Data Processing Agreement

1. Definitions

• Data Protection Laws: the laws that apply to processing Customer Personal Data under the Terms, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.
• Customer Personal Data: personal data the Service processes on your behalf, mainly about your callers, website chat visitors, people who message you, your email correspondents and your contacts.
• Sub-processor: a third party we engage that processes Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Personal Data.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have their GDPR meanings; "business", "service provider", "sell" and "share" have their CCPA meanings.

2. Roles of the parties

You are the controller of Customer Personal Data, or a processor acting for your own client, in which case you confirm that your client's instructions allow this DPA. We are your processor or sub-processor. For account and billing information about you and your users, and for our website, we are an independent controller under our Privacy Policy.

You are responsible for the lawfulness of the processing you instruct, including the notices and consents the law requires, such as any consent needed beyond the AI and recording notice the Service plays at the start of every call.

3. Processing on your instructions

We process Customer Personal Data only on your documented instructions: the Terms, this DPA and the way you configure and use the Service. If the law requires other processing, we tell you first unless the law forbids it. We tell you if we believe an instruction breaks Data Protection Laws. Annex 1 describes the processing.

We do not sell or share Customer Personal Data. We do not retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you, and we do not combine it with personal data from other sources, except as Data Protection Laws allow a service provider to do. We do not use it to train AI models, and we instruct the AI model providers we use not to store it or train on it.

4. Confidentiality

Everyone at NeuralMarketer who can access Customer Personal Data is bound by confidentiality and gets access only as needed to provide, secure and support the Service. Access to email content is limited to administrators, and each access is logged.

5. Security

We maintain the technical and organizational measures in Annex 2. We may update them over time, but never in a way that lowers the overall level of protection.

6. Sub-processors

• You authorize the Sub-processors listed in Annex 3.
• We give you at least 30 days' notice by email and in the app before we add or replace a Sub-processor, and we update Annex 3.
• You can object on reasonable data protection grounds within those 30 days by emailing legal@neuralmarketer.com. We will look for alternatives in good faith. If we cannot resolve the objection, you may cancel the affected service, and we refund prepaid fees for the time after the change takes effect.
• We bind each Sub-processor to data protection terms that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for its performance.

In an emergency, for example to restore the Service after a provider fails, we may replace a Sub-processor at once and tell you as soon as we can, with the same right to object.

7. Requests and assistance

The Service lets you export, correct and delete Customer Personal Data, erase everything about one person, delete single records and choose how long content is kept. If one of your data subjects contacts us, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to. We give you reasonable help with data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to us.

8. Security Incidents

We notify you without undue delay after we become aware of a Security Incident, and we aim to do so within 72 hours. We tell you what happened, the data and people likely affected, the likely consequences and what we are doing about it, and we update you as we learn more. We help you meet your own notification duties. Notifying you is not an admission of fault.

9. Deletion and return

While you use the Service you can export Customer Personal Data at any time from Settings. When the Terms end or you delete your account, our deletion job deletes Customer Personal Data, usually within minutes, including your voice agents and their call audio and transcripts at our voice provider. Deleted data leaves our backups within 7 days, and other Sub-processors delete their copies under their own retention schedules. We may keep data the law requires us to keep, and we protect it while we do.

10. Information and audits

We make available the information reasonably needed to show that we meet this DPA, including written answers to one security questionnaire a year. If that is not enough, or a supervisory authority requires it, you may audit our compliance once a year, with 30 days' notice, during business hours, at your cost, through an auditor bound by confidentiality, and without access to other customers' data.

11. International transfers

We process Customer Personal Data in the United States. For transfers from the EU, the EEA or Switzerland, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated into this DPA: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For those Clauses: the optional docking clause in Clause 7 applies; Option 2 of Clause 9 (general written authorization, with the notice period in the Sub-processors section) applies; the optional wording in Clause 11 does not apply; the supervisory authority under Clause 13 is the one competent for you or your representative; Clauses 17 and 18 choose the law and the courts of Ireland; and Annexes I, II and III are Annex 1, Annex 2 and Annex 3 of this DPA, with the parties named in Annex 1.

