1. Parties and roles
Each party has a different role with respect to this data:
Controller
The company or professional that contracts Muvly AI (the “client”, for example a moving company). It decides why and how the data of its own end customers is processed.
Processor
Néstor Brito Medina, a self-employed professional with tax ID (NIF) Y6721372G, based at Calle Manzanilla 10, 3D, 41013 Seville (Spain), who provides the service under the brand Muvly.AI (hereinafter “Muvly AI”). Contact: info@muvly.ai.
The data of the client’s own account (sign-up, billing, panel users) is outside this document: Muvly AI is the controller of it, as set out in its privacy policy.
2. Subject matter and duration
The subject matter is providing the Muvly AI service: a conversational assistant that serves the client’s end customers on the client’s website, interprets what they say, calculates a quote with the rates the client configures and hands the resulting contact over to the client.
The engagement lasts as long as the client’s subscription to the service. When it ends, section 12 applies.
3. Nature and purpose of the processing
Nature
Automated processing of personal data by a conversational artificial intelligence system, with temporary storage and automatic deletion.
Purpose
Generating a moving quote from what the end customer says in the chat and delivering it to the client.
What the AI does not decide
The price is not calculated by the language model but by the client’s rate engine, with the rules and prices the client has configured. No decision with legal effects on a person is taken solely by automated means.
4. Types of data and data subjects
The personal data processed is what the end customer provides when asking for a quote:
Contact
Name, email address and phone number.
Addresses and date
Origin and destination addresses and the date of the move.
Inventory
Belongings to be moved and, if given, the declared value of the items or vehicles to be insured.
Inventory photos
The images the end customer uploads during the conversation.
Chat content
What the end customer writes and the assistant’s replies.
The data subjects are the client’s end customers: the people who ask for a quote through the chat.
5. Obligations of Muvly AI
As processor, Muvly AI undertakes to:
Follow documented instructions
Process the data only on the client’s documented instructions, which are this document and the service configuration the client sets in its panel, including as regards transfers. If it considers that an instruction infringes data protection law, it will tell the client.
Confidentiality
Ensure that the persons authorised to process the data have committed to confidentiality.
No other purpose
Not use the data for its own purposes, nor sell it, nor disclose it to third parties other than the authorised sub-processors.
Assistance to the client
Assist the client, with appropriate technical and organisational measures, in responding to data subjects’ rights requests and, where relevant, in data protection impact assessments and consultations with the supervisory authority.
6. Security measures
Muvly AI applies technical and organisational measures appropriate to the risk (GDPR article 32). Among them:
Encrypted secrets
The API keys of AI providers and the second-factor secrets are stored encrypted.
Protected photos
Inventory photos are not at a public address: they are served only to an authenticated user of the company the contact belongs to.
Internal services
The assistant’s internal tools service is not reachable from the Internet.
Model request logging
With the managed model, request logging on AWS’s side is disabled.
7. Sub-processors
The client gives Muvly AI general authorisation to use the sub-processors on this list. Muvly AI requires them to meet data protection obligations equivalent to those of this document and remains answerable to the client for their compliance.
If Muvly AI plans to add or replace one, it will tell the client with reasonable notice so that the client can object. The list is the same as the one in the privacy policy.
Sub-processors that may receive end customers’ data:
Amazon Web Services EMEA SARL (Amazon Bedrock)
Artificial intelligence: generative AI models from different providers (such as Anthropic, OpenAI, Google or Meta), served through Amazon Bedrock, that generate the assistant’s replies (model managed by Muvly AI). Receives the conversation text and, if provided, the inventory photos. EU (EU inference profile). Only if unavailable, automatic fallback to AWS’s global inference profile, which may involve processing outside the EU; in that case the transfer relies on the European Commission’s standard contractual clauses or, if the provider is certified, the EU-U.S. Data Privacy Framework.
