Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (“DPA”) applies when Swiftlee LLC (“Swiftlee,” “we”) processes personal data of your callers on your behalf while providing the answering service.

• You (the Customer) are the controller — you decide why and how your callers' personal data is processed.
• Swiftlee is the processor — we process that data only to provide the service, on your documented instructions.

For your own account data (your name, email, billing), Swiftlee acts as an independent controller, as described in the Privacy Policy.

2. Definitions

“Personal data,” “processing,” “controller,” “processor,” and “data subject” have the meanings given under applicable data-protection law, including the California Consumer Privacy Act as amended by the CPRA (“CCPA”). “Caller data” means personal data of your callers that Swiftlee processes under this DPA. “Sub-processor” means a third party engaged by Swiftlee to process caller data.

3. Details of the processing

• Subject matter: provision of the Swiftlee phone answering service.
• Duration: the term of your subscription, plus the retention periods in Section 10.
• Nature and purpose: receiving and handling inbound calls, capturing messages and intake, recording and transcribing calls, and delivering the results to you.
• Types of personal data: caller names, phone numbers, email addresses, call audio recordings, call transcripts, message content, and any information a caller volunteers.
• Categories of data subjects: your callers, prospects, customers, and contacts.

4. Swiftlee's obligations

Swiftlee will:

• Process caller data only on your documented instructions, including the instructions in this DPA and the Terms;
• Ensure personnel authorized to process caller data are bound by confidentiality;
• Implement and maintain the security measures described in Section 6;
• Assist you, taking into account the nature of the processing, in meeting your own obligations to data subjects and regulators;
• Not sell or share caller data, and not process it for advertising or for any purpose other than providing the service.

5. Sub-processors

You authorize Swiftlee to engage the sub-processors below to process caller data. Each is bound by data-protection terms no less protective than this DPA.

• Supabase — database, authentication, and data hosting
• Vapi — AI voice agent infrastructure (AI-tier customers)
• OpenAI — AI language model that powers the receptionist (via Vapi)
• Deepgram — speech-to-text transcription (via Vapi)
• Telnyx — voice and SMS telephony
• Cloudflare R2 — call recording storage
• Resend — transactional email delivery
• Stripe — payment processing (account billing data only)
• Vercel — application hosting
• Inngest — background job processing
• Sentry — error monitoring

We will give you advance notice of any new or replacement sub-processor and a reasonable opportunity to object on data-protection grounds.

6. Security measures

Swiftlee maintains technical and organizational measures including:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls and tenant isolation (row-level security) so each customer sees only its own data;
• Authenticated, audited access to production systems;
• Signed-URL, time-limited access to call recordings;
• Regular review of access and of sub-processor security posture.

7. Data subject requests

If a caller asks to access, correct, or delete their personal data, Swiftlee will promptly notify you and will not respond directly except on your instruction. Taking into account the nature of the processing, we will provide reasonable assistance — including tools in your portal to export and delete call data — so you can meet your response obligations.

8. Personal data breaches

Swiftlee will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting caller data, and will provide the information reasonably needed for you to meet your own notification obligations.

9. Audits

On reasonable written request, and no more than once per year (or as required by a regulator), Swiftlee will make available the information necessary to demonstrate compliance with this DPA.

10. Return and deletion of data

On termination of your account, Swiftlee will delete caller data in accordance with the retention schedule in the Privacy Policy — call recordings on their configured retention window, and remaining account and call data within 30 days of cancellation — except where retention is required by law. You may export your call data from the portal before termination.

11. International transfers

Caller data is processed primarily in the United States. Where Swiftlee or a sub-processor processes caller data outside the country of collection, it will do so under an appropriate legal transfer mechanism.

12. CCPA / CPRA terms

With respect to personal data subject to the CCPA, Swiftlee is a service provider. Swiftlee:

• Will process caller data solely to perform the service, and for no other purpose;
• Will not sell or share caller data, and will not retain, use, or disclose it outside the direct business relationship with you or for any commercial purpose other than the service;
• Will not combine caller data with personal data from other sources except as permitted by the CCPA;
• Certifies that it understands and will comply with these restrictions.

13. Liability and precedence

This DPA forms part of the Terms of Service. Each party's liability under this DPA is subject to the limitations of liability in the Terms. If there is a conflict between this DPA and the Terms on a data-protection matter, this DPA controls. This DPA is governed by the same law as the Terms.

14. Contact

Data-protection questions or requests: privacy@getswiftlee.com