Data Processing Agreement

1. Roles

• 1.1 For your customers' and callers' personal data you are the controller and we are your processor.
• 1.2 We are a controller for your own account data and for the signing audit trail, as described in our Privacy Policy.

2. What We Process

• Subject matter: providing the Service: the AI Virtual Receptionist, voicemail, customer and job records, quotes and invoices, and document sending and signing.
• Duration: for the term of your account and the retention periods in section 9.
• Purpose: answering your calls and recording their details, sending you alerts, keeping your records, and sending documents for signature.
• Data subjects: your callers, customers and document signers, and your staff who use the account.
• Personal data: names, phone numbers, email and postal addresses, call transcripts and summaries, voicemail audio, job details, quotes and invoices, and signed documents.
• Special category data: not intended, but callers may mention health or similar details (for example to a care home). You must tell us if your business routinely receives such data, so that a data protection impact assessment can be carried out.

3. Your Instructions

• 3.1 We process the data only on your documented instructions: this agreement, your settings in the Service (such as the receptionist's questions, urgent-call alerts and transfers) and anything you ask in writing, unless the law requires otherwise, in which case we will tell you first if the law allows.
• 3.2 We will tell you if we think an instruction breaks data protection law.
• 3.3 You are responsible for having a lawful basis, for telling your callers and customers how you use their data (you can link them to our caller privacy notice), and for the receptionist questions you configure.

4. Our Obligations

• 4.1 Confidentiality: everyone who can access the data is bound by confidentiality.
• 4.2 Security: we apply the measures in section 8.
• 4.3 Rights requests: we will pass to you any request we receive from your callers or customers, and help you answer requests (copies, correction, deletion) through the Service or on request.
• 4.4 Compliance help: we will help you with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account what we know about the processing.
• 4.5 Breaches: we will tell you without undue delay, aiming for within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to notify the ICO.
• 4.6 Deletion and return: when your account ends we will, at your choice, let you export your data and then delete it within 90 days, except where the law requires us to keep it.
• 4.7 Audits: we will make available the information needed to show we meet this agreement, and allow reasonable audits (normally by written questionnaire, at most once a year unless after a breach).

5. Subprocessors

• 5.1 You authorise the subprocessors listed in section 10. We will give you at least 30 days' notice (by email or in the Service) of new subprocessors. You may object on reasonable data protection grounds; if we can't resolve it, you may close your account and receive a pro-rata refund of any prepaid fees.
• 5.2 We impose data protection terms on each subprocessor that are no less protective than these, and remain responsible to you for their work.

6. International Transfers

We transfer data outside the UK only with UK adequacy regulations, or the UK International Data Transfer Addendum or Agreement, in place. Current transfers are shown in section 10.

7. Liability

The limits in the Terms of Service apply to this agreement, except where the law does not allow them to.

8. Security Measures

• Data encrypted in transit (TLS) and at rest (Google Cloud default encryption).
• Access by workspace membership, enforced by database and storage rules that are tested automatically.
• Phone webhooks verified by signature; call audio streamed over signed, expiring links and not recorded.
• Staff and administrator access limited to what is needed, with Google Cloud audit logs.

9. Retention

Voicemail audio is deleted after 90 days, and call transcripts and caller details 12 months after the call. Documents and other records are kept as set out in the Terms of Service and the Privacy Policy.

10. Subprocessors

• Google Cloud / Firebase: hosting, database, file storage and the call-answering server. UK (database), United States (file storage), Netherlands (call server).
• Google (Gemini API, Speech-to-Text, Text-to-Speech): transcribing and understanding calls and voicemail, and drafting content. Global, including the United States. Not used to train Google's models.
• Telnyx: phone numbers, call connection, SMS alerts and voicemail recording. United States and EU.
• Resend: emails to you (call alerts, signing requests). United States.
• Stripe and GoCardless: payments, where you take payments from your customers. UK, EU and United States.
• postcodes.io: checking postcodes (the postcode only). UK.