Data Processing Addendum
Effective October 6, 2026. Last updated October 6, 2026.
This Data Processing Addendum ("DPA") forms part of the Terms of Service (or other written agreement) between Quill Hound ("Processor") and the customer ("Customer") for Quill Hound Voice. It applies whenever we process personal data on the Customer's behalf. If this DPA conflicts with the Terms, this DPA controls for personal data.
Signed copy: this DPA applies automatically when the Customer accepts the Terms. To get a countersigned copy for your records, email jglass@quillhound.com with your organization's legal name and a signer, and we will send one for signature.
1. Roles
The Customer is the controller (and, under U.S. state laws, the "business"); Quill Hound is the processor (the "service provider" or "processor"). We process Customer personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service. We will tell the Customer if we believe an instruction breaks the law.
2. Scope of processing
| Subject matter and purpose | Providing the Service: business calling, texting, voicemail, call recording, transcription, AI summaries and drafts, reports and CRM integration. |
|---|---|
| Duration | The term of the subscription plus the deletion period in section 8. |
| Data subjects | The Customer's staff (Users); people who call, text or are called or texted by the Customer; the Customer's contacts. |
| Categories of data | Names, phone numbers, email addresses, call metadata, call recordings and voicemails (voice), transcripts, summaries, text messages, notes, tasks, CRM record ids, User account and sign-in data. |
| Special categories | Not intended. Conversations can contain anything people say; the Customer controls what is recorded and must not process protected health information unless a BAA is signed (none is offered today). |
| Operations | Collection, storage, transmission, transcription, analysis by AI, retrieval, display, export and deletion. |
3. Processor obligations
- We will not sell or share Customer personal data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as the law allows a service provider to.
- We will not use Customer data to train AI models without the Customer's explicit opt-in.
- Everyone who can access Customer data is bound by confidentiality.
- We will help the Customer answer data-subject requests (access, deletion, correction, portability) and with data-protection impact assessments, taking into account the nature of the processing. Users can export and delete their own data in Settings.
4. Security measures
- Encryption in transit (TLS) for all traffic; carrier webhooks verified by signature.
- Workspace separation in the database with row-level security on every table, and role-based access (admin, manager, team lead, agent).
- Recordings served only through signed, expiring links; CRM access tokens encrypted at rest; API keys stored only as hashes.
- Secrets held in the hosting provider's secret store, never in source code; automated checks block committing them.
- Configurable retention: automatic deletion of recordings and transcripts after a period the Customer chooses.
- Access to production limited to the people who run the Service.
5. Subprocessors
The Customer authorizes the subprocessors listed on our Subprocessors page. We impose data-protection terms on each that are at least as protective as this DPA, and remain responsible for their performance. We will update that page and notify workspace admins at least 30 days before adding or replacing a subprocessor; the Customer may object on reasonable data-protection grounds, and if we cannot resolve it, may terminate the affected Service and receive a refund of prepaid fees for the unused period.
6. Personal data breach
We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer data. The notice will describe what happened, the data and people affected (as far as known), the likely consequences, and what we are doing about it, and we will update it as we learn more.
7. International transfers
We and our subprocessors process data in the United States. For personal data from the European Economic Area, the United Kingdom or Switzerland, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), with the UK International Data Transfer Addendum and Swiss amendments as applicable, which are incorporated by reference. The annexes are completed by section 2 (processing), section 4 (security) and the Subprocessors page.
8. Deletion and return
During the subscription, the Customer can delete data and set retention in the Service. When the subscription ends, we will return Customer data in a common machine-readable format on request made within 30 days, and delete it within 90 days after the end of the subscription, except where the law requires us to keep it. Data in provider backups is deleted as those backups expire.
9. Audits
On reasonable written request, no more than once a year (or after a breach or a regulator's request), we will answer the Customer's security questionnaire and provide the information needed to show compliance with this DPA. If that is not enough, the Customer (or an independent auditor bound by confidentiality) may audit on 30 days' notice, during business hours, at its own cost, without disrupting the Service. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.
10. Liability
Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it.
Contact
Privacy and DPA questions: jglass@quillhound.com.