Data Processing Addendum
Effective date: TBD. Placeholder pending legal review.
Roles
Customer is the data controller for the call data flowing through their Callspring brand. Callspring is the data processor.
Subprocessor categories
Callspring engages subprocessors across the following categories: database and authentication, telephony carriage, speech-to-text, language-model inference, text-to-speech synthesis, recording storage, billing, transactional email, and compute hosting. The current list of named subprocessors is provided to customers on request and is included as an exhibit to executed Data Processing Agreements. Customers are notified at least 30 days before any subprocessor change that materially affects data flows.
Security
Encryption in transit (TLS) and at rest. Row-level security in the database, scoped to the signed-in operator's team. Access logs are retained 12 months and available on request.
Breach notification
Material security incidents will be communicated to the customer within 72 hours of confirmation, along with the scope of impact and the remediation plan.
This page is a placeholder. Final DPA lands when legal review completes.