24 September 2026
Notice of processing
This instrument is issued by ByfronAI, Tbilisi, Georgia (the "Company"), under the Law of Georgia on Personal Data Protection of 14 June 2023 (the "Law"). For personal data submitted to the Company about its own correspondents, the Company is the controller. For personal data of a client's visitors and callers (together, "Customer Data"), the client is the controller and the Company is the processor, acting only on the client's documented instructions, which are the confirmation email under the terms of engagement and this instrument. Requests are made to Support@byfronai.com. No personal data protection officer has been designated. That address is the contact required by the Law until a designation is published.
1. Website correspondence
The public site maintains no account and no intake form. If a person emails the Company, the Company processes the address, the message, and any attachment, for the purpose of answering and, where requested, of preparing an engagement. The legal basis is the taking of steps prior to a contract at the person's request, and thereafter the contract. Provision of an email is a condition of receiving a reply. It is not a statutory obligation. Refusal has no consequence other than the absence of a reply. Where no contract follows, the correspondence is erased twenty-four (24) months after the last message.
The Company does not deploy advertising cookies, analytics cookies, or other non-essential cookies, and therefore seeks no consent for them. The hosting provider may retain a transient connection log as a security measure in the legitimate interest of keeping the site available. That log is not used to market to the visitor.
2. Customer Data
On an instructed build the Company processes the content of messages. On the one-hundred-eighty dollar and three-hundred-ninety-nine dollar plans it also processes a name and a telephone number where the person elects to leave them, together with the question asked. A name and number are not a condition of receiving an answer on the ninety-nine dollar plan. Refusal means only that the client's personnel cannot be asked to place a return call.
Customer Data is processed by the Company and by subprocessors bound by written contract, and only to the extent required to host the service, to carry a confirmed voice line, and to produce the reply. The Company does not sell Customer Data, does not use it to solicit the Company's own clients, and does not use it for any purpose outside those instructions. The categories of recipients are infrastructure providers, communications providers named in a voice confirmation, and such other processors as are strictly required for performance. A recipient may process data outside Georgia. Any such transfer is limited to what performance requires and is made under contractual safeguards. The Company does not publish the identity of its suppliers on this page. That identity is given to the client in the confirmation, or upon written request, before a new recipient is given Customer Data, and the client shall keep that disclosure confidential.
The legal basis, as between the client and the person concerned, is the basis the client determines, ordinarily the client's contract with that person or the client's legitimate interest in answering an enquiry the person initiated. As between the client and the Company, the basis of the Company's processing is the client's written instruction. Where the Law requires consent for a recording, the client shall obtain it, and the line shall state the fact of monitoring before the request is taken.
3. Audio monitoring
Audio monitoring, where the confirmed plan includes voice, is limited to answering the call, retaining the question, and handing the call to the client's personnel. It is not used for covert surveillance, for scoring a person who was not told, or for any purpose outside that handoff. Before the request is taken, the caller is informed that an assistant is on the line and that the call may be kept for the handoff, and is told that a person may be requested instead. Access is confined to the client's designated personnel and to Company personnel engaged on that build. The burden of proving that the warning was given rests on the controller, and the Company maintains the configuration that speaks it. Recordings and transcripts are destroyed at the end of the period in Article 4.
4. Retention
- Correspondence with no ensuing contract: twenty-four (24) months from the last message, then erased.
- Messages, names, numbers, call recordings, and transcripts: the paid term and ninety (90) days thereafter, then erased, or sooner on written instruction of the controller or of the data subject, and longer only where a law of Georgia requires retention.
- Invoices and accounting records: for the period Georgian accounting rules require, and no longer for any marketing purpose.
Upon expiry, data are erased or destroyed so they cannot be reconstructed in the ordinary course, except for a residual copy retained solely because a legal hold or a statutory duty so requires, and then only for that duty.
5. Rights
A data subject may require confirmation of whether data concerning that person are processed and, where they are, may require the data, the source, the purpose, the legal basis, the recipients or categories of recipients, the retention period or the criteria for determining it, and the existence of a transfer abroad. The person may require rectification, erasure, restriction, and portability, may object, and may withdraw consent. Withdrawal does not affect processing that was lawful before withdrawal, and does not undo a communication already delivered. The Company does not charge for the exercise of these rights. A request is made to Support@byfronai.com. The person may also lodge a complaint with the Personal Data Protection Service of Georgia at pdps.ge. Where the data are Customer Data, the request is properly addressed to the client as controller. The Company shall assist the client in answering it, and shall not answer it in a manner that contradicts the client's lawful instruction, except where the Law requires the Company to act directly.
6. Persons under sixteen
The services are not directed at a person under sixteen (16). The Company will not configure a deployment whose intended audience is such a person unless the parent or other legal representative has consented in the manner the Law requires, and unless processing special categories of such a person's data, if any were ever in scope, is supported by the written consent the Law demands. No such deployment is offered by these pages.
7. Security and subprocessors
The Company applies organisational and technical measures appropriate to the risk, including access limited to personnel on the relevant engagement and transmission protected in transit. Subprocessors are engaged only under written terms that bind them to the instructions and to confidentiality. The Company shall not permit a new subprocessor to receive Customer Data until the client has been told, in the confirmation or in a subsequent writing, who that subprocessor is. The means, architecture, and suppliers by which the Company performs are confidential information of the Company and are not part of the public notice. The Company shall notify the client without undue delay after becoming aware of a personal data breach affecting Customer Data, and shall provide the information the client reasonably needs to meet the client's own notification duties, including any duty to inform the Service.