Tenant Compliance Guide

Provider: ETACARINAE S.R.L. · VAT IT02552640068 · Contact: legal@assumiai.it
Last updated: 13 February 2026 · Audience: businesses using Alba by AssumiAI to communicate with their own customers

Alba by AssumiAI is a B2B SaaS. When you (the tenant) use Alba to talk to your own customers, some legal responsibilities remain with you as the data controller. This guide summarises what you must do to stay compliant in the EU, US and Canada.

1. Your role vs ours

You are the data controller for your customers' data. You decide why and how it is processed.
ETACARINAE S.R.L. is the data processor acting on your instructions, under the Data Processing Agreement.

2. GDPR (EU)

Add Alba by AssumiAI (ETACARINAE S.R.L.) to your list of sub-processors in your own privacy policy.
Collect and document consent for marketing communications; consent for transactional communications is not required but should be logged.
Publish a lawful basis (contract, legitimate interest, consent) for each processing purpose.
Answer data-subject requests within 30 days. Alba exports customer data on demand via the Admin dashboard.

3. AI Act (EU)

Inform end-users that they are interacting with AI. Alba does this automatically at the start of every inbound conversation on your behalf; you should also mention it in your own privacy policy.
Do not use Alba to make legally-binding decisions without human oversight (art. 22 GDPR + AI Act).
For high-risk verticals (medical, legal), enable Human Review mode in the tenant settings.
Art. 50(4) — public-interest content: if you publish Alba-generated text or audio to inform the public on matters of public interest (health, legal, financial, real-estate, political or news content — e.g. blog posts, newsletters, social media posts, press releases), you must add a clear AI-generated disclosure such as "AI-assisted" or "generated with AI". This obligation falls on you as the deployer, not on Alba as the provider.

3-bis. US state AI laws (in force in 2026)

California SB 1001 — bot disclosure in commercial/political chats. Alba's automatic "you are talking to an AI" greeting satisfies this on all channels.
California SB 942 (Jan 2026) — watermarking of AI-generated content: not applicable to private customer-service conversations; only relevant if the tenant publishes AI-generated content publicly (see §3 art. 50(4) above).
Utah SB 149 — chatbots in regulated occupations (medical, legal, mental health, accounting) must proactively disclose AI. Alba's greeting covers this.
Colorado SB 26-189 (May 2026, effective Jan 1, 2027 — repealed and reenacted SB 24-205) — Automated Decision-Making Technology (ADMT) framework for consequential decisions in employment / credit / insurance / education / housing / healthcare / legal / government. Alba does not make consequential decisions, so you remain out of scope as long as you use Alba for customer service. Do not repurpose Alba for automated hiring or credit scoring without written authorisation and a bias audit.
Tennessee ELVIS Act — voice cloning requires explicit consent of the voice owner. If you use Alba Voice V1 clone, you must have documented consent from whoever's voice was cloned.

4. US 10DLC / TCPA (SMS)

Register your Brand and Campaign via Alba's Twilio 10DLC onboarding flow.
Collect opt-in consent for every phone number before sending SMS. Store timestamp and IP.
Honour STOP, UNSUBSCRIBE, END, QUIT, CANCEL keywords. Alba enforces this at the policy engine layer.
Send HELP reply within one message cycle. Alba handles this automatically.
Include your business name and STOP disclaimer in the first message to a new recipient.

5. Canada CASL / CRTC

Explicit consent (opt-in) required for commercial electronic messages (CEMs); implied consent has strict limits (existing business relationship within 24 months).
Every CEM must include sender identification and an unsubscribe mechanism.
V1 voice cloning is not available in Canada pending CRTC AI-voice compliance completion. Use V2.

6. California CCPA / CPRA

Add a "Do Not Sell or Share My Personal Information" link to your website (Alba does not sell data; still required if you are the tenant).
Honour user opt-outs of sale/share within 15 business days.

7. Retention

Alba retains conversation content for 730 days by default; you can reduce this per your policy. Consent records are retained 10 years (accountability). Invoices 10 years (Italian tax law) or as per your local law.

8. Incident response

Personal data breaches: notify us within 24 hours at privacy@assumiai.it. We will support your notification duties to the relevant Data Protection Authority (72h in EU) and to affected data subjects when required.

9. Contact

Legal: legal@assumiai.it · Privacy: privacy@assumiai.it. We respond within 30 days.