Privacy Policy

Data Controller:

EdgeBuddy B.V., trading as edge247
KvK: 97717193 | RSIN: 868199230 | BTW: NL868199230B01
Email: contact@edge247.ai

We are registered in the Netherlands and comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, "UAVG").

We have not appointed a Data Protection Officer as this is not required given the nature and scale of our data processing. For all privacy inquiries, contact us at contact@edge247.ai.

We want to be explicit about what we do not collect:

5.1 Data Controller

We are the data controller for:

• Business contact information you provide to us (name, email, phone, company)
• Billing and invoicing data
• Support and communication records
• Website analytics data (anonymous)

5.2 Our Maintenance Access

We are an IT deployment and maintenance service provider. During maintenance, we access your system via Tailscale SSH for technical administration only: software updates, health monitoring, error log review, and security patching. We do not access, review, or process your business data (conversations, memory, notes).

Our personnel are bound by confidentiality obligations. Upon termination, we revoke our access and destroy any credentials we hold. If your legal counsel determines that our maintenance access requires a Data Processing Agreement under GDPR Article 28, we will enter into one upon request.

5.3 You Are the Data Controller for Agent Data

You are the data controller for all personal data processed by your Full-Time Agent, including conversations between the agent and your employees or customers, personal data contained in the agent's memory and notes, and any personal data accessed by the agent through connected services (email, calendar, and similar).

As data controller, you are responsible for:

• Maintaining a lawful basis for this processing;
• Informing data subjects (employees, customers) about the AI agent;
• Responding to data subject access, correction, and deletion requests;
• Disclosing in your own privacy policy that AI processing involves data transfer to OpenRouter and upstream AI providers (US-based), with Zero Data Retention enabled.

We can provide template language for your privacy policy upon request.

Some of our service providers are located in the United States. We ensure lawful data transfers through the following mechanisms:

• EU-US Data Privacy Framework (DPF): Anthropic, Google, and Vercel are certified under the EU-US DPF, which provides an adequate level of data protection recognized by the European Commission (Adequacy Decision of July 10, 2023).
• Standard Contractual Clauses (SCCs): Where DPF certification is not available, we rely on EU Commission-approved Standard Contractual Clauses.
• End-to-end encryption: Tailscale uses WireGuard encryption for all connections. Maintenance traffic is encrypted peer-to-peer; Tailscale coordination servers only handle encrypted metadata.

We monitor developments regarding the EU-US Data Privacy Framework. Should the framework be invalidated, we will implement alternative transfer mechanisms (SCCs) promptly.

We protect your personal data through the following measures:

• Encryption in transit: All communications use TLS 1.3. Maintenance access uses Tailscale WireGuard encryption (end-to-end).
• Access controls: Tailscale VPN with ACL-based access policies. Each client's device is cryptographically isolated on our Tailscale network.
• Minimal data collection: We collect only what is necessary for service delivery (privacy by design, GDPR Article 25).
• Credential management: Implementation credentials are deleted immediately after setup. API keys are stored with restricted file permissions (chmod 600) on client hardware.
• Security audits: We run regular security audits on client deployments.
• EU-based email: Our email is hosted on Zoho's EU (Amsterdam) servers.

For your Full-Time Agent on your hardware, you are responsible for physical security of the Mac Mini, device encryption (FileVault), network security at your premises, and not sharing credentials with unauthorized parties.

You have the following rights regarding your personal data:

To exercise any of these rights, contact us at contact@edge247.ai. We will respond within 30 days (extendable by 60 days for complex requests, with prior notice).

We will not charge a fee for reasonable requests. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, in accordance with Article 12(5) GDPR.

If you are a client using our Full-Time Agent service, please note:

13.1 Your Employees and Customers

When your employees or customers interact with your Full-Time Agent via WhatsApp, Telegram, or other channels, you are the data controller for those interactions. You must:

• Include the AI agent in your own privacy policy;
• Inform users that they are chatting with an AI agent (required under the EU AI Act from August 2, 2026);
• Disclose that conversation data is processed transiently (Zero Data Retention) via OpenRouter and upstream AI providers (US-based);
• Have a lawful basis for processing employee data via the AI agent (typically employment contract or legitimate interest);
• Respond to data subject requests regarding agent interactions.

13.2 WhatsApp Compliance

If your Full-Time Agent uses WhatsApp:

• WhatsApp Business terms apply to your use of the platform;
• You must comply with WhatsApp's policies regarding AI-powered messaging;
• We recommend the agent's first message to new contacts includes a disclosure: "I am [Company]'s AI assistant. How can I help you?"

13.3 Template Language

We can provide template privacy policy language covering the Full-Time Agent as part of our Implementation service. Contact us at contact@edge247.ai.