Privacy Policy

1. Who we are

COMUTATO SOLUTIONS SRL is a company registered in the Republic of Moldova (IDNO 1025600039307), with its registered office at str. Alecu Russo 24, of. 130, MD-2044, Chisinau, Republic of Moldova.

For any privacy question, or to exercise your rights, contact us at privacy@comutato.com.

2. Controller and processor roles

When you visit our website or hold a Comutato account, we act as the data controller of your account and contact data.

When we operate the AI assistant on behalf of a business customer, we process the personal data of that customer's end-users (for example, message content and contact details) as a data processor, on the customer's documented instructions. The business customer is the controller of that data.

3. Data we process

Depending on how you interact with us, we may process:

• Account and contact data — name, business email, company, and login details of client users.
• Conversation data — messages, media, and metadata exchanged between an end-customer and the AI assistant through connected channels (WhatsApp, Telegram, Instagram, Messenger, Facebook, Viber) and CRM systems.
• CRM and deal data — lead, deal, task, and pipeline information synced from the connected CRM to provide the service.
• Usage and technical data — IP address, device and browser type, and product-usage events used for security and to improve the service.
• Billing data — the information required to invoice a paid plan.

4. Why we process it (purposes and legal bases)

We process personal data on the following GDPR Article 6 legal bases:

• Performance of a contract — to provide, operate, and support the service (Art. 6(1)(b)).
• Legitimate interests — to secure, maintain, and improve the service and prevent abuse, balanced against your rights (Art. 6(1)(f)).
• Consent — where required, for example certain analytics cookies (Art. 6(1)(a)).
• Legal obligation — to meet accounting, tax, and other legal requirements (Art. 6(1)(c)).

5. AI processing

The assistant uses large language models (via Amazon Web Services and Anthropic) to understand messages and generate replies. Relevant conversation context is sent to these providers solely to produce a response.

We do not use client conversation data to train foundation models, and our AI providers process it only to return the response.

6. Sub-processors

We rely on vetted service providers that process personal data on our behalf under data-processing agreements, including:

• Amazon Web Services (EU, eu-central-1) — cloud hosting, storage, transcription, and model inference.
• Anthropic — large-language-model inference.
• Kommo and Wazzup24 — CRM and messaging-channel connectivity.
• Lemon Squeezy — payment and subscription processing.
• LangSmith and Grafana — observability and monitoring.
• PostHog — website product analytics.

7. International transfers

Our infrastructure is hosted in the European Union (Frankfurt, eu-central-1). Where a sub-processor transfers data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Data retention

We keep personal data only as long as necessary for the purposes described here, for the duration of the client relationship, and as required by law. Conversation data processed for a business customer is retained per that customer's instructions and deleted or returned at the end of the engagement.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation, secret management, and audit logging. No method of transmission or storage is completely secure, but we work to protect your data against unauthorised access, alteration, or loss.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any right, contact privacy@comutato.com. Where we act as a processor for a business customer, we will refer your request to that customer.

You also have the right to lodge a complaint with a supervisory authority — in Moldova, the National Center for Personal Data Protection (datepersonale.md).

11. Cookies and analytics

Our website uses essential cookies and, with your consent where required, product-analytics tools (PostHog) to understand usage and improve the site. You can control non-essential cookies through your browser or our cookie settings.

12. Children

Our services are intended for businesses and are not directed to children under 16. We do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the last-updated date above; significant changes will be communicated to account holders.