Data Processing Agreement

1. Roles

The Controller is the customer. They decide to send their conversations to Foliary, whose conversations those are, and what is done with the result.

The Processor is Belim & Co, acting only on the Controller's instructions.

The data subjects are the Controller, and the people the Controller talks to on Voxer — who are not parties to this agreement. The Controller is responsible for telling them that Foliary is in use and for having a lawful basis for their data (Terms §3).

For the Controller's own account and billing data, Belim & Co is a controller in its own right and the Privacy Policy governs that, not this agreement.

2. Subject matter, duration, nature and purpose

3. Types of personal data

• Names and Voxer account identifiers of the Controller and of everyone they converse with
• The contents of messages: text as sent, and transcripts of voice messages
• AI-generated summaries and conversation categories derived from that content
• Timestamps, message direction, conversation membership, recording length
• Links to audio, image and video files hosted by Voxer (the files themselves are not copied to Foliary, except the voice files of a history import the Controller requests, held until they are transcribed and deleted within 30 days)
• The Controller's account email, name, time zone, and an optional description of their business

3.1 ⚠️ Prohibited data

The Controller must not use Foliary to process protected health information (PHI) as defined under HIPAA, or any data subject to HIPAA. Belim & Co is not a HIPAA business associate, will not sign a Business Associate Agreement, and Foliary is not HIPAA-certified. A Controller whose conversations involve PHI must not connect Foliary.

Conversation content is unstructured and its contents are outside the Processor's control: a coaching conversation may contain health, financial or other sensitive details, and the Processor cannot detect or filter this. The prohibition above is the Controller's responsibility to observe, and the Processor cannot enforce it technically.

4. Categories of data subject

The Controller, and the Controller's clients, team members, partners, mentors and other correspondents on Voxer.

5. Processor's obligations

The Processor shall:

1. process personal data only on the Controller's documented instructions, which are these terms and the Controller's use of the product, unless required otherwise by law — in which case it will tell the Controller first, unless the law forbids that;
2. ensure personnel with access are bound by confidentiality;
3. take the security measures in §6;
4. not engage a sub-processor except under §7;
5. help the Controller respond to data-subject requests (§8);
6. help the Controller with security, breach notification and impact assessments, given the information available to it;
7. delete or return personal data at the end of the service, per §11;
8. make available the information needed to show compliance with these obligations, and allow and contribute to audits — see §12.

The Processor does not use the Controller's conversation content to train AI models, and does not permit its sub-processors to do so.

6. Security

• Tenant isolation is enforced in the database, not only in the application, and is verified by an automated test that runs before every release.
• The Controller's Voxer connection address is verified against a one-way hash. An encrypted copy is kept so the address can be sent to the Controller again. Its key is held in a key-management service separate from the database; only the component that emails the Controller can use it, and only to send the address to the account's own email address. If the address is exposed, the Processor replaces it.
• Encryption in transit; encryption at rest by the hosting providers.
• Least-privilege access: each internal service holds only the permissions it needs, and the component that handles billing cannot read conversation content.
• Production access is restricted to personnel who need it.
• Personnel do not access conversation content without the Controller's permission. Where access is needed to troubleshoot a technical issue, the Processor asks the Controller first. Access required by law is handled under §5(1).

7. Sub-processors

The Controller gives general authorization for the sub-processors listed in the Privacy Policy: Supabase, Google Cloud, OpenAI, Vercel, Stripe, Postmark and Cloudflare.

The Processor will give the Controller 30 days' notice before adding or replacing a sub-processor, and the Controller may object on reasonable data-protection grounds; if the objection cannot be resolved, the Controller may terminate and receive a pro-rata refund of any prepaid fees.

Each sub-processor is bound by terms no less protective than these, and the Processor remains liable for their performance.

Voxer is not a sub-processor of Belim & Co. It is the Controller's own supplier and the source of the data.

Nor is any AI assistant the Controller connects (such as Claude or ChatGPT). It reads the Controller's conversations on the Controller's behalf, under the Controller's own account with that provider, and what it does with them is governed by that account, not by this agreement.

8. Data-subject requests

The Processor will notify the Controller without undue delay of any request it receives directly from a data subject, and will not respond itself except to confirm the request has been passed on.

The Processor will assist the Controller in accessing, correcting, exporting or deleting a data subject's information. This assistance is provided on request: email support@foliary.co and the Processor will action the request within 30 days.

Deletion applies to messages already held. New messages in a continuing conversation are captured as usual and are not deleted automatically. Voxer sends Foliary every regular conversation on the Controller's account, and Foliary cannot exclude one correspondent: where a data subject objects to future capture, the Controller must stop communicating with them in regular Voxer conversations while the account is connected, or use a Voxer Private Chat, which Voxer does not currently send to integrations (Terms §3).

9. International transfers

The Processor stores and processes the personal data covered by this agreement in the United States. The Controller's own account and billing data, which this agreement does not cover (§1), are handled under the Privacy Policy; payments go through Stripe, which also uses its own global infrastructure. Foliary is designed for US privacy and data laws and has not been assessed against the laws of any other country. A Controller outside the United States transfers personal data to the United States by using Foliary, and is responsible for determining whether that transfer and this agreement meet the requirements of the Controller's own jurisdiction. The Processor offers no transfer mechanism beyond this agreement — no standard contractual clauses and no certification under any cross-border data transfer framework.

10. Breach

The Processor will notify the Controller within 72 hours of becoming aware of any personal data breach affecting the Controller's data, with the information available at the time and updates as it learns more.

11. Deletion and return

On termination the Controller may request an export of their data, as CSV, by emailing support@foliary.co (Terms §8).

The Processor will delete the Controller's personal data within 30 days of termination, except where law requires it to be kept, and will confirm deletion on request.

Raw incoming message logs are deleted automatically 30 days after receipt, independently of this.

12. Audits

The Processor will answer reasonable written questions about its compliance, at most annually.

Any audit beyond that — including any on-site audit, and any audit required by a supervisory authority — is at the Controller's cost.

13. Liability

Each party's liability under this agreement is subject to the limit in Terms of Service §9: the fees paid in the 12 months preceding the claim.

14. Order of precedence

If this agreement conflicts with the Terms of Service, this agreement prevails for matters of personal data processing.