The data you manage in Aymar Agents — leads, contacts, conversation messages, appointments, tickets — is
**personal data belonging to your own end customers**. Moving it into a system of yours, whether with your
API key (`/public/v1`), your own MCP server, or an integration connected from
**[Integrations](/en/integrations/)**, doesn't change the responsibility split that already governs the
rest of Aymar Agents — it's the same in all three cases:

- **Aymar Agents** acts as the **data processor**: we process and store that data on your behalf, under
  the guarantees of your contract and our data processing agreement (DPA).
- **Your account (the tenant)** is the **data controller**: you decide which external systems that data is
  shared with and for what purpose, and you're the one who answers to your end customers and to the
  relevant data protection authority.

## What this means in practice

When your data leaves Aymar Agents into another system of yours (a CRM, a spreadsheet, your own
helpdesk…), that destination system is **outside** what Aymar Agents can guarantee or audit. You're
responsible for:

- **Minimizing** what you extract — request only the fields your integration actually needs, don't list
  entire resources "just in case".
- **Meeting your own information obligations** (GDPR Arts. 13/14) about how you process that data in the
  destination system, if it adds a purpose your end customer wasn't already told about.
- **Honoring an erasure request** in your destination system too: deleting an end customer's data in
  Aymar Agents (from the Platform) doesn't automatically delete a copy already synced elsewhere before.
- **Safeguarding your API key or your MCP server's credentials** like any other credential that grants
  access to personal data — revoke them immediately if you suspect they leaked (guide
  **[API keys](/en/guides/claves-api/)**, section 13).

This page describes a split that's already in force, not something new introduced by any one piece — it's
the same logic that already applies to any third-party integration connected from your account, whether or
not a public API or MCP server is involved.

## See also

- **[Integrations](/en/integrations/)** — the connection, allowlist and audience mechanism that governs
  every integration.
- **[Authentication](/en/api/authentication/)** — the technical detail of API keys.
- **[Security and compliance](/en/security/)** — the rest of the guarantees, with the four access layers.