Data Processing Addendum

1.1. “Contacts” means the Client’s callers, website visitors, and prospective and existing customers.

1.2. “Contact Personal Information” means personal information about Contacts that Worklode processes on the Client’s behalf to provide the Services.

1.3. “Privacy Laws” means the California Consumer Privacy Act, as amended, and its regulations (the “CCPA”), and the other U.S. state privacy laws that apply to the processing of Contact Personal Information.

1.4. For Contact Personal Information, the Client is the business or controller, and Worklode acts as the Client’s service provider and processor.

2.1. The Agreement, including this Addendum, and the Client’s settings in the System are the Client’s instructions to Worklode for processing Contact Personal Information.

2.2. Worklode will process Contact Personal Information only for the following business purposes: answering, recording, transcribing, and replying to calls, texts, website chats, and email for the Client; filtering spam, phishing, and malware; creating inquiries and jobs; matching a Contact’s phone numbers and email addresses within the Client’s account only; and providing support, security, and quality assurance for these Services.

2.3. For those purposes, Worklode receives, records, transcribes, stores, filters, and classifies calls and messages, including by artificial intelligence; displays them in the System; prepares and sends replies in the Client’s name; and organizes the resulting records.

2.4. Worklode processes Contact Personal Information for the term of the Agreement and afterward only as Section 10 describes.

2.5. The Client is responsible for giving Contacts the notices, and obtaining from them the consents, that the law requires for this processing, as Sections 5.3, 5.4, 9.4, and 11.3 of the Terms of Service provide.

3.1. The Contact Personal Information that Worklode processes may include:

• names, telephone numbers, and email addresses;
• the content of calls, texts, website chats, and emails, including attachments;
• call recordings and transcripts;
• job, service, and appointment details, and the inquiries and jobs created from them;
• message metadata and the results of spam and security filtering; and
• any other information a Contact chooses to provide, which may incidentally include sensitive information.

4.1. Worklode will not sell or share Contact Personal Information; retain, use, or disclose it for any other purpose or outside its direct business relationship with the Client; or combine it with personal information received from or on behalf of any other person, except to detect and prevent spam, fraud, and security incidents.

4.2. Worklode will not use Contact Personal Information for advertising and will not permit its artificial-intelligence model providers to use it to train their models.

4.3. Any internal use of Contact Personal Information to build or improve the quality of the Services is limited to what the CCPA regulations permit a service provider to do, and never includes performing services for any other person.

5.1. Worklode will comply with the Privacy Laws that apply to it in processing Contact Personal Information and will provide the same level of privacy protection required of the Client by the CCPA and other applicable state privacy laws.

5.2. Worklode will notify the Client if it determines that it can no longer meet its obligations under this Addendum or the Privacy Laws.

5.3. The Client may take reasonable and appropriate steps to ensure that Worklode uses Contact Personal Information consistently with the Client’s obligations under the Privacy Laws, and, on notice to Worklode, to stop and remediate unauthorized use of it.

5.4. Worklode will ensure that each person who processes Contact Personal Information is subject to a duty of confidentiality.

5.5. Worklode will make available to the Client the information necessary to demonstrate compliance with this Addendum. Worklode will allow and cooperate with reasonable assessments by the Client or its designated assessor or, instead, may arrange for a qualified and independent assessor to assess its policies and technical and organizational measures using an appropriate and accepted control standard, and will give the Client a report of that assessment on request.

6.1. Worklode will assist the Client, by appropriate technical and organizational measures, in responding to Contacts’ requests to exercise their rights under the Privacy Laws.

6.2. If a Contact sends Worklode a request about Contact Personal Information, Worklode will tell the Contact that it holds the information for the Client and direct the request to the Client, or act on the Client’s instructions; where the law requires Worklode to respond itself, it will.

6.3. At the Client’s direction, Worklode will delete, or enable the Client to delete, a Contact’s personal information, and will direct its subprocessors to do the same, subject to the exceptions the Privacy Laws allow.

6.4. Worklode will also assist the Client in maintaining the security of Contact Personal Information, in breach notification, and in data-protection assessments, taking into account the nature of the processing and the information available to Worklode.

7.1. Worklode will maintain reasonable administrative, technical, and organizational safeguards designed to protect Contact Personal Information, and will limit access to it as Section 8 describes.

