Data Processing Agreement

For the personal data of the client's customers and callers, the client is the controller and Farwatch AI ("Farwatch") is the processor. Farwatch processes that data only to provide the service described in the Terms of Service and on the client's documented instructions.

Caller phone numbers and names, call recordings and transcripts, qualification outcomes, appointment bookings, and the messages sent to callers. Duration: the term of the agreement plus any retention the client requests, then deletion.

Data is encrypted in transit and at rest. Access is limited to the operator account and the client's own logins; each client's data is isolated at the database level so no client can read another's. Integration credentials are encrypted at rest.

Supabase (database, authentication, file storage), Vercel (hosting), Anthropic (language model processing of transcripts and questions), Vapi (voice agent calls), Twilio (telephony and SMS), Resend (email), Stripe (billing). We will give clients notice before adding a sub-processor.

We will help the client respond to requests from individuals (access, correction, deletion, opting out) and to security incidents affecting their data, and will notify the client without undue delay of a breach affecting their data.

At the end of the agreement, on request, we delete the client's personal data within thirty days except where law requires retention.