Data Processing Addendum

U.S. state privacy laws require a business to have a written contract with any provider that processes personal information on its behalf. Without one, handing data to a provider can count as a sale or a share — with obligations the business did not intend to take on.

This Addendum is that contract. It applies automatically when the Business accepts the Terms of Service; no signature is required, and none needs to be requested.

The Business is the controller (in California wording, the business). It determines what personal information is collected through VoxPilot and why.

VoxPilot is the service provider (elsewhere, the processor). It processes that information only on the Business’s documented instructions.

The Business’s use of the platform — the settings it chooses, the questions it gives the agent, the numbers it routes — constitutes its documented instructions.

Subject matter: answering, recording, transcribing, and summarizing inbound telephone calls; extracting structured details; and, where connected, creating calendar appointments.

Duration: the term of the Terms of Service, plus the retention period in § 8.

Categories of individuals:people who call the Business, and the Business’s own staff who use the dashboard.

Categories of information: voice recordings, transcripts and summaries, names, telephone numbers, email addresses where given, appointment details, and whatever else a caller chooses to say.

VoxPilot will:

• process personal information only to provide the service, and for no commercial purpose of its own;
• not sell it and not share it for cross-context behavioral advertising;
• not retain, use, or disclose it outside the direct business relationship between the parties;
• not combine it with information received from anyone else, except as permitted to provide the service;
• not use it to train foundation or general-purpose AI models;
• bind every person with access to confidentiality, and grant access only where it is needed to do the work;
• notify the Business if it can no longer meet these obligations.

The Business is responsible for:

• obtaining every consent and giving every notice required to record and transcribe its calls, including in states that require the consent of all parties;
• keeping the AI announcement enabled and accurate for the jurisdictions its callers call from;
• the lawfulness of the instructions it gives;
• not entering into the platform any information it is not permitted to process — including protected health information under HIPAA, which VoxPilot does not support.

VoxPilot maintains, at a minimum:

• encryption of personal information in transit and at rest;
• separation of each customer’s data by tenant;
• authenticated access to the dashboard, with role-based permissions;
• logging of access to production data;
• restriction of production access to personnel who require it;
• backups, and a documented path to restore them.

These measures may change as technology does. VoxPilot will not reduce the overall level of protection during the term.

The Business authorizes VoxPilot to engage the subprocessors listed in the Privacy Policy, which names each provider and what it does.

VoxPilot will impose data protection obligations on each subprocessor that are no less protective than those in this Addendum, and remains liable for their performance.

VoxPilot will give at least 30 days’ notice before adding or replacing a subprocessor. If the Business objects on reasonable data protection grounds, it may terminate the affected service without penalty before the change takes effect.

The Business may export or delete its data at any time from the dashboard. On termination, VoxPilot deletes personal information within 30 days, except where the law requires it to be kept longer — in which case it remains protected by this Addendum for as long as it is held.

Backups are overwritten in the ordinary backup cycle.

Requests from individuals.Where a caller contacts VoxPilot directly about access, correction, or deletion, VoxPilot will not answer on the Business’s behalf. It will forward the request without undue delay and assist the Business in responding.

Audit. On reasonable written request, and no more than once in any twelve months unless a law or a security incident requires otherwise, VoxPilot will provide the information needed to demonstrate compliance with this Addendum. Where an on-site inspection is legally required, the parties will agree scope and timing in advance and the Business bears the cost.

Security incidents.VoxPilot will notify the Business without undue delay, and no later than 72 hours after becoming aware of a breach affecting the Business’s personal information, and will provide what is known about its nature, scope, and remediation.

Liability under this Addendum is subject to the limitations in § 16 of the Terms of Service. Nothing here creates a liability that those limitations exclude.

A U.S. business can still fall under the EU General Data Protection Regulation — for example where it offers services to people in the European Union and receives their calls.

Where the GDPR applies to the Business’s use of VoxPilot, the parties agree that the German Auftragsverarbeitungsvertrag applies in addition to this Addendum for that processing, and that VoxPilot acts as processor under Article 28 GDPR. Where the two documents conflict, the one imposing the stricter obligation on VoxPilot governs.

A Business in this position should tell us, so we can put the right paperwork — including standard contractual clauses where a transfer requires them — in place.

Where this Addendum conflicts with the Terms of Service on the processing of personal information, this Addendum governs. In all other respects the Terms of Service govern.