Data Processing Addendum

Version 2026-10-16 · closed alpha. Under review by our lawyers; changes follow section 15 of the Terms.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Brainstorm IT LLC, which operates SAGOT ("SAGOT"), and the Customer. It applies when SAGOT processes personal data on the Customer's behalf. Terms not defined here have the meaning given in the Terms, the EU General Data Protection Regulation ("GDPR"), the UK GDPR or the Philippine Data Privacy Act of 2012 ("DPA 2012"), the Singapore Personal Data Protection Act, US state privacy laws such as the California Consumer Privacy Act ("CCPA"), Brazil's LGPD, India's Digital Personal Data Protection Act, Australia's Privacy Act, Canada's PIPEDA, Japan's APPI and any other data protection law that applies to the processing ("Data Protection Law").

1. Roles

• The Customer is the controller (personal information controller) of personal data in Customer Data.
• SAGOT is the processor (personal information processor) and processes that data only on the Customer's documented instructions.
• The Customer's instructions are the Terms, this DPA and the Customer's configuration and use of the Service. SAGOT tells the Customer if it believes an instruction breaks Data Protection Law.
• The AI processing region chosen by the workspace owner (European Union or United States) is a documented instruction on where call audio and text are processed by the AI sub-processor. The Customer is responsible for choosing a region that meets its obligations; the owner's choice, the time and the accepted statement are recorded.

2. Details of processing

Item	Description
Subject matter and purpose	Providing the Service: AI voice agents that make and answer phone calls, and the records of those calls
Duration	The term of the Terms plus the deletion period in section 10
Data subjects	People the Customer's agents call or who call them; the Customer's users
Personal data	Names, phone numbers and other contact fields; call audio recordings; transcripts; call metadata (time, duration, outcome, line); information shared during calls; user account data
Special categories	None intended. The Customer must not instruct agents to collect special-category or sensitive personal information unless the law allows it and the Customer has assessed it
Processing locations	Hosting and storage: Singapore. AI processing during calls: the region chosen by the workspace owner (section 5)
Processing operations	Storing, transmitting and placing calls; speech recognition, language processing and speech generation; recording and transcription; display and export; deletion

3. SAGOT's obligations

SAGOT will:

1. process personal data only on documented instructions, unless the law requires otherwise (in which case SAGOT tells the Customer first, unless the law forbids it);
2. ensure that people authorized to process the data are bound by confidentiality;
3. implement the security measures in Annex A;
4. engage sub-processors only as described in section 5;
5. assist the Customer, taking into account the nature of the processing, with requests from data subjects and with security, breach notification, impact assessments and consultation with supervisory authorities;
6. delete or return personal data at the end of the Service as described in section 9;
7. make available the information reasonably needed to demonstrate compliance with this DPA and allow audits as described in section 8.

4. Data subject requests

The Service lets the Customer find, export and correct contact data, call histories and recordings, and erase everything held about one person — by contact or by phone number, including inbound callers — in one step, optionally keeping only a one-way fingerprint of the number so that person is never called again. If SAGOT receives a request from a data subject about Customer Data, it will forward it to the Customer without undue delay and will not respond itself except to direct the person to the Customer.

5. Sub-processors

The Customer authorizes SAGOT to use the sub-processors below. SAGOT imposes data protection obligations on each that are no less protective than this DPA and remains responsible for their performance.

Sub-processor	Purpose	Location
Amazon Web Services	Hosting, database, call media servers and encrypted backups	Singapore (ap-southeast-1)
Google Cloud (Vertex AI)	Speech recognition, language processing and voice generation during calls	The processing region the workspace owner chooses: European Union (EU multi-region and Netherlands, europe-west4) or United States (US multi-region and Iowa, us-central1)
Resend	Sending account and workspace emails (invitations, notifications)	United States

Providers the Customer connects itself — for example its own Twilio account, its mobile operator or HTTPS connections — act for the Customer and are not SAGOT's sub-processors.

SAGOT will notify Customers by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service without penalty.