7.2. The Client is responsible for the security of its account, devices, and connected accounts, and for activity occurring through its account, as Section 3.4 of the Terms of Service provides.

7.3. Worklode will notify the Client without undue delay after becoming aware of a breach of security affecting Contact Personal Information, and will give the Client the information reasonably available to Worklode to help the Client meet its own notification obligations.

8.1. Authorized Worklode personnel may access calls, texts, chats, and emails handled through the Services, and messages held by the Services’ filters, to provide support, review and recover filtered messages, maintain quality and security, and comply with law. Access is limited to personnel who need it for those purposes, and they are bound by confidentiality obligations.

8.2. Worklode’s support tools, which use an artificial-intelligence model provided by a subprocessor listed in Annex A, can read conversations to help Worklode personnel answer support requests.

9.1. The Client authorizes Worklode to engage the subprocessors listed in Annex A. Worklode engages subprocessors only under written contracts imposing the same obligations as this Addendum.

9.2. Worklode will give the Client at least thirty (30) days’ notice before adding or replacing a subprocessor, by email to the Client’s account email or through the System, and will update Annex A. The Client may object to the change by writing to privacy@worklode.com before it takes effect.

10.1. At the Client’s direction, Worklode will delete or return Contact Personal Information at the end of the Services unless retention is required by law.

10.2. Unless the Client directs otherwise:

• messages, attachments, and call and message conversations, including email, are kept while the Client’s account is active and are deleted thirty (30) days after the Services end;
• messages that the Services classify as spam, phishing, vendor, automated, or otherwise not an inquiry are deleted thirty (30) days after receipt, and messages containing malware may be deleted at once; and
• the Client’s Contact records, including Contacts’ names, telephone numbers, and email addresses, and its inquiries and jobs are kept after the Services end until the Client asks us to delete them, so that they are available if the Client returns.

10.3. The Client may ask Worklode to delete Contact Personal Information at any time by writing to privacy@worklode.com, and Worklode will delete it, subject to law.

11.1. Questions, instructions, requests, and objections under this Addendum may be sent to privacy@worklode.com.

Worklode uses the following subprocessors to process Contact Personal Information, each for the purpose stated. Worklode gives thirty (30) days’ notice before adding or replacing a subprocessor, as Section 9.2 describes, and updates this list when the change takes effect.

• Amazon Web Services: receiving and sending email (Amazon SES); storing email messages, attachments, and other files (Amazon S3); running the Services, their queues, and their events (Amazon ECS, Amazon SQS, and Amazon EventBridge); keeping audit records of account activity (Amazon DynamoDB); and hosting Claude models, both those reached through OpenRouter and the one used by Worklode’s support tools, which can read conversations to help Worklode personnel answer support requests (Amazon Bedrock).
• OpenRouter: routing the Services’ requests to artificial-intelligence models, which read calls, messages, and conversations to classify and summarize them, extract job details, and write replies. Worklode configures it to use only model hosts that do not use the content to train their models.
• Google: hosting Gemini models (Google Vertex AI and the Gemini API) and Claude models (Google Vertex AI), reached through OpenRouter.
• Anthropic: hosting Claude models reached through OpenRouter, directly and as Claude Platform on AWS.
• Microsoft Azure: hosting Claude models reached through OpenRouter.
• MongoDB (MongoDB Atlas): the database holding the Client’s records of its Contacts, inquiries, and jobs.
• Supabase: the database holding the assistant’s conversations, including calls, texts, chats, and emails, with their summaries and the details extracted from them.
• Upstash: short-lived locks and queue metadata used to run the Services.
• Vercel: hosting the Client’s website, and so receiving its visitors’ requests, and the web apps in which the Client and Worklode personnel read conversations.
• PostHog: counting visits to the Client’s website, from the page, the referring page, the browser, device, and screen size, the time, and the visitor’s IP address.
• Twilio: telephone numbers, calls, and text messages.
• Vapi: the voice assistant that answers the Client’s calls, records them, and transcribes them.
• Expo: delivering the Worklode app’s notifications, which name the Contact and summarize their request, through Apple’s and Google’s push notification services.
• Datadog: operational logs. Message content is kept out of them, but telephone numbers and record identifiers can appear.