Data Processing Agreement

1. Definitions

For the purposes of this DPA:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data.
• "Controller" means the entity that determines the purposes and means of Processing.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller.
• "Data Subject" means the individual to whom Personal Data relates.
• "Sub-processor" means any Processor engaged by the Processor.

2. Processing of Personal Data

2.1 Processor's Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure persons authorized to process Personal Data are subject to confidentiality
• Implement appropriate technical and organizational measures
• Assist the Controller in responding to Data Subject requests
• Delete or return Personal Data at the end of the provision of services

2.2 Nature and Purpose of Processing

• Nature: Collection, recording, storage, retrieval, use, and transmission of call data
• Purpose: Provision of AI-powered phone answering services
• Duration: For the term of the Agreement plus any retention period

3. Types of Personal Data

The following categories of Personal Data may be processed:

• Contact information (names, phone numbers)
• Voice recordings and transcripts
• Call metadata (timestamps, duration, caller ID)
• Message content
• Business inquiry details

Categories of Data Subjects

• Customers of the Controller
• Prospective customers
• Employees or representatives of customers
• Other individuals who contact the Controller

4. Security Measures

Technical Measures

• Encryption of data in transit and at rest
• Automated weekly dependency vulnerability checks
• Access controls and authentication mechanisms
• Network security provided by our managed hosting providers
• Regular security updates and patches

Organizational Measures

• Access on a need-to-know basis
• Confidentiality agreements with staff
• Incident response procedures

5. Sub-processors

Authorized Sub-processors

The Controller agrees to the use of the following sub-processors:

• Vercel: Application hosting, file storage (Vercel Blob), and AI models (Vercel AI Gateway). AI Gateway sends model requests to AI providers that Vercel lists as its own subprocessors.. Data: All data the application handles, including call recordings, attachments, and conversation content sent to AI models.
• PlanetScale: Primary Postgres database, hosted on AWS in us-east-2 (Ohio). Data: All stored customer records.
• Inngest: Background job scheduling. Data: Job events, mostly record IDs, and the task details sent to webhooks.
• Twilio: Phone numbers, calls, SMS and MMS, caller lookup. Data: Phone numbers, call audio, message content.
• ElevenLabs: Voice AI for phone calls. Data: Live call audio, transcripts, call recordings.
• LiveKit: Voice AI for phone calls, including speech and language models, and call debugging. Data: Live call audio, transcripts, and call logs and traces, including AI requests and responses, kept up to 30 days for debugging.
• Resend: Inbound and outbound email. Data: Email addresses and content.
• Pusher: Realtime dashboard updates. Data: Record IDs and counts, no message content.
• WorkOS: Sign-in for AI app connections. Data: User ID, name, and email address of the person who connects an AI app, and their team ID and name.
• Sentry: Error monitoring. Data: Incidental personal data in error reports.
• PostHog: Product analytics and AI quality tracing. Data: Dashboard usage events, which may include incidental personal data, and AI requests and responses, with emails, phone numbers, card-like numbers, and credentials masked. Other personal details, such as names, may remain.
• Braintrust: AI quality tracing, stopped October 3, 2026. Data: Previously sampled AI requests and responses, with emails, phone numbers, and card-like numbers masked, held until deletion is confirmed.
• Stripe: Payment processing for Answering Agent subscriptions. Data: Business billing contacts and payment details.
• Autumn: Subscription and plan management. Data: Business billing contacts and plan usage.

Answering Agent does not use Personal Data to train AI models. The AI model providers that handle its requests do so with zero data retention. LiveKit lists its AI model providers at livekit.com/legal/sub-processors. Calls on ElevenLabs follow ElevenLabs' own terms, and ElevenLabs uses AI model providers under its own subprocessor terms, listed at compliance.elevenlabs.io. PlanetScale runs on Amazon Web Services. Answering Agent sends no data directly to these providers.

AI apps, API clients, and webhook endpoints that the Controller connects are not Sub-processors. Processor sends Personal Data to them only on the Controller's instructions.

Changes to Sub-processors

• Processor will notify Controller of intended changes
• Controller has 30 days to object to new sub-processors
• If objection cannot be resolved, Controller may terminate affected services

6. International Transfers

Personal Data may be transferred to countries outside the EEA. Such transfers will be subject to appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions
• Other valid transfer mechanisms under applicable law

7. Data Subject Rights

The Processor shall assist the Controller in fulfilling obligations to respond to Data Subject requests for:

• Access to Personal Data
• Rectification or erasure
• Restriction of Processing
• Data portability
• Objection to Processing

8. Personal Data Breach

Breach Notification

• Processor will notify Controller without undue delay upon becoming aware of a breach
• Notification will include all available information about the breach
• Processor will cooperate in investigation and mitigation

Breach Records

Processor maintains records of all breaches including:

• Facts relating to the breach
• Effects and remedial action taken
• Documentation sufficient for regulatory compliance

9. Audit and Compliance

Audit Rights

• Controller may conduct audits up to once per year
• 30 days advance written notice required
• Audits conducted during business hours
• Controller bears costs unless material non-compliance found

Certifications

Processor does not currently hold a SOC 2 report or other security certification. Processor is working toward a SOC 2 examination and will provide any issued report to Controller on request, under a confidentiality agreement.

Until then, Processor will provide its current security documentation and answer reasonable security questionnaires on request.

10. Return and Deletion

Upon termination of services:

• Processor will return or delete all Personal Data
• Controller has 30 days to retrieve data
• Deletion certificate provided upon request
• Legal retention requirements may apply

11. Liability and Indemnification

Processor Liability

• Processor liable for Processing outside Controller instructions
• Processor liable for failure to comply with direct obligations
• Liability subject to limitations in main Agreement

Indemnification

Each party indemnifies the other against damages arising from their respective breaches of data protection law.

12. GDPR Compliance

For Processing subject to GDPR:

• Processor will comply with Articles 28-33 of GDPR
• Processor will assist with DPIAs where required
• Processor will maintain Article 30 records
• Standard Contractual Clauses apply for transfers

13. California Privacy Rights

For Processing subject to CCPA/CPRA:

• Processor is a "Service Provider" under CCPA
• Processor will not sell Personal Information
• Processor will not retain, use, or disclose for commercial purposes
• Processor certifies understanding of restrictions

14. Term and Termination

• DPA effective for duration of main Agreement
• Survives termination for Processing obligations
• Data deletion/return obligations survive termination

15. Governing Law

This DPA is governed by the same law as the main Agreement, except where data protection law requires otherwise.

16. Contact Information