Terms of service + DPA

This document governs the contract between EvolvIA Italia (owner: Romeo Muço, email romeo@evolvia-italia.com), hereinafter the "Provider", and the client who subscribes to a plan of the Nora service (the "Client"). Nora is a voice and WhatsApp AI assistant available around the clock for small and medium businesses.

One-off setup €2,179. Monthly plans: Starter €99, Business €299, Enterprise on request. Self-service cancellation at any time from the Stripe customer portal. No penalties. The current month is not refunded pro rata.

Target availability 99.0% per month, calculated on the availability of Vapi, Telnyx and Supabase EvolvIA. Excluded: scheduled maintenance (with 24 hours' notice), force majeure, sub-processor outages (for example a Vapi or Stripe outage).

Refund within the first 14 days: if Nora does not handle at least 10 real calls within 14 days of signing, for reasons attributable to the Provider, the setup is refunded in full. The setup is NOT refunded where the cause is attributable to the Client (incomplete information, a website whose content cannot be extracted, a knowledge base that was never confirmed).

The Provider's total liability towards the Client, for any cause, is limited to the amount paid by the Client in the 12 months preceding the damaging event. Indirect damages, loss of profit and the loss of the Client's own end customers arising from a malfunction of Nora are excluded.

The Client acknowledges and undertakes to inform its own end users (callers) that they are speaking with an AI system and not with a person. The disclosure is already built into the assistant's first message (for example "I'm Nora, the AI assistant at [business name]"). The Client must not disable or alter it.

For sensitive sectors (dentistry, pharmacy, legal, financial) Nora applies rules fixed in the system: it does not give medical diagnoses, specific legal advice or investment advice. Faced with out-of-scope requests it automatically hands over to a human operator. The Client is responsible for providing accurate information about its own business.

This contract is governed by Italian law. The Court of Rome has exclusive jurisdiction over any dispute, save for the mandatory consumer forum where applicable.

Data controller: the Client (for example a restaurant, a dental practice, an online shop) is the controller of the personal data of its own end users: callers' phone numbers, conversation content, booking details.

Data processor: EvolvIA Italia processes that data on behalf of the controller, within the limits of the instructions documented in the contract and the terms of service.

Subject: the personal data contained in the calls handled by Nora.

Nature: collection, recording, storage, consultation, AI processing, communication to the controller through the dashboard.

Purposes: delivery of the Nora service, that is handling calls, bookings, information and handover to an operator.

Categories of data subjects: the end users who call the Client's number or write to its WhatsApp Business.

The end user's phone number or WhatsApp contact; the text transcript of the conversation; the audio recording of the call, where that option is enabled; the outcome of the conversation (booked, information, handed over, dropped); technical data such as date, time, duration, cost and the AI model used.

Also included is the data the end user provides during the call: name, email, preferences.

Special categories (art. 9 GDPR): if the Client's sector is healthcare (dentistry, pharmacy), health-related data may come up. The Client is responsible for having an appropriate legal basis, for example explicit consent.

Transcripts are kept for 12 months from the date of the call, unless the Client requests otherwise. Audio recordings for 90 days, and the Client can delete them at any time from the dashboard. At the end of the contract all Client data is deleted within 30 days, with an export guaranteed before deletion.

EvolvIA Italia uses the sub-processors listed on the dedicated public page. New sub-processors are announced with 30 days' notice. The Client may object with reasons and, if no agreement is reached on an alternative, terminate without penalty.

Encryption of data in transit (TLS 1.3) and at rest (LUKS volume and AES-256 database); separation of data between clients at database level; an immutable access log for every access to sensitive data; backups every 6 hours kept for 30 days; access through a temporary email link, with no reusable passwords, and optional second factor; rate limits on system calls and a bot check after repeated failed login attempts.

The Client, as controller, can exercise its end users' rights with the tools EvolvIA Italia provides: data export, deletion with pseudonymisation, correction of individual records. Details are on the sub-processors page, in the section on GDPR rights.

EvolvIA Italia notifies the Client of any personal data breach within 48 hours of discovery, providing the information the Client needs to meet its own obligation to notify the supervisory authority within 72 hours (art. 33 GDPR).

These take place on the basis of the EU Standard Contractual Clauses 2021/914 and, where applicable, the EU-US Data Privacy Framework. Details are on the sub-processors page.