Data Processing Agreement

Last updated: 2026-06-22

This is a plain-language draft provided for transparency. Have legal counsel review it before relying on it.

This DPA applies when ATP processes personal data on your behalf (for example, the data in calls Riley handles for your business). It supplements the Terms.

Roles

For the call and customer data ATP handles for you, you are the data controller and ATP is the data processor. ATP processes that data only on your documented instructions and to provide the service.

Scope of processing

Subject matter: operating the AI phone agent and dashboard. Data: caller phone numbers, call transcripts and optional recordings, messages, bookings, and contact details. Data subjects: your callers and contacts. Duration: while your account is active.

Subprocessors

You authorize ATP to use the subprocessors listed in our Privacy Policy (Vapi (telephony + speech-to-text / text-to-speech); Anthropic (the AI model); Supabase (database + authentication); Stripe (payments); Twilio (phone numbers + SMS); Resend (email)). ATP remains responsible for their compliance and will give notice of material changes.

Security

ATP applies reasonable technical and organizational measures: encryption in transit, access controls, least-privilege service credentials, and isolation of each tenant data.

Assistance, breach, and deletion

ATP will help you respond to data-subject requests and, without undue delay, notify you of a personal-data breach affecting your data. On termination, ATP will delete or return your personal data except where law requires retention.