CREATE FREE ACCOUNT · NO CARD REQUIRED START FREE
LOG IN SIGN UP

Integrations & GDPR

GDPR compliance for MuseRelay integrations, native calendar, native ticketing and external services. Data is hosted on European infrastructure when native modules are used.

Inicio › Integrations & GDPR

Last updated: 2026-05-07

This page describes how third-party integrations available in MuseRelay interact with personal data, the legal basis used and the technical safeguards applied. The Customer remains data Controller; MuseRelay acts as data Processor under the DPA.

1. Meta Platforms (WhatsApp Business, Instagram, Facebook Messenger)

  • Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, D02 X525, Ireland.
  • Data received: business profile (page name, picture, ID), inbound messages and attachments, webhook events (delivery and read receipts).
  • Purpose: deliver messaging functionality between the Customer and its end users.
  • Legal basis: performance of contract (Art. 6.1.b GDPR) between the Customer and the end user; the Customer is responsible for obtaining any additional consent if applicable.
  • Storage: messages are stored encrypted in the EU on AWS Ireland and IONOS Germany.
  • Deletion: users may request deletion at any time — see /data-deletion.
  • What we do NOT do with Meta data: we do not use it to train AI models, for marketing or advertising, for resale to third parties, or for cross-platform profiling.

2. Telephony (Telnyx, voice channels)

  • Provider: Telnyx LLC (USA), with data processing agreement and SCC + supplementary measures.
  • Data received: caller number, call duration, audio (only when answered).
  • Legal basis: performance of contract (Art. 6.1.b GDPR); legitimate interest in call quality and security (Art. 6.1.f GDPR).
  • Voice notice: at the start of every call, callers receive a privacy notice describing the controller, the purpose, retention and how to exercise their rights.

3. European AI providers (Vertex AI, AWS Bedrock and IONOS GPT-OSS 120B)

  • Vertex AI: Google Cloud in a European region (Belgium/EU). Used for multimodal processing (text, images, audio) where required by the Customer agent.
  • AWS Bedrock: Amazon Web Services EMEA SARL in a European region (Ireland/eu-west-1) for Claude Haiku 4.5.
  • IONOS AI Model Hub: IONOS SE in a European region (Germany/EU) for GPT-OSS 120B. GPT-OSS is the model used; the operational provider/subprocessor is IONOS, not OpenAI.
  • Regional residency: MuseRelay does not use global zones for this processing; AI workloads configured by MuseRelay run only in European regions of Vertex AI, AWS Bedrock and IONOS.
  • Training: these providers do not train external models on Customer data under our contracts.

4. Calendars and external systems

When the Customer connects external calendars (Google, Microsoft, Apple), the OAuth tokens are stored encrypted at rest and used only to read/write events strictly necessary to fulfil the conversational task requested by the end user.

4.bis MuseRelay native calendar and ticketing

MuseRelay includes a native calendar and native ticketing system so the Customer can manage appointments, availability, support requests, attachments, statuses, SLAs and history inside the platform. When these native modules are used, the data is stored on MuseRelay European infrastructure and does not need to be transferred to external scheduling or ticketing tools. External integrations remain available if enabled by the Customer, but the native option generally reduces data exposure to third parties.

4.ter First-party analytics and captcha

MuseRelay does not load Google Analytics or Google reCAPTCHA in its public flows. Anti-bot protection is handled through self-hosted ALTCHA, with challenge and verification managed by the platform itself, without sending that validation to Google or another external captcha provider.

5. Data minimisation and retention

Only the data needed to provide the service is processed. Default retention windows: messages 24 months; voice recordings 90 days; access logs 12 months; billing records 6 years (legal obligation). Customers may request shorter retention.

6. Exercising your rights

Access, rectification, erasure, restriction, portability, objection: privacy@muserelay.com or privacy@muserelay.com. EU Representative: screenart@muserelay.com. Supervisory authority: Spanish Data Protection Agency (www.aepd.es).

Actualizado: 8 May, 2026