Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer", "you") and XALLER AI, a trade name of ZPEACHY LLC ("Xaller.ai", "we", "us"). It applies when we process Customer Personal Data in providing the Service.

For Customer Personal Data, you are the business (controller) and we are your service provider (processor). We process Customer Personal Data only on your behalf.

This DPA does not cover Protected Health Information, which may be processed only under a signed Business Associate Agreement.

2. Definitions

• "Customer Personal Data" means personal information in Customer Data that we process on your behalf, including caller information, call recordings, transcripts, summaries and the information your team adds.
• "Data Protection Laws" means US federal and state privacy and data-protection laws that apply to the processing, including the California Consumer Privacy Act as amended ("CCPA") and similar state laws.
• "Subprocessor" means a third party we engage that processes Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

Other terms have the meanings in the Terms or in the Data Protection Laws.

3. Processing details

Item	Description
Subject matter	Providing the Xaller.ai AI phone receptionist service.
Duration	The term of the Terms, plus the deletion period in section 10.
Nature and purpose	Answering, recording and transcribing calls; generating summaries and labels; notifications; connected-tool delivery; storage, security, support and billing.
Categories of data subjects	Callers to your business; your owners, administrators and team members; people named in the information you provide.
Categories of personal data	Names, phone numbers, email and postal addresses, call audio, transcripts, reasons for calling and answers to your configured questions, call metadata, account and usage data.
Sensitive data	Not intended. You must not configure the Service to collect payment-card data, government identifiers or health information (absent a BAA).

4. Our obligations

We will:

1. process Customer Personal Data only for the limited and specified business purposes in section 3 (providing the Service you requested) and on your documented instructions, which are the Terms, this DPA, your configuration of the Service and other written instructions you give, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it;
2. tell you if we believe an instruction violates Data Protection Laws;
3. not sell or share Customer Personal Data (as those terms are defined in the CCPA);
4. not retain, use or disclose Customer Personal Data for any purpose other than those business purposes, including any commercial purpose of our own, or outside the direct business relationship between you and us, except for the uses Data Protection Laws allow a service provider: security and integrity, fraud and abuse prevention, debugging, legal compliance, building or improving the quality of the Service without profiling individuals or using the data for another business, and de-identification;
5. not combine Customer Personal Data with personal information we receive from or on behalf of others, or collect from our own interactions with individuals, except as Data Protection Laws allow for service providers;
6. not use Customer Personal Data to train generally available AI models;
7. ensure people authorized to process Customer Personal Data are bound by confidentiality;
8. comply with Data Protection Laws that apply to us as a service provider and provide the same level of privacy protection they require;
9. notify you within 5 business days if we determine we can no longer meet our obligations under Data Protection Laws or this DPA;
10. allow you to take reasonable and appropriate steps to ensure we use Customer Personal Data consistently with your obligations, such as reviewing the information in section 11, and, after notice, to stop and remediate unauthorized processing;
11. bind each Subprocessor by written contract to terms that meet these requirements.

We certify that we understand and will comply with the restrictions in this section.

5. Your obligations

You are responsible for:

• having a lawful basis and giving the notices needed for us to process Customer Personal Data, including call-recording and AI-disclosure notices required in your callers' jurisdictions;
• the accuracy and lawfulness of the information you provide and the instructions you give;
• configuring the Service, including retention, team access and connected tools, to meet your obligations.

6. Security

We maintain the technical and organizational measures described in Annex 1 and update them over time without reducing overall protection.

7. Subprocessors

You give general authorization for us to engage Subprocessors. Our current Subprocessors are listed on our subprocessor list. We will:

• impose data-protection terms on each Subprocessor that protect Customer Personal Data at least as much as this DPA;
• remain responsible for our Subprocessors' performance;
• give at least 30 days' notice before a new or replacement Subprocessor processes Customer Personal Data, by updating the list and emailing every account owner. In an emergency, such as a provider failure or a security need, we may make the change sooner and will notify you as soon as possible afterwards, with the same right to object.

