Data Processing Agreement

What we process, and why

We process personal data only to provide the service you subscribed to: connecting calls, answering them with the agents you configured, recording and transcribing where you have turned that on, writing the results to the CRM you connected, and billing you for use. We do not sell personal data, and we do not use your calls, recordings or transcripts to train our own models.

The categories are the ones a phone system implies: the names, numbers, email addresses and notes you hold about your contacts; the audio and text of calls placed through us; and the account details of the people on your team who use the service.

How long we keep it

Recordings and transcripts belong to you and stay available for as long as your subscription is active, unless you delete them sooner — each one can be deleted from its call record, and deletion is permanent.

When an account is closed, personal data is deleted within 30 days, except records we are required to keep for tax and accounting purposes, which are limited to billing details and retained for seven years. Encrypted backups are cycled out within 35 days. Call metadata kept for billing — the number called, the time and the duration — is retained with those billing records.

Recording and consent

Call recording is on by default and can be turned off for a line on request; calls answered by an AI assistant are always transcribed. Incoming calls that are recorded or transcribed start with a spoken notice that they may be recorded and transcribed: on calls answered by an assistant, before its greeting; on calls answered by your team, when they pick up. Calls your team places are recorded without a spoken notice, so it is up to the caller to tell the other person where the law requires it. The law on recording differs by state and country. As the controller, you remain responsible for any further notice or consent your callers’ jurisdictions require, and for how you use the recordings and transcripts.

Security measures

• Encryption in transit (TLS) for every connection to the platform, and encryption at rest for stored recordings, transcripts and integration credentials.
• Third-party credentials, including CRM tokens, are encrypted with a key held outside the database.
• Access to production data is limited to staff who need it to run the service, over authenticated and logged sessions.
• Tenant data is separated by account, and every request is authorised against the account that owns the record.
• Sensitive fields are kept out of application logs; call audio is never written to logs.
• Backups are encrypted and restricted to the same staff as production.

Subprocessors

We use the providers below to deliver the service. Each is bound by terms no less protective than this agreement. We will tell you before adding a new subprocessor that handles your personal data, and you may object on reasonable data-protection grounds.

For the current named list, including the specific companies behind each role, write to support@reasonvoice.ai.

International transfers

Data is processed in the United States. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses, which are incorporated into this agreement by reference and apply automatically to those transfers.

Your rights, and what we do

Access and export

Your data is available in the dashboard and through our API at any time during the subscription.

Correction and deletion

You can edit or delete contacts, calls, recordings and transcripts yourself. Closing an account removes personal data as described above.

Assistance with requests

If someone whose data you hold makes a request to you, we help you answer it within the time the law allows.

Breach notification

If we become aware of a personal data breach affecting your data, we notify you without undue delay and within 72 hours of becoming aware.

Audit

On reasonable notice, and no more than once a year, we answer questions about how this agreement is met and provide the documentation we hold.

Staff and confidentiality

Everyone at ReasonVoice with access to personal data is bound by confidentiality obligations that survive the end of their engagement, and access is removed when it is no longer needed for their work.

Ending the agreement

This agreement lasts as long as we process personal data for you. When your subscription ends, you may export your data for 30 days, after which it is deleted on the schedule above. Disconnecting a CRM or uninstalling our app revokes our access to that system immediately.