Data Processing Addendum

Last updated: January 2026 · Incorporates GDPR, CCPA, and HIPAA-ready provisions

1. Parties & Scope

This Data Processing Addendum ("DPA") is part of the Terms of Service between VoiceAI ("Processor") and the customer ("Controller"). It applies to all personal data processed by VoiceAI on behalf of the customer, including call recordings, transcripts, phone numbers, contact information, and AI-generated content.

2. Roles & Responsibilities

Customer = Data Controller

Determines the purposes and means of processing. Responsible for obtaining consent from call participants, complying with telecommunications laws, and managing data subject requests.

VoiceAI = Data Processor

Processes data on behalf of the customer per documented instructions. Does not use customer data for own purposes. Does not sell customer data.

3. Data Processing Details

CategoryData TypesPurposeRetention
Voice DataCall audio, real-time voice streamsSpeech processing, agent responsesUntil customer deletion
Text DataTranscripts, summaries, analyticsCall analysis, CRM recordsAccount lifetime
Contact DataPhone numbers, names, email, notesCRM, call routing, follow-upsUntil customer deletion
LLM LogsPrompts, responses, tokens, errorsDebugging, cost tracking90 days
Account DataEmail, name, company, roleAccount management30 days post-termination

4. Subprocessors

VoiceAI uses the following subprocessors. Customers are notified 30 days before adding new subprocessors:

  • Twilio Inc. — Telephony (PSTN, SMS, phone numbers) — DPA available
  • AssemblyAI Inc. — Speech-to-text, voice AI — DPA available
  • Supabase Inc. — PostgreSQL hosting, auth, storage — DPA available
  • Stripe Inc. — Payment processing — DPA available
  • LLM Providers — Customer-selected (OpenAI, Anthropic, Google, etc.) — Customer responsible for DPA with their LLM provider
  • Resend Inc. — Email delivery — DPA available

5. Security Measures

  • Encryption in transit: TLS 1.2+ for all connections
  • Encryption at rest: AES-256 for database and file storage
  • Row Level Security (RLS) isolates tenant data at the database level
  • API keys hashed with SHA-256 (never stored in plaintext)
  • Webhook signatures: HMAC-SHA256
  • SSO/SAML 2.0 for enterprise authentication
  • Audit logging for all administrative actions
  • Regular security reviews and penetration testing
  • Incident response: notification within 72 hours of breach discovery

6. Data Subject Rights

VoiceAI assists customers with data subject requests by:

  • Providing API endpoints for data export (full tenant data in JSON/CSV)
  • Providing dashboard tools for data deletion
  • Supporting account-level data deletion (removes all tenant data within 30 days)
  • Maintaining audit logs of data access for compliance verification

7. HIPAA-Ready Configuration

For healthcare customers (Scale plan), VoiceAI supports:

  • Business Associate Agreement (BAA) available upon request
  • No data retention mode: transcripts processed then immediately deleted
  • Customer-managed encryption keys
  • Audit trail for all PHI access
  • AssemblyAI and Twilio both offer BAAs for their services
  • Customer must execute BAAs with all subprocessors that touch PHI

8. International Data Transfers

Data is stored in Supabase's primary region (US or EU, customer-selected). Cross-border transfers use Standard Contractual Clauses (SCCs). LLM provider data transfers depend on the customer's configured provider — customers should review their LLM provider's data residency options.

9. Contact

DPO contact: dpo@voiceai.example

← Back to home
TermsPrivacyAcceptable Use