Data Processing Agreement
You don't sign this separately. It is part of the Terms you accept, and it says how we handle your customers' and staff's information for you.
This agreement says how Kwickly LLC ("Kwickly Answers", "we") handles personal information for a business that uses Kwickly Answers ("you"). It is part of our Terms of Service. Where the Terms and this agreement differ about personal information, this agreement applies. Kwickly Answers serves businesses in the United States only.
1. Who is who
You decide why and how your customers' and staff's information is used: you are the "business" under the California Consumer Privacy Act (CCPA), and the controller under other privacy laws. We handle it for you to provide the service: we are your "service provider" (processor).
2. What we handle, and why
- About your callers and customers: names, phone numbers, email and service addresses, call recordings, transcripts and summaries, chat and messaging-app messages, bookings, notes, answers to your intake questions, orders and payment references.
- About your staff: names, job titles, contact details, photos, shifts, time off, clock-in times, pay rates, the figures you record for pay, the days and hours they say they can work, and notes they add.
- About your own team's accounts: portal sign-ins and what they do in the portal.
We handle it only to provide Kwickly Answers to you, as the Terms, your plan and your settings describe, for as long as your account is open, and then as section 9 says.
3. Your instructions
- We use this information only on your instructions: your settings in the portal, what you ask us in writing, and what the Terms describe. If the law makes us do something else, we tell you first unless the law forbids it.
- We don't sell it or share it for cross-context behavioral advertising, and we don't use it for any purpose of our own outside our work for you, except as the CCPA allows a service provider to (for example to keep the service secure, or to fix it).
- We don't combine it with information from other businesses or from other sources, except as the CCPA allows.
- We don't use it to train AI models ourselves, and we send it to the AI companies on our Subprocessor list only to provide the service to you. Those companies work under their own terms, and some may use information to improve their own services as those terms allow; our Privacy Policy says more.
- We follow the CCPA and give this information the same protection it requires. If we can no longer do that, we tell you. You may take reasonable steps to stop and fix any use of it that isn't allowed.
- If we think an instruction of yours breaks the law, we tell you.
4. Confidentiality
Only the owner of Kwickly Answers can see client data today. Anyone added later signs a confidentiality promise first.
5. Security
We protect your information with the measures on our Security and trust page: encrypted connections, each business kept apart from every other, encrypted keys and gate codes, a record of changes, and encrypted nightly database backups and weekly picture backups.
6. Subprocessors
You allow us to use the companies on our Subprocessor list. Each works under its own written terms. For the companies that run our calls, chat, texts, email sending, payments, database, servers, automation, backups and our own mailbox, those terms include data-protection terms (a data processing agreement) that cover your information. Two cases are different: Cloudflare carries our traffic through Render, and works with us directly, under its own terms, only for the sign-up check; and Rime and PlayHT, two voice companies used only if a business's assistant is set up with one of their voices, work under their own terms rather than Vapi's, and we review those terms before we use either for a business. We stay responsible to you for their work. We email the owner of every business at least 30 days before a new company that we choose starts handling its information, and update the Subprocessor list. Companies that work inside Vapi's service are added by Vapi, not us: when we learn of one, we email the owner of every business as soon as we can and update the list. If you object, you can cancel (section 6 of the Terms says how).
7. Helping with people's requests
If one of your customers or staff asks us to see, correct or delete their information, we pass the request on to you (our Privacy Policy says we may) and help you answer it. In the portal you can download your customer list, and change or delete a customer's record yourself.
8. Security incidents
If we learn that your information has been lost, or seen or changed by someone who shouldn't have, we tell you without undue delay, and within 72 hours of confirming it affects your business. We tell you what happened, what information and which people it affects, what we are doing about it, and we help you give any notice the law requires.
9. When your account closes
Before you close your account you can download a copy of your whole account from Account, Your data in your portal: your customers, bookings, calls, orders, team, web page and settings, as spreadsheet (CSV) and JSON files. When you ask us to delete your account, it is deleted 30 days after whichever comes later: your request or the day your plan ends. Until then you can stop it. Deleted information leaves our live database at once and our encrypted nightly database backups within 15 days. Deleted pictures leave our encrypted weekly picture backups within 29 days. Call recordings are held by our phone provider, which deletes a recording on its own schedule (14 days on our current plan). What we keep of a call is deleted 12 months after the call, as our Privacy Policy says. We keep only what the law or billing needs. Stripe keeps its own billing and tax records.
10. Questions and reviews
We answer written security questions. Once a year, or after an incident, you can send us reasonable questions in writing about how we protect your information. No third-party audit reports exist today.
11. Where information is kept
Our database, servers and nightly backups are in the United States (Oregon), and so are our weekly picture backups. Our phone, text, email, payment, automation and mailbox companies are set up for the United States. Some companies work where we don't choose: the AI, voice and speech companies inside Vapi's service are placed by Vapi, Google's Gemini has no region setting, and Cloudflare carries our traffic across its worldwide network. So information can be handled outside the United States while a call or chat is under way. Our Subprocessor list shows where each company runs.
12. Limits
The limits of liability in the Terms apply to this agreement too. This agreement does not raise them.
Contact
Kwickly LLC, 18750 Delaware St, Unit 281, Huntington Beach, CA 92648 · harley@kwicklyanswers.com