You may object to a new Subprocessor on reasonable data-protection grounds within that notice period. We will try in good faith to resolve the objection. If we cannot, you may terminate the affected Service and receive a refund of prepaid fees for the unused part of the term.

Third-party tools you connect to the Service are not our Subprocessors; you choose them and your agreement with each provider governs them.

8. Assistance and requests

Taking into account the nature of the processing, we will:

• help you respond to requests from individuals to exercise their privacy rights: through the Service's features (viewing calls and exporting account data) and, for deleting or correcting specific calls, by acting on your written request within 10 business days; and forward to you, within 5 business days, any request we receive that relates to your data;
• provide reasonable information you need for data-protection assessments.

9. Security Incidents

We will notify you without undue delay, and in any case within 72 hours after confirming a Security Incident affecting your Customer Personal Data. We will describe the incident, the data affected, the steps we are taking and a contact for more information, and update you as we learn more. We will take reasonable steps to contain and remediate the incident. Notifying you is not an admission of fault.

10. Return and deletion

Call recordings, transcripts, captured caller details and AI analysis are deleted automatically at the end of your plan's retention period. After that, the Service keeps a call record without caller details or content (time, duration, number reached, outcome category, AI-assigned urgency, sentiment and language labels, follow-up status and minutes used) for billing and usage history.

When the Terms end or you close your account, your agent stops, and 30 days later we delete the remaining call content and uploaded knowledge documents. We keep the following, protected by this DPA for as long as we hold it, and use it only for the stated purpose:

• account and user records, and call records without content, for billing, security and legal purposes, for 3 years after the account closes (7 years where call records form part of billing records), after which we delete or de-identify them;
• billing records and invoices for 7 years, as tax and accounting rules require;
• audit and security records for 2 years after they are created;
• data in encrypted backups, until the backups expire on their normal schedule (within about 30 days);
• data a law requires us to keep, or that relates to a legal claim, until the requirement ends.

Before closing your account, the account owner can export your data from the app. Data already sent to your notification channels, webhooks or connected tools is outside this deletion.

11. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and summaries of independent assessments when available. If that is not enough, you may audit once a year with at least 30 days' notice, during business hours, at your cost, under confidentiality, and in a way that does not compromise other customers' data. You may also audit after a Security Incident affecting your data, or when a regulator requires it.

An audit does not include access to other customers' data, our Subprocessors' facilities or systems (for those we provide the Subprocessor's own certifications or reports where available), source code, or information subject to legal privilege or security restrictions that would put the Service at risk.

12. International processing

We store Customer Personal Data in the United States. If a Subprocessor processes it elsewhere, we will ensure safeguards that Data Protection Laws require.

13. General

This DPA lasts as long as we process Customer Personal Data. The liability limits in the Terms apply. If this DPA conflicts with the Terms about Customer Personal Data, this DPA controls.

Annex 1: Security measures

• Encryption: TLS for data in transit; encryption at rest for databases, storage and backups; additional application-level encryption for caller phone numbers, AI call analysis and other sensitive fields.
• Access control: least-privilege access; production access restricted to authorized personnel; two-step verification for staff; customer roles (owner, admin, member); audited access to recordings and transcripts.
• Tenant separation: each customer's data is separated by account and checked on every request.
• Application security: secure development practices, dependency updates, rate limiting and abuse controls, input validation, and periodic security reviews.
• Monitoring and logging: security event logging and alerting, with call content and credentials kept out of routine logs.
• Resilience: encrypted daily backups with tested restores, and outage fallbacks that forward calls to the customer's fallback number.
• Retention and deletion: automatic deletion of call content after the plan retention period; call content and knowledge documents deleted 30 days after account closure, as described in section 10.
• People: confidentiality obligations for personnel with data access.
• Vendor management: review of Subprocessors' security and contractual protections.