AI Phone Receptionist — Data Processing Agreement
This agreement forms part of the Terms of Service and is accepted together with them. It governs NexusCaller's processing of personal data of people who call the customer's phone line on the customer's behalf, under Article 28 of the EU General Data Protection Regulation (GDPR) and as a "service provider" under the California Consumer Privacy Act (CCPA/CPRA). A countersigned copy is available on request to info@nexuscaller.com.
1. Processing on instructions
The Processor processes callers' personal data only to provide the AI Phone Receptionist, on the Controller's documented instructions — its settings in the Service and these terms — unless required otherwise by law, in which case it will inform the Controller where permitted. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.
2. Purpose limitation
The Processor will not sell or share the data, will not use it for its own purposes (including training AI models or advertising), and will not combine it with data from other customers or sources, except as needed to provide the Service.
3. Confidentiality
Persons authorized to process the data are bound by confidentiality, and access is limited to what is needed to operate and support the Service.
4. Security
The Processor implements the measures in Annex 2 and keeps them appropriate to the risk.
5. Sub-processors
The Controller authorizes the sub-processors listed in the Privacy Policy (including Vapi and Twilio for telephony and voice AI, and the speech-recognition, voice and AI-model providers used through them). The Processor imposes equivalent data protection obligations on them, remains responsible for them, and gives at least 30 days' notice of any new sub-processor, during which the Controller may object; if the objection cannot be resolved, the Controller may terminate the affected Service.
6. Assistance
The Processor helps the Controller respond to data-subject requests (including a tool to find and delete all calls for a phone number or email address), and with security, breach notification and data protection impact assessments, taking into account the nature of the processing.
7. Personal data breaches
The Processor notifies the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available. For California personal information, the Processor notifies the Controller immediately after discovery.
8. Deletion and return
Call records, recordings, transcripts and summaries are deleted automatically 12 months after the call, in the Processor's systems and at Vapi. When the Service ends, the Processor deletes the Controller's data within 30 days, after the Controller has had the opportunity to retrieve it, unless law requires keeping it.
9. Information and audits
The Processor makes available the information necessary to demonstrate compliance, in the first instance by answering a reasonable security questionnaire once a year. On-site audits, where required by law, are at the Controller's cost and on reasonable notice.
10. International transfers
Data is processed in the United States. Where GDPR applies, transfers are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914, the "SCCs"), which are incorporated by reference, with the Controller as data exporter and the Processor as data importer: Module 2 (controller to processor) and, where the Controller acts as a processor for another controller, Module 3 (processor to processor). For the SCCs: Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorization) applies, and the Processor gives at least 30 days' notice of any new sub-processor, during which the Controller may object; under Clause 13, the competent supervisory authority is the one competent for the Controller; for Clause 17 (governing law) and Clause 18 (courts), the law and courts of the Republic of Ireland apply, unless the Controller's Member State is required. Annexes 1 and 2 of this agreement and the sub-processor list in the Privacy Policy provide the information for the SCCs' annexes. If this agreement conflicts with the SCCs, the SCCs prevail. A copy of the SCCs is available on request at info@nexuscaller.com.
11. Controller's responsibilities
The Controller is responsible for having a lawful basis for the processing, including for recording calls; for complying with call-recording and consent laws (such as all-party-consent rules) beyond the fixed spoken AI and recording notice the Service plays at the start of every call; for its own privacy notice to callers, which should mention that its line is answered by an AI assistant and recorded; for the content and instructions of its receptionist; and for not instructing the collection of sensitive data over the phone.
12. California (CCPA) service-provider terms
Where the CCPA applies, the Processor is the Controller's service provider, and the Controller discloses personal information to it only for the limited and specified business purpose of providing the Service described in Annex 1. The Processor:
- complies with the CCPA and provides the same level of privacy protection as the CCPA requires;
- does not sell or share the personal information;
- does not retain, use or disclose it for any purpose other than that business purpose, or outside its direct business relationship with the Controller;
- does not combine it with personal information it receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as the CCPA and its regulations allow; and
- notifies the Controller if it determines that it can no longer meet its obligations under the CCPA.
The Controller may take reasonable and appropriate steps to ensure that the Processor uses the personal information consistently with the Controller's CCPA obligations and, on notice, to stop and remediate unauthorized use.
Annex 1 — Description of processing
| Subject matter | Operating an AI phone receptionist that answers incoming calls to the Controller's phone line |
|---|---|
| Data subjects | Callers who phone the Controller's line answered by the Service |
| Personal data | Caller's phone number; number called; date, time and duration of the call; voice recording of the call; transcript; name, email, address or other details the caller chooses to share; AI-generated summary of the call (who called, what they need, whether a follow-up is needed) |
| Special categories | None intended. Voice recordings are not used to identify callers (no voiceprints). Callers may volunteer sensitive information; the Controller must not instruct the receptionist to request it |
| Nature and purpose | Answering calls using speech recognition, AI models and synthetic voices; recording and transcribing calls; summarizing calls and emailing summaries to the Controller; transferring calls to the Controller's staff line where configured |
| Duration | For the term of the Service; calls, recordings and transcripts up to 12 months (also deleted at Vapi); deletion within 30 days of the Service ending |
| Transfers | To the United States, under the Standard Contractual Clauses |
Annex 2 — Security measures
- Encryption in transit (HTTPS/TLS) for all access to the Service
- Passwords stored only as salted hashes (scrypt); two-step sign-in for administrator access
- Strict separation of customers' data — each customer's logins can access only that customer's receptionists and calls; call recordings are reachable only by signed-in users of that business
- Call events received from the voice platform are verified with a webhook secret
- Audit log of administrative actions; sign-in rate limiting
- Third-party API keys stored encrypted (AES-256-GCM)
- Blocking of website-reader requests to private network addresses
- Automatic deletion of calls, recordings and transcripts after 12 months, including at Vapi; one-step erasure of a caller's calls by phone number or email on request
- Hosting on Railway's managed infrastructure, with access limited to NexusCaller administrators