Effective Date June 23, 2026
This Data Processing Addendum (“DPA”) supplements the Vocaliva LLC Terms of Service, Master Services Agreement, and any applicable written agreement, statement of work, order form, accepted service arrangement, or signed client agreement between Vocaliva LLC and a business customer.
This DPA applies when Vocaliva LLC processes personal data on behalf of a business customer in connection with Vocaliva’s AI receptionist, lead capture, missed-call follow-up, appointment workflow, CRM automation, email/SMS automation, review request automation, website, forms, digital marketing, social media management, Google Business Profile optimization, SEO, generative engine optimization, reporting, and related services.
Vocaliva LLC is intended for businesses located in the United States. This DPA is provided as a standard customer data-processing addendum and may be updated as Vocaliva’s services, vendors, or legal requirements change.
1. Definitions
“Customer” means the business or organization using Vocaliva services.
“Customer Personal Data” means personal data, personal information, or similar information that Vocaliva processes on behalf of Customer through the services.
“Services” means Vocaliva’s AI receptionist, lead intake, call handling, missed-call follow-up, booking workflow, CRM automation, email/SMS automation, review request automation, websites, forms, digital marketing, social media management, Google Business Profile optimization, SEO, generative engine optimization, reporting, and related business automation services.
“Subprocessor” means a third-party service provider engaged by Vocaliva, directly or indirectly, to process Customer Personal Data in connection with the Services.
2. Roles of the Parties
Customer determines what information is collected from callers, leads, prospects, clients, patients, customers, or other individuals and how that information should be used in Customer’s business.
To the extent Vocaliva processes Customer Personal Data on behalf of Customer, Customer acts as the controller or business, and Vocaliva acts as the processor or service provider, depending on the applicable law.
Customer is responsible for providing required privacy notices, obtaining legally required consents, choosing appropriate workflows, and ensuring that Customer’s use of the Services complies with laws that apply to Customer’s business or industry.
Customer is also responsible for determining and implementing legally appropriate call-recording notices, AI or automated-agent disclosures, SMS consent language, privacy notices, and any other disclosures required for Customer’s callers, customers, clients, patients, prospects, employees, locations, and industry.
3. Scope and Purpose of Processing
Vocaliva processes Customer Personal Data only as reasonably necessary to provide, operate, secure, support, improve, and maintain the Services, or as otherwise instructed by Customer through use of the Services.
Processing may include receiving, recording, transcribing, summarizing, storing, organizing, routing, displaying, transmitting, deleting, or otherwise handling Customer Personal Data for business communication and automation purposes.
4. Details of Processing
| Topic | Description |
|---|---|
| Subject Matter | AI receptionist, missed-call follow-up, lead intake, appointment workflow, CRM automation, email/SMS automation, review request automation, website forms, websites/landing pages, digital marketing, social media management, SEO/GEO support, notifications, reporting, and related business automation services. |
| Duration | For the duration of the customer relationship and any additional retention period reasonably necessary for legal, security, backup, dispute, or operational purposes. |
| Categories of Data Subjects | Customer’s callers, leads, prospects, clients, patients, customers, staff, authorized users, and other individuals who interact with Customer through the Services. |
| Types of Personal Data | Names, phone numbers, email addresses, business details, appointment requests, call information, call recordings, transcripts, summaries, messages, form submissions, CRM notes, workflow status, review request records, website/marketing data, social media or Google Business Profile information provided by Customer, analytics data, and related service records. |
| Purpose | To answer or support calls, capture lead information, support booking workflows, send follow-ups, send review requests, support approved marketing/website/social/SEO workflows, maintain records, notify Customer, troubleshoot issues, improve service quality, and provide agreed services. |
5. Customer Instructions
Vocaliva will process Customer Personal Data according to Customer’s documented instructions, including instructions given through configuration, workflows, forms, calendars, call scripts, settings, and other service choices.
