Data Processing Agreement

1. Roles

You are the controller of your customers' personal data. We act as processor: we process that data only on your documented instructions — to answer your calls, book your jobs, collect your deposits, and report your numbers — and as necessary to operate the service you bought.

2. What we process, and why

Caller names, phone numbers, addresses, job details, call recordings and transcripts, booking confirmations, and payment references. Purpose is limited to service delivery: call handling, scheduling, payment collection, reporting, and compliance monitoring. Nothing else.

3. Our commitments

• Instructions only: we process data only as you instruct and as this DPA allows. If an instruction looks wrong, we tell you before acting.
• Confidentiality: everyone who touches your data is bound to confidentiality.
• No sale, no training: your data is never sold and never used to train anyone else's models.
• Assistance: we help you answer data-subject requests (access, correction, deletion) and regulatory inquiries as they relate to our processing.
• Breach notification: if we discover a personal-data breach affecting your data, we notify you without undue delay with what happened, what data was affected, and what we're doing.

4. Sub-processors

We use the sub-processors named in our Privacy Policy §3 (voice AI, telephony routing, payments, infrastructure, dashboard, compliance data, email delivery). We remain responsible for them. We will notify you before adding or replacing a sub-processor; continued use of the service after notice is acceptance.

5. Security

Encryption in transit (TLS) and at rest, least-privilege access, and audit-logged automation. Our workflows are fail-closed: missing consent, missing recording disclosure, or any doubt blocks the action and queues it for human review instead.

6. International transfers

Primary processing happens on dedicated infrastructure and major cloud/edge providers (see Privacy Policy §3). Where a sub-processor transfers data across borders, it does so under its own published transfer safeguards.

7. Return and deletion

At any time — during service or after termination — you may request a full export of your data or its deletion. On termination we delete or return your data within 30 days unless law requires retention, and confirm completion in writing.

8. Your responsibilities

You are responsible for having a lawful basis to share your customers' data with us (e.g., providing the service they requested), for the accuracy of your price book, calendar, and business rules, and for designating who on your team may receive reports and alerts.

9. Term and precedence

This DPA lasts as long as we process your data. If it conflicts with the service agreement on data protection, this DPA controls for data-protection matters.

Questions about this DPA: hello@instaxis.com. This document describes our actual practices; it is not legal advice.