Data processing agreement
When we set up the AI employee and the Vilmor CRM, we process your customers' data on your behalf. This agreement explains how, under Article 28 of Regulation (EU) 2016/679 (GDPR), and is part of the Terms of service.
Version of 15 October 2026. This is a translation: the Italian version prevails.
1. Who decides and who processes
Your business is the controller: it decides why and how to use its customers' data. Vilmor (Vittorio Halfon, sole proprietorship, VAT no. 14871950961, Via Bartolomeo D'Alviano 24, 20146 Milan, Italy) is the processor: it processes the data only to provide the service and according to your instructions. The data stays yours.
Your instructions are the Terms of service, the offer you accepted, the rules written at setup and whatever you ask us in writing afterwards. If an instruction seems unlawful to us, we tell you before carrying it out.
2. What data, and whose
- Whose: your customers and prospective customers who write to you or whom you contact through the service, and the people on your team who use the Vilmor CRM.
- What: name and contact details, messages and conversations, requests and answers to the AI employee's questions, appointments, notes, the status of quotes and payments, reviews, and the technical data of messages (date, time, channel).
- What not: the service isn't designed for health data or other special categories of data, and the AI employee doesn't ask for it (section 8 of the Terms of service).
- What for: replying to your customers, following them through to the appointment and payment, reminding them of deadlines, asking for reviews and keeping everything in one place, within the limits of the tasks in the offer.
- For how long: for the duration of the Terms of service, then until the deletion described in section 8.
3. Who sees the conversations
You and the people on your team you give access to. On our side, Vittorio Halfon, and anyone working with him only if bound by confidentiality: we enter your space to set it up, for support, to fix a fault or when you ask us, and for nothing else. The providers in section 4 process the data to make the service work.
4. The providers that process the data
You authorize us to use these sub-processors. Each is bound by the same data protection obligations we have toward you.
| Provider | What it does | Where | Transfer safeguards |
|---|---|---|---|
| HighLevel Inc. and LeadConnector LLC | The platform behind the Vilmor CRM and the AI employee: it stores contacts, conversations, appointments and notes, and sends the messages. | United States (Google Cloud and Amazon Web Services) | Active certification under the EU-U.S. Data Privacy Framework; European Commission standard contractual clauses in its data processing agreement. |
| HighLevel's providers | Services the platform uses to work, including OpenAI for artificial intelligence, Twilio for SMS and telephony, Mailgun for email, and HighLevel's technical support, also from India. | Mainly United States; India for support | The obligations of HighLevel's data processing agreement, including the standard contractual clauses. |
The complete, up-to-date list of HighLevel's providers is published by HighLevel on its sub-processors page. HighLevel states that it doesn't use personal data to train general, public artificial intelligence models.
If we add or change a provider we tell you in writing as soon as we know, before it processes your data when that depends on us. You can object within 30 days; if we can't find a solution, you can cancel at no cost.
5. The channels you connect
You connect WhatsApp with your own number and your own Meta account. For those messages, Meta (WhatsApp Ireland or WhatsApp LLC) processes the data on behalf of your business, under the WhatsApp Business terms you accept when connecting the number: Meta keeps messages on its platform for up to 30 days, encrypted. The same applies to the other channels you connect with your own accounts, such as Facebook, Instagram or your email: your relationship with those providers is your own.
6. Security
- Data travels encrypted (TLS 1.2 or higher) and is stored encrypted (AES-256), as stated by HighLevel.
- HighLevel states that it holds ISO/IEC 27001:2022 certification and undergoes a SOC 2 Type II audit every year. Vilmor has no certifications of its own.
- Each person enters the Vilmor CRM with their own account and sees only what their role allows.
- We access your space with two-factor authentication, and close access that is no longer needed.
7. How we help you
- Your customers' requests: if one of your customers asks to see, correct or delete their data, we help you do it from the Vilmor CRM. If the request reaches us, we pass it on to you.
- Data breaches: if we become aware of a breach affecting your data, we tell you without undue delay, and in any case within 48 hours of becoming aware of it, with what you need to decide whether and how to notify the supervisory authority (the Italian Garante) and your customers.
- Assessments and audits: we give you the information you need for your own assessments of the processing and to show that we comply with this agreement. You can request an audit with 30 days' notice, at your own expense, at most once a year except after a breach. For HighLevel, the reports and certificates HighLevel makes available apply.
8. At the end of the service
If you ask us within 30 days of the end of the Terms of service, we hand over the contacts in a CSV file and the conversations in a file you can reuse. Then we delete your space in the Vilmor CRM: at HighLevel deletion becomes permanent after 24 hours, and its daily backups are kept for 7 days. We keep only what the law requires us to keep, such as invoices.
9. Contact and changes
For this agreement, write to privacy@vilmor.it. If the providers or their rules change we update this page, and for changes that affect you, section 4 and section 14 of the Terms of service apply.