How we handle your data
The AI systems we build talk to your customers. That's why data protection is part of every project from day one, not something added at the end.
Our promises
Customers know they're talking to AI
Every assistant introduces itself as an AI assistant and always offers a way to reach a person.
A person approves what matters
Emails, quotes and payments don't go out without human approval, unless you have asked for that explicitly.
We keep only what's needed
A system collects only the data its task needs and deletes it on an agreed schedule.
Your data stays yours
Wherever possible, systems run in your own accounts. If our contract ends, we hand everything over.
How we work with data
- Data processing agreement (DPA). We sign one with every client before a system starts working with personal data.
- UK GDPR and EU GDPR. We set the lawful basis for each type of data and describe the processing in your privacy notice.
- Data protection impact assessment (DPIA). We carry one out when a system handles sensitive data, for example in clinics.
- Access. Each agent gets only the permissions it needs. Access keys are kept in secure credential stores, never in code.
- Protection against manipulation. Incoming emails and messages are treated as data, not as instructions, and every action is logged.
Health data
For clinics and dental practices, the AI assistant gives no medical advice, directs emergencies to 999 or 112 and keeps the minimum information. Health data is a special category under GDPR and is processed only with a clear lawful basis and a contract.
AI regulation
We follow the EU AI Act for our clients in Bulgaria and the EU, and ICO guidance in the UK. Chatbots and voice assistants carry transparency duties, which we meet by default.
Questions about data
Email us at office@petrionai.com. We reply within one working day.