Last updated: 2026-05-07
1. Data controller
The U.S. entity Muse Layer LLC acts as the commercial operator. For GDPR purposes, the entity below has been designated as EU Representative pursuant to Article 27 GDPR. GDPR data subject requests are handled through the EU Representative.
1.1. Commercial operator (parent)
- Legal name: Muse Layer LLC
- Address: 5203 Juan Tabo Blvd, Ste 2B, Albuquerque, NM 87111, USA
- EIN: 30-1474701
- Jurisdiction: New Mexico (USA)
1.2. EU Representative (GDPR Art. 27) and technology processor
- Legal name: Screen Art S.L.
- VAT/Tax ID: B57029415
- Address: Carrer Rosari 47, 07420 - Sa Pobla, Illes Balears, España
- Email: screenart@muserelay.com
2. Data protection contact
- Privacy / GDPR: privacy@muserelay.com
- Data Protection Officer: privacy@muserelay.com
3. Purposes of processing
- Providing the Agent8Ai Organization service and managing the user account.
- Handling inquiries, technical support and operational communications.
- Billing and compliance with accounting and tax obligations.
- Compliance with legal obligations (GDPR, e-commerce regulations, applicable tax law).
- Service improvement through aggregated, anonymized metrics.
3.bis Categories of data processed
- Account and organization: name, email, encrypted credentials, roles, workspace, preferences, language and billing/tax data.
- Contacts and end users: name, email, phone number, channel identifiers, labels, notes, history and data provided during conversations.
- Conversations and tickets: messages, human or AI replies, status, assignments, priority, attachments, audit trail and public token-based tracking.
- Calendars and bookings: appointments, resources, service types, availability, confirmations, cancellations, reminders and data required to provide the service.
- Voice and telephony: caller ID (CLI), called number, timestamps, duration, routing and textual transcript. Agent8Ai Organization does not store call audio unless a specific feature expressly states otherwise.
- Files and multimodal data: images, audio, documents or other attachments sent by the Customer or its end users through connected channels.
- Technical and security data: IP, device, browser, logs, encrypted integration tokens, audit events and usage metrics.
Agent8Ai Organization native calendar and native ticketing system allow bookings, availability and support to be managed inside the platform. This reduces the need to transfer personal data to external tools and keeps that data on the European servers used by MuseRelay, except for external integrations voluntarily enabled by the Customer.
4. Legal basis
- Performance of contract (Art. 6.1.b GDPR) for service delivery and billing.
- Compliance with legal obligations (Art. 6.1.c GDPR) for accounting and tax retention.
- Legitimate interest (Art. 6.1.f GDPR) for security, fraud prevention and anonymized metrics.
- Consent (Art. 6.1.a GDPR) for marketing communications and non-essential cookies.
4.ter Analytics, captcha and Google services not used
Agent8Ai Organization does not use Google Analytics or equivalent third-party advertising analytics tools on the legal pages and public platform flows. Any operational metrics are internal, aggregated or technical, and are used for security, performance and service billing.
For anti-bot protection we do not use Google reCAPTCHA or third-party reCAPTCHA providers. The public captcha configured by default is self-hosted ALTCHA, verified by MuseRelay on its own infrastructure, avoiding the transfer of the anti-bot check to Google or other external providers.
4.bis Meta Platforms data (Instagram, Facebook Messenger, WhatsApp Business)
When you connect Instagram Business, Facebook Messenger or WhatsApp Business to Agent8Ai Organization, we receive from Meta Platforms:
- Account profile information (name, picture, ID).
- Incoming messages and attachments.
- Webhook events (delivery, read receipts).
This data is used solely to provide the messaging functionality within Agent8Ai Organization. We do NOT use Meta data for:
- AI model training.
- Marketing or advertising.
- Resale to third parties.
- Cross-platform profiling.
Data deletion: per GDPR Art. 17, users can request full deletion through:
- Their Agent8Ai Organization account settings.
- Email to privacy@muserelay.com.
- The dedicated public page /data-deletion.
- The Facebook deauthorize callback configured in our Meta App.
- The Facebook data deletion request flow.
5. Data retention
Data is retained for the duration of the contractual relationship and afterwards for the legally required periods (a minimum of 6 years for tax and accounting records under applicable law).
6. Recipients and subprocessors
We work with a limited set of subprocessors (infrastructure, messaging and telecommunications providers) who act under data processing agreements. The up-to-date list is available at /subprocessors. Main processing infrastructure is located in Alemania (UE) y Bélgica (UE).
7. International transfers
Where a subprocessor is located outside the European Economic Area, the safeguards set out in Chapter V of the GDPR apply (Standard Contractual Clauses approved by the European Commission, adequacy decision and/or additional technical measures such as encryption).
8. Data subject rights
You may exercise your rights of access, rectification, erasure, objection, restriction, portability and to not be subject to automated decisions by writing to privacy@muserelay.com or privacy@muserelay.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) as the supervisory authority of the EU Representative.
9. Security
We apply appropriate technical and organisational measures (encryption in transit and at rest, access control, audit logging and incident response procedures) in accordance with Art. 32 GDPR.