AI Bizlutions
Record of Processing Activities (GDPR Art. 30)
Controller: AI Bizlutions, LLC · Last Updated: November 3, 2026
1. Processing Purposes
| Purpose | Lawful Basis | Description |
|---|---|---|
| Service delivery | Contract (Art. 6(1)(b)) | CRM, invoicing, communications, automation features |
| AI content generation | Consent (Art. 6(1)(a)) | Social media content, document analysis, entity tagging |
| Analytics & usage tracking | Legitimate interest (Art. 6(1)(f)) | Platform performance, feature usage metrics |
| Billing & payments | Contract (Art. 6(1)(b)) | Subscription management, credit tracking, invoicing |
| Marketing communications | Consent (Art. 6(1)(a)) | Email campaigns, product updates |
| Compliance auditing | Legal obligation (Art. 6(1)(c)) | GDPR compliance, security assessments |
| Support ticket management | Contract (Art. 6(1)(b)) | Customer support, issue resolution |
2. Categories of Data Subjects
- Business users (customers/account holders)
- CRM contacts (data entered by customers about their clients)
- Email recipients (contacts in email campaigns)
3. Categories of Personal Data
| Category | Data Elements | Sensitivity |
|---|---|---|
| Account information | Name, email, company, password hash | Standard |
| Business contacts | Name, email, phone, company, job title | Standard |
| Financial data | Invoice amounts, payment status (no card numbers — delegated to Stripe) | Standard |
| Usage analytics | AI actions, feature usage, session duration | Standard |
| Communications | Email threads, message content | Standard |
| Integration tokens | OAuth tokens (encrypted at rest) | High |
4. Recipients & Third-Party Transfers
| Recipient | Purpose | Safeguards |
|---|---|---|
| AWS (US-East-2) | Infrastructure, storage, compute | DPA, SCCs |
| Google Gemini | AI content generation, entity analysis | DPA, data deletion after processing |
| Stripe | Payment processing | PCI DSS, DPA |
| Meta (Facebook/Instagram) | Social media publishing | Platform ToS, user-initiated |
| Social media publishing | Platform ToS, user-initiated | |
| Microsoft Graph | Email sync, calendar | DPA, user-initiated |
| Intuit QuickBooks | Invoice sync | DPA, user-initiated |
| Replicate | Video/media generation | DPA, ephemeral processing |
5. International Transfers
All data is stored in AWS US-East-2 (Ohio, United States). Transfers to third-party processors are protected by:
- Standard Contractual Clauses (SCCs)
- EU-US Data Privacy Framework (where applicable)
- Processor DPAs with each sub-processor
6. Retention Periods
| Data Type | Retention | Basis |
|---|---|---|
| Account data | Duration of account + 30 days | Contract |
| CRM contacts | Duration of account | Contract |
| Messages/threads | 730 days (auto-purged) | Legitimate interest |
| AI usage events | 24 months (TTL auto-delete; kept for the same 24 months after account deletion as billing records, no longer linked to any identifying profile) | Legitimate interest |
| Activity logs | 90 days (TTL auto-delete) | Legitimate interest |
| Agent executions | 365 days (auto-purged) | Legitimate interest |
| Email campaign jobs | 365 days (auto-purged) | Legitimate interest |
| Email events | 180 days (auto-purged) | Legitimate interest |
| Billing records | 7 years | Legal obligation |
| Snapshots | 365 days (auto-purged) | Legitimate interest |
7. Technical & Organizational Security Measures
- TLS 1.2+ for all data in transit
- AES-256 encryption at rest (AWS managed keys)
- IAM least-privilege access controls
- PII redaction before AI transmission (emails, phones, SSNs, credit cards)
- Session tokens with 24-hour TTL and HMAC signatures
- Brute-force protection with escalating lockout
- DND suppression guards (fail-closed) for outbound messaging
- Token encryption for stored OAuth credentials
- SSRF protection for server-side URL fetches
This Record of Processing Activities is maintained pursuant to Article 30 of the GDPR. For questions, contact our Data Protection Officer at dpo@aibizlutions.com.
See also: Privacy Policy | Data Processing Agreement | Sub-Processors | Representatives