The AI provider configured by the client company (if it uses its own key)
Solely if the company connects its own account with a language model provider instead of the model managed by Muvly AI. Receives the conversation text and, if provided, the inventory photos. Chosen and contracted by the client company, which is responsible for it; Muvly AI merely routes the conversation to the account that company has configured.
Google Maps Platform
Geocoding addresses and calculating the distance between origin and destination. Receives the address being looked up, never the full conversation. It may involve processing outside the EU; in that case, the transfer relies on the safeguards provided for by the GDPR, such as the European Commission’s standard contractual clauses or, if the provider is certified, the EU-U.S. Data Privacy Framework.
Amazon Web Services (Amazon SES)
Sending the service’s transactional email: account verification and operational notices. Receives the recipient’s email address and the content of the message. Within the EU.
IONOS
Hosting of the service’s infrastructure, of the info@muvly.ai mailbox and of the domain’s DNS zone. Hosts the service data and has access to the emails sent to that address.
8. Other tools
These tools do not receive end customers’ data and are listed for transparency:
Stripe Payments Europe, Ltd. (Stripe)
Card payment of subscriptions, wallet top-ups and the assisted onboarding pack. Receives the client company’s billing and payment details; Muvly AI does not store card data. Company based in Ireland (EU).
Mautic (own tool)
Managing commercial communications: news by email and unsubscribes. Business contact details of the person who signs up (not those of end customers) and their preference regarding the receipt of communications. Hosted on Muvly AI’s own infrastructure: it is not a third party and adds no other vendor.
9. International transfers
Email and hosting are processed in the European Union. Processing data in the EU does not make it immune to the laws of other countries: what is stated is that it is processed in the EU, not that it is unreachable from outside.
The managed model (Amazon Bedrock, from Amazon Web Services) is normally processed in the European Union (EU inference profile). Only if that profile is unavailable is AWS’s global inference profile used as an automatic fallback, under which requests may be processed in other commercial AWS regions, including outside the European Union and the European Economic Area. In that case the transfer relies on the European Commission’s standard contractual clauses or, if the provider is certified, on the EU-U.S. Data Privacy Framework.
Using Google Maps Platform may involve processing outside the EU; in that case it relies on the European Commission’s standard contractual clauses or, if the provider is certified, on the EU-U.S. Data Privacy Framework.
If the client connects its own AI provider, the location of the processing and the safeguards for any transfer depend on that provider, which the client chooses, contracts and answers for.
10. Artificial intelligence and no training
Model managed by Muvly AI
Generative AI models from different providers (such as Anthropic, OpenAI, Google or Meta), served by Amazon Web Services through Amazon Bedrock and normally processed in the European Union (EU inference profile) and, only as an automatic fallback, in other AWS regions (global inference profile), with the transfer safeguards set out in section 9.
Commitment not to train
Muvly AI will not use the client’s conversations, photos or other data to train or improve artificial intelligence models, its own or third parties’, and will not authorise any sub-processor to do so.
The client’s own AI provider
If the client connects its own key, the client chooses that provider, contracts its terms and answers for them, including as regards the use of data for training.
11. Retention
Conversation, inventory and photos
180 days. A daily automatic process deletes expired sessions, and photos leave the disk before their record does.
Quote and contact
They are the client’s own business record, and the client sets its own retention period. Deleting the chat does not touch them.
12. Deletion or return at the end
When the service ends, and at the client’s request, Muvly AI will return or delete the personal data processed on its behalf and any existing copies, unless a legal rule requires them to be kept. In the meantime, the automatic deletion in section 11 continues to apply.
13. Information and audit
Muvly AI will make available to the client the information needed to show that it meets these obligations and will allow audits, including inspections, carried out by the client or by an auditor it authorises, with reasonable notice and without compromising the security or confidentiality of other clients.
14. Security breaches
If Muvly AI becomes aware of a security breach affecting the client’s personal data, it will notify the client without undue delay, with the information it has (nature, data and people affected, likely consequences and measures taken), so that the client can meet its own notification duty.
15. Contact
For any question about this document, write to info@muvly.ai.
Contact: info@muvly.ai
Back to home