
  • model responses.

4.6. Technical Data​

This may include:

  • application logs;
  • audit logs;
  • error logs;
  • version information;
  • system information;
  • IP address;
  • timestamps;
  • API usage information.

5. Data Processing Locations​

For Products deployed on premises, data is processed and stored primarily in infrastructure controlled by the Customer.

Akabot does not, by default, copy business data from the on-premises environment to Akabot infrastructure.

However, data may leave the Customer's environment when:

  • the Customer enables external AI;
  • a workflow calls an external API;
  • the Customer provides data for technical support;
  • a Product uses an online licensing or update service; or
  • the Customer configures an integration with an external system.

6. Processing Purposes​

Data may be processed to:

  • run workflows;
  • orchestrate Agents;
  • manage automation;
  • perform AI inference;
  • provide Data Services;
  • authenticate and authorize users;
  • create logs and audit records;
  • troubleshoot issues;
  • monitor security;
  • perform backups; and
  • provide technical support.

7. Personal Data​

The Customer is responsible for determining whether data entered into a Product contains personal data or sensitive personal data.

The Customer must ensure that it has an appropriate legal basis to process that data.

Where Akabot processes personal data on the Customer's behalf, the parties' roles and responsibilities may be further set out in a Data Processing Agreement (DPA).

8. Data Retention​

For data held in an on-premises environment, the Customer controls the retention policy, except where technical limitations are stated in the Product documentation.

The Customer should establish appropriate retention periods for:

  • operational data;
  • audit logs;
  • application logs;
  • AI logs;
  • documents;
  • backups.

Akabot is not responsible by default for deleting data held in infrastructure controlled by the Customer.

9. Technical Support Data​

When the Customer provides logs, database dumps, screenshots, workflows, or other files to Akabot for technical support, Akabot uses that data only for support or another agreed purpose.

The Customer should remove or mask unnecessary sensitive data before sending it.

Access by Akabot personnel must be limited according to business need.

10. Data Sharing​

Akabot does not sell Customer Data.

Data is shared with a third party only when:

  • necessary to provide a feature enabled by the Customer;
  • requested by the Customer;
  • authorized by the Customer;
  • necessary to perform a contractual obligation; or
  • required by law.

A recipient of shared data is obligated to protect Customer Data consistent with this Policy and applicable law.

11. Cross-Border Data Transfers​

Use of external cloud services or AI providers may result in data being processed outside the country where the Customer operates.

The Customer is responsible for assessing applicable legal requirements before enabling those features.

Upon request, Akabot provides reasonable technical information about data flows to support that assessment.

12. Data Minimization​

The Customer is advised to provide only the minimum amount of data necessary for each task.

For external AI, the Customer should consider:

  • masking;
  • anonymization;
  • pseudonymization;
  • removing personally identifiable information (PII);
  • removing credentials; and
  • removing unnecessary confidential information.

13. Credentials and Secrets​

Passwords, private keys, API keys, access tokens, and other secrets must be appropriately protected.

The Customer is responsible for:

  • restricting access;
  • rotating credentials;
  • revoking exposed credentials; and
  • avoiding plaintext secrets in workflows or logs where the Product supports an appropriate protection mechanism.

14. Rights of Data Subjects​

To the extent permitted by applicable law, a data subject has the following rights regarding their personal data:

  • Right to be informed: to be informed about the processing of their personal data, except as otherwise provided by law.
  • Right to consent and withdraw consent: to consent or refuse to consent to the processing of their personal data, except as otherwise provided by law, and to withdraw consent at any time.
  • Right of access: to access, view, or request correction of their personal data.
  • Right to erasure: to request deletion of their personal data, except as otherwise provided by law.
  • Right to restrict and object to processing: to request restriction of, or object to, the processing of their personal data, except as otherwise provided by law.
  • Right to complain, denounce, or litigate: to file a complaint, denunciation, or lawsuit in accordance with applicable law.
  • Right to claim damages: to claim damages in accordance with applicable law in the event of a violation of the protection of their personal data, unless otherwise agreed by the parties or provided by law.

For personal data that the Customer enters, collects, synchronizes, or connects to a Product, the Customer acts as the data controller and is responsible for ensuring the exercise of the above rights for the relevant data subjects. A data subject should contact the Customer directly to exercise their rights.

For personal data that Akabot collects and processes as a data controller (for example, the Customer's account or contact information), a data subject may submit a rights request to Akabot using the contact information in Section 22 (Contact). Akabot will handle a valid request within a reasonable period under applicable law and notify the data subject of the outcome.

Where Akabot acts as a processor and has the relevant technical capability, Akabot will assist the Customer in fulfilling the rights above as agreed by the parties.

15. Obligations of Data Subjects​

A data subject is responsible for:

  • providing complete, truthful, and accurate personal data when requested, and updating it promptly when it changes;
  • protecting their own personal data and promptly notifying Akabot or the Customer if they discover that their personal data has been compromised or contains an error;
  • respecting and protecting the personal data of other data subjects; and
  • complying with applicable personal data protection law.

16. Data Breaches​

Each party is responsible for handling security incidents within its control.

If Akabot confirms a security incident within its area of responsibility that affects Customer Data, Akabot will follow its incident response process and notify the Customer as required by the agreement and applicable law.

17. Risks and Limitations​

Akabot applies appropriate technical, physical, and administrative measures to protect personal data. However, due to the nature of technology and cybersecurity risks, Akabot cannot guarantee absolute protection of personal data and is not liable for circumstances beyond Akabot's reasonable control, including but not limited to previously unknown security vulnerabilities or cyberattacks that exceed industry-standard security measures.

If an incident affecting personal data occurs, Akabot will follow its incident response process and provide notice as set out in Section 16 (Data Breaches) and as required by applicable law.

18. Data Deletion and Return​

For on-premises data, the Customer controls deletion and retention.

For data temporarily provided to Akabot for support, deletion or retention is governed by the applicable internal policy, agreement, or DPA.

19. Cookies​

Akabot's website and certain Products may use cookies or similar technologies to recognize a device, record when and how a Product or website is used, measure visits, and improve the user experience.

The Customer may decline or disable cookies through its browser settings; doing so may, however, limit the ability to use some features in full.

20. Dispute Resolution​

Any dispute arising out of or relating to the processing of personal data under this Policy will first be resolved by the parties through negotiation. If negotiation is unsuccessful, the dispute will be resolved under the Governing Law and Dispute Resolution section of the Terms of Use.

21. Policy Changes​

This Policy may be updated when:

  • the architecture changes;
  • the types of data change;
  • a new provider is added;
  • legal requirements change; or
  • there is a material change in how data is processed.

An updated version must state its effective date.

22. Contact​

FPT IS COMPANY LIMITED
Website: https://akabot.com
Privacy/DPO: [email protected]
Support: [email protected]