6. International transfers

Customer Data is hosted in Singapore. Some sub-processors process data in other countries as listed above. Where Data Protection Law requires a transfer mechanism:

• EEA: the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor), are incorporated by reference, with SAGOT as data importer, Irish law and courts, and the details of processing in section 2 and Annex A as their annexes;
• United Kingdom: the UK International Data Transfer Addendum to those clauses applies;
• Switzerland: the same clauses apply with the Federal Act on Data Protection as the governing law for Swiss transfers;
• elsewhere: SAGOT provides contractual protections that meet the applicable law, including the DPA 2012 and the rules of the National Privacy Commission.

SAGOT performs and keeps a transfer impact assessment for these transfers and makes a summary available to the Customer on request.

7. US state privacy laws

Where SAGOT processes personal information subject to the CCPA or similar US state laws, it acts as a service provider (or processor) and will not: sell or share the personal information; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Customer; or combine it with personal information from other sources, except as those laws permit. SAGOT will tell the Customer if it can no longer meet these obligations.

8. Personal data breaches

SAGOT will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data, with the information available at the time: what happened, the categories and approximate numbers of people and records affected, likely consequences and the measures taken or proposed. SAGOT will update the Customer as more information becomes available and help the Customer meet its own notification duties, including the 72-hour notices required by the GDPR and the National Privacy Commission.

9. Audits

SAGOT will answer reasonable written security questionnaires once a year and provide information about its security measures. Where Data Protection Law requires more, the Customer may audit SAGOT's compliance with this DPA with at least 30 days' notice, during business hours, at the Customer's cost, without access to other customers' data, and subject to confidentiality.

10. Retention, return and deletion

• The Customer sets the retention period for call recordings and transcripts in each workspace (1 to 90 days). Content past that period is deleted from the live Service.
• The Customer can export its data at any time, and the workspace owner can delete a workspace and all its data from the Service at any time.
• When the Service ends, or on the Customer's written request, SAGOT deletes Customer Data from the live Service within 30 days, and backups are overwritten within about 31 days after that, unless the law requires SAGOT to keep it.

11. Service statistics

The Customer authorizes SAGOT to anonymize Customer Data to create the service statistics described in section 3.6 of the Terms. Statistics use call metadata only, never content or contact details, and are published only when each figure combines at least 1,000 calls from at least five different customers. Anonymized statistics are not personal data and are not Customer Data.

12. Staff access

SAGOT staff can open personal data in a Customer workspace only through support access that a workspace owner or admin approved (read-only, time-limited and logged for the Customer), or where the law requires it or a serious security incident or abuse must be investigated. Platform staff otherwise see operational metadata only, with phone numbers masked.

13. Representatives and contact

SAGOT's data protection officer can be reached at privacy@sagots.com. SAGOT has not yet appointed representatives in the European Union or the United Kingdom under Article 27 GDPR; it will do so before offering the Service to people there beyond the closed alpha and will list them here. Until then, contact privacy@sagots.com.

Annex A — Security measures

• Encryption: data is encrypted in transit with TLS; secrets for Customer connections are encrypted in the database; backups are stored encrypted in a private storage bucket.
• Access control: role-based workspace permissions; scoped, revocable API keys; two-step sign-in with an authenticator app for every account, required for SAGOT staff; staff access by platform role with customer-approved support access for customer content.
• Accountability: an append-only audit log of platform staff actions and support access.
• Network: public telephone signalling accepted only from the telephony provider's published address ranges; administrative access over a private network.
• Resilience: nightly database backups kept for about 31 days.
• Data minimization: call content deleted after the Customer's retention period; platform views mask phone numbers.
• Abuse prevention: rate limits, a platform-wide do-not-call list, and workspace and account suspension.
• Transparency in calls: every call speaks a disclosure that the person is talking with an AI and that the call is recorded or transcribed; objections end the call. Audio recording can be turned off per workspace.

Frequently asked questions

Is SAGOT a controller or a processor?

For the calls, contacts and recordings in your workspace, SAGOT is your processor and you are the controller. SAGOT is a controller only for its own account, billing and website data.

Where is my data stored?

In Amazon Web Services' Singapore region. During calls, audio and text are processed by the AI provider listed above.