For transfers from the UK, the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner applies to those Clauses: Table 1 is completed from this DPA, Table 2 from the paragraph above, Table 3 from the Annexes, and either party may end the Addendum as its Table 4 allows. For transfers from Switzerland, references to the GDPR mean the Swiss Federal Act on Data Protection and the competent authority is the Federal Data Protection and Information Commissioner.

Where a recipient is certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, a transfer to that recipient may rely on that certification instead.

12. US state privacy laws

For personal information covered by US state privacy laws, we act as your service provider or processor. We follow the restrictions in Processing on your instructions, comply with those laws, provide the level of privacy protection they require, and tell you if we can no longer meet them, in which case you may take reasonable steps to stop and remedy unauthorized use.

13. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow those limits.

14. Term, changes and precedence

This DPA lasts as long as we process Customer Personal Data for you. If it conflicts with the Terms, this DPA controls; if it conflicts with the Standard Contractual Clauses, the Clauses control. We may update this DPA as the Terms describe, and we will not reduce the protection it gives Customer Personal Data without your agreement unless the law requires it.

15. Annex 1: Description of processing

• Parties: data exporter, the Customer named in the account (controller, or processor for its client); data importer, Neural Marketer LLC, 629 N High St, Columbus, OH 43215, United States, legal@neuralmarketer.com (processor).
• Data subjects: your callers; visitors who use your website chat; people who message your connected social accounts; senders and recipients of email in the inboxes you connect; your contacts and the people who book appointments with you; your users.
• Categories of data: names, phone numbers, email addresses, social platform identifiers and public profile names; call audio and transcripts; chat, message and email content; appointment details; notes and other information you or the people who contact you provide.
• Sensitive data: the Service is not designed for special categories of personal data or payment card data. You will not configure it to ask for them, and any that people volunteer is protected by the measures in Annex 2.
• Nature and purpose: answering calls, chats, messages and email for you with AI; transcribing calls; drafting replies; booking appointments; keeping records for you; producing reports; and supporting, securing and maintaining the Service.
• Frequency: continuous, while you use the Service.
• Duration and retention: for as long as you use the Service. Content follows each profile's retention setting (24 months unless you choose 3, 6, 12 or 36 months); call audio and transcripts at our voice provider are kept 90 days; deletion as in Deletion and return.
• Transfers to Sub-processors: as listed in Annex 3, for the purposes listed there.

16. Annex 2: Security measures

• Hosting: a private cloud network in the United States (Iowa); the database accepts only service identities, with no shared database passwords.
• Encryption: encryption in transit for all traffic; encryption at rest for databases, files and backups; an additional application layer of encryption for access tokens, connection secrets and sessions, using managed encryption keys.
• Access control: least-privilege service accounts; staff view a customer account only to support or secure it, with the reason recorded unless the customer has allowed support access; staff make changes in a customer account only with the customer's permission in Settings; email content is visible only to administrators; every staff access to a customer account and every administrator view of email content is logged.
• Authentication: confirmed email addresses for customer accounts; a fresh sign-in for sensitive actions such as account deletion; server-side sessions that can be revoked at once.
• Application security: signatures on incoming webhooks are verified and unverified requests are rejected; rate limits; bot checks on the sign-up and contact forms; protection against server-side request forgery when we fetch web pages.
• Logging and monitoring: request and error logs kept 30 days with email addresses and phone numbers masked; staff alerts when a privacy job fails.
• Availability and recovery: backups kept 7 days with point-in-time recovery; infrastructure defined in code and reviewed before it is deployed.
• Data minimization and deletion: retention settings per profile with a nightly purge; per-record deletion; erasing one person everywhere; account and profile deletion jobs that also remove what Sub-processors hold where their services allow it.
• AI providers: every request to an AI model that carries Customer Personal Data is sent with data collection denied, so only providers that do not store it or train on it are used.
• People: confidentiality duties for everyone with access, and access removed when it is no longer needed.
• Incidents: a documented process to assess, contain and notify, as in Security Incidents.

17. Annex 3: Sub-processors

Services you connect, such as your own Google, Microsoft or Meta accounts, are not our Sub-processors: we act in them on your instruction, under your own agreement with those providers.

18. Contact