Data Processing Addendum

Last updated: October 11, 2026.

This Data Processing Addendum ("DPA") is part of the Terms of Service between SOS Web Design LLC, doing business as Jewelry Website Designers ("Processor", "we"), and the Client ("Controller", "you") for the AI Build service (the "Service"). It applies automatically when you accept the Terms and applies whenever we process personal data on your behalf. If this DPA and the Terms conflict on data protection, this DPA prevails.

1. Definitions and roles

Data Protection Laws means the laws that apply to the processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection and U.S. state privacy laws such as the California Consumer Privacy Act ("CCPA").
Client Personal Data means the personal data of your callers, chat visitors, customers and staff that we process on your behalf through the Service (the details are in Annex 1).
For Client Personal Data you are the controller (or "business") and we are your processor (or "service provider"). For your account and billing data we are an independent controller, as described in our Privacy Policy.

2. Processing on your instructions

We process Client Personal Data only to provide, secure and support the Service, according to your documented instructions. The Terms, your settings in the app and your agents' configuration are your instructions. We tell you if we believe an instruction breaks Data Protection Laws. You are responsible for the lawfulness of your instructions, for a legal basis for the processing and for any notices and consents your callers and visitors need beyond those the Service gives automatically.

3. Confidentiality

Everyone we authorize to process Client Personal Data is bound by confidentiality and has access only as needed for their role.

4. Security

We apply the technical and organizational measures described in Annex 2, appropriate to the risk. We may update them as long as the overall level of protection is not reduced.

5. Sub-processors

You give us general authorization to use the sub-processors listed in Section 5 of our Privacy Policy.
We will update that list, and notify you by e-mail or in the app, at least 30 days before a new sub-processor starts processing Client Personal Data (or sooner in an emergency, with notice as soon as possible). You may object on reasonable data-protection grounds within that period; if we cannot solve the concern, you may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

6. Help with requests and compliance

The app lets you find, export and delete calls, conversations, appointments and tickets. If we receive a request from one of your callers or visitors, we will send it to you and not answer it ourselves unless you ask us to.
We will reasonably help you with data subject requests, data protection impact assessments and consultations with authorities, as far as the Service and the information available to us allow.

7. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after we become aware of a breach affecting Client Personal Data, with the information we have about its nature, likely consequences and the measures taken. We will keep you updated and take reasonable steps to contain it.

8. Deletion and return

Conversation transcripts and messages are deleted automatically 12 months after the conversation. When your subscription ends, you can export your data during the following 30 days; then your account is closed and, 30 days later, Client Personal Data is erased, except where the law requires us to keep it. Data in backups is overwritten within a short period.

9. Information and audits

We will make available the information reasonably needed to show compliance with this DPA, such as written answers to security questionnaires. If that is not enough, you may audit our compliance, at your cost, no more than once a year, with at least 30 days' notice, during business hours and under confidentiality, in a way that does not affect the security of other clients.

10. International transfers

We are located in the United States. To the extent Client Personal Data from the European Economic Area is transferred to us, the parties enter into the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference: clause 7 (docking) applies; under clause 9 option 2 (general authorization) applies with the notice period of Section 5; the optional wording of clause 11 does not apply; under clauses 17 and 18 the law and courts of Ireland apply; the Annexes are completed by Annexes 1 and 2 of this DPA, and the competent supervisory authority is the one of the EEA country where you are established or represented.
For the UK, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies; for Switzerland, the clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority and Swiss law references where required.
Our transfers to sub-processors outside the EEA are covered by the Standard Contractual Clauses or by the EU-U.S. Data Privacy Framework where the sub-processor is certified.

11. U.S. state privacy laws

As your service provider we will not: sell or share Client Personal Data; keep, use or disclose it for any purpose other than the business purposes in this DPA, or outside our direct business relationship with you; or combine it with personal data from other sources, except as the CCPA allows. We will comply with the CCPA, provide the same level of privacy protection it requires, and tell you if we can no longer meet these obligations. You may take reasonable steps to stop unauthorized use. We certify that we understand these restrictions.

12. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow it. This DPA lasts as long as we process Client Personal Data for you.

Annex 1 - Details of the processing

Parties: data exporter / controller: the Client identified in its AI Build account, using the Service for its business; data importer / processor: SOS Web Design LLC, Linden, MI 48451, USA, info@jewelrywebsitedesigners.com.
Data subjects: people who call or chat with the Client's agents; the Client's customers and contacts; the Client's staff and team members (for example those who receive transferred calls).
Categories of data: name, phone number, e-mail address, messages and call transcripts, appointment and request details, information callers choose to give, technical data (time, channel, phone numbers involved). The Service is not intended for special categories of data; under the Terms the Client does not collect them through the agents.
Nature and purpose: receiving and answering calls and messages with AI, speech recognition and text-to-speech, booking appointments, taking messages and tickets, transferring calls, sending confirmations, storing and showing conversations and statistics to the Client.
Frequency: continuous, while the Service is used.
Duration and retention: as in Section 8.
Sub-processors: as listed in Section 5 of the Privacy Policy, for the same purposes.

Annex 2 - Technical and organizational measures

Encryption in transit (HTTPS / TLS) for the website, the app, APIs and the voice connection; encryption at rest of stored keys and access tokens; passwords stored only as salted hashes.
Separation of each Client's data in the application; role-based access for Client team members and for our staff; Administrator-only access to installation and maintenance tools.
Limits on failed sign-ins, session expiry after inactivity, protection against cross-site requests and framing, and an audit log of sensitive staff actions.
No audio recording of AI calls; recordings of transferred calls deleted after transcription; automatic deletion of transcripts and messages after 12 months.
Hosting with professional providers, regular software updates, monitoring of errors and scheduled tasks, and backups.
Confidentiality obligations for staff and contractors; selection of sub-processors that offer data processing terms.