1. Roles
Where we process personal data about your callers, you are the controller and we are the processor. You decide the purpose; we act on your documented instructions. This addendum forms part of the Terms of Service.
2. Subject matter of the processing
- Categories of data subject: your callers, leads, existing customers, and your own staff.
- Categories of personal data: phone number, name, call audio, transcripts, appointment details, SMS content, and any information a caller volunteers during a call.
- Special category data: not solicited, but a caller may volunteer it (for example health details when describing an emergency).
- Duration: for the term of your subscription, plus the retention period in the Privacy Policy.
3. Our obligations
- Process personal data only on your documented instructions.
- Ensure personnel with access are bound by confidentiality.
- Apply appropriate technical and organisational security measures.
- Assist you with data subject requests, breach notification and impact assessments, so far as reasonably possible.
- Notify you without undue delay on becoming aware of a personal data breach.
- Delete or return personal data at the end of the contract, at your choice.
- Make available the information needed to demonstrate compliance, and allow audits on reasonable notice.
4. Your obligations
You warrant that you have a lawful basis for the calls the agent makes and receives, that you have obtained any consent required for recording, and that your instructions to us do not put us in breach of data protection law. See the Acceptable Use & AI Policy.
5. Sub-processors
You authorise us to engage the sub-processors below. We will give notice before adding or replacing one, and you may object on reasonable data-protection grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| GoHighLevel (HighLevel) | CRM, calendar, pipeline and telephony platform of record | United States |
| Twilio (via GoHighLevel LC Phone) | Placing and receiving calls, SMS delivery | United States |
| AI & speech processing providers | Speech-to-text, language understanding, voice synthesis | United States / European Union |
| Cloud hosting provider | Application hosting and storage of recordings and transcripts | European Union |
| Payment processor | Subscription billing and card processing | United States |
| Google (Tag Manager / Analytics) | Website analytics | United States |
The specific provider we use within each category is available on request — email ghlsparkai@gmail.com. We keep this list current and update it here when a sub-processor changes.
6. International transfers
Where personal data is transferred across borders — including to providers in the United States and the European Union — we rely on the data protection laws of the country in which each sub-processor operates, together with the contractual commitments in our agreements with them and encryption in transit and at rest.
7. Contact
Data protection queries: ghlsparkai@gmail.com.