Where Customer enables call recording, transcription, AI voice, SMS, email automation, review request, website form, marketing, social media, SEO, or automated follow-up features, Customer instructs Vocaliva LLC to process related Customer Personal Data for those purposes and remains responsible for ensuring that required notices and consents are provided.
Vocaliva may process Customer Personal Data as required by law, provided that Vocaliva will notify Customer when legally permitted.
6. Sensitive Data
Customer should not submit or instruct Vocaliva to collect sensitive personal, medical, financial, legal, emergency, or regulated information unless Vocaliva has expressly agreed in writing to support that use case.
Vocaliva is not currently offered as a HIPAA-compliant, emergency-response, legal-advice, financial-advice, or regulated medical decision-making service.
7. Security Measures
Vocaliva will use reasonable administrative, technical, and organizational safeguards designed to protect Customer Personal Data from unauthorized access, disclosure, alteration, or destruction.
These safeguards may include access control, vendor account security, password protection, limited internal access, platform security features, recordkeeping, and reasonable review of service providers.
No online platform, phone system, AI tool, CRM, email provider, or internet-connected service can guarantee absolute security.
8. Confidentiality
Vocaliva will limit access to Customer Personal Data to personnel, contractors, or service providers who need access to provide, support, secure, or improve the Services and who are subject to confidentiality or similar obligations.
9. Subprocessors
Customer authorizes Vocaliva to use Subprocessors to provide the Services. Vocaliva’s current Subprocessor List is available at https://vocaliva.com/subprocessors.
Vocaliva may update the Subprocessor List from time to time. Where required by applicable law or customer agreement, Vocaliva will provide reasonable notice of material changes and allow Customer to raise a reasonable, good-faith objection.
Vocaliva will take reasonable steps to use service providers that maintain appropriate privacy and security commitments for the nature of the services they provide.
10. Assistance With Requests
Taking into account the nature of the Services, Vocaliva will provide reasonable assistance to Customer in responding to valid requests from individuals to access, correct, delete, or restrict use of Customer Personal Data, to the extent such assistance is technically and commercially reasonable.
Customer remains responsible for determining whether a request is valid and how to respond.
11. Security Incidents
If Vocaliva becomes aware of a security incident involving Customer Personal Data that requires notice to Customer under applicable law, Vocaliva will notify Customer without undue delay after becoming aware of the incident and will provide reasonable information available to Vocaliva.
Vocaliva’s notice of an incident is not an admission of fault or liability.
12. Return and Deletion
Upon termination of the applicable services, Customer may request deletion or return of Customer Personal Data, subject to technical feasibility, legal requirements, platform limitations, backup retention, security obligations, and legitimate business recordkeeping needs.
13. California Service Provider Terms
Where the California Consumer Privacy Act, as amended, applies to Customer Personal Data, Vocaliva will process applicable personal information as a service provider or contractor for the limited business purposes of providing the Services.
Vocaliva will not sell Customer Personal Data or share Customer Personal Data for cross-context behavioral advertising. Vocaliva will not retain, use, or disclose Customer Personal Data for a purpose outside the direct business relationship with Customer except as permitted by applicable law.
14. International Transfers
Vocaliva and its service providers may process or store Customer Personal Data in the United States or other locations where their personnel, systems, or subprocessors operate. Where required, appropriate transfer mechanisms or vendor terms may apply.
15. Audits and Information
Upon reasonable written request, Vocaliva may provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, legal, and operational limitations.
Any audit or review must be reasonable in scope, scheduled in advance, and conducted in a way that does not compromise security, confidentiality, other customers’ data, or Vocaliva’s operations.
16. Order of Precedence
If there is a conflict between this DPA and the Terms of Service, Master Services Agreement, or Order Form regarding the processing of Customer Personal Data on behalf of Customer, this DPA will control for that specific data-processing issue unless a signed agreement expressly states otherwise.
17. Contact
Questions about this DPA may be sent to:
Vocaliva LLC
Legal and DPA notices: [email protected]
Privacy requests: [email protected]
General inquiries: [email protected]
Website: https://vocaliva.com