Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Kodless.