Data processing addendum

You are the controller of the personal information you put into Ringfully and of the information the service generates about your calls. [TBD] is your processor, and acts on your documented instructions.

Under the California Consumer Privacy Act, we are a service provider. We do not sell or share personal information, do not retain it for any purpose other than providing the service, and do not combine it with information from anyone else.

This addendum forms part of the terms of service and applies automatically. You do not need to sign anything separately, though we will countersign a copy if your process requires one.

Subject matter and duration

Provision of a cloud telephone service, for as long as your subscription lasts, plus the thirty-day window after it ends.

Nature and purpose

Connecting, routing, recording and metering telephone calls and text messages, and keeping a record of them for you.

Categories of data subject

Your employees and contractors who use the service, and the members of the public who call you or whom you call.

Categories of personal information

Names, work email addresses, telephone numbers, call metadata, call recordings, voicemail audio and transcripts, text-message content, contact records, agent availability history, and session records including IP addresses. Set out in full in the privacy policy.

Special categories

None intended. A caller may nevertheless say something sensitive on a recorded call, which is a reason to think carefully about recording rather than a category we process on purpose.

We will:

1. process personal information only on your instructions, and tell you if we believe an instruction breaks the law;
2. keep everyone with access under a duty of confidence;
3. apply the security measures in clause 5;
4. use sub-processors only under clause 4;
5. help you respond to a data-subject request, under clause 6;
6. tell you about a personal-data breach without undue delay, under clause 7; and
7. delete or return the data at the end, under clause 8.

You give general authorisation for the sub-processors listed on the sub-processors page. We will update that page and tell you before a new one starts handling your data, and you may object.

Everything is processed in the United States — our servers and database in AWS US East (Northern Virginia), and call audio at Twilio with no region pinned. There is no Canadian and no European hosting option.

If you are a Quebec business, Law 25 requires you to assess this transfer before making it. This addendum, the sub-processors page and the security page are the material for that assessment, and we will answer specific questions in writing.

Passwords hashed with bcrypt; encryption in transit; per-organization data isolation enforced on an identifier read from the verified session token, with a test suite that attempts cross-organization access and asserts it fails; short-lived access tokens with rotating refresh tokens and replay detection; account lockout; rate limiting at the application and at the edge; a default-deny egress firewall on outbound requests made by call flows; secrets in a managed secret store. The security page describes each.

Stated equally plainly, because an addendum that omitted them would be misleading:

1. We hold no SOC 2 report, no ISO 27001 certificate and no HIPAA or PCI attestation, and agents cannot enable multi-factor authentication. Multi-factor is mandatory on our own operator console only.
2. There is no exportable audit log. Actions are attributable in our own logs, but there is no report you can pull for an audit.

If a data subject comes to us directly we will not respond substantively; we will pass the request to you, tell you we have, and help you answer it.

That help is manual. There is no self-service export and no self-service deletion; we assemble a copy or perform a deletion by hand on request, within thirty days. If your obligations require you to respond faster than that as a matter of course, tell us before you buy.

We will tell you without undue delay after becoming aware of a personal-data breach affecting your data, with what we know at the time: what happened, which categories and roughly how many records, the likely consequences, and what we are doing. We will keep you updated as we learn more rather than waiting for a complete picture. We keep a record of incidents whether or not they meet a notification threshold.

On termination we will, at your request made within thirty days, provide a copy of your data in a commonly-used format and then delete it, including from backups on their ordinary cycle. After that window we may delete it without further notice. We will confirm deletion in writing if you ask.

We will make available the information needed to show we are meeting this addendum, and answer a security questionnaire. We do not currently offer on-site audit, and there is no third-party report to substitute for one. Where that is not enough for your process, say so early — the answer may be that Ringfully does not yet meet your bar, and that is better established before a contract than after.

[TBD], addressed to [TBD]. For a countersigned copy, send yours and we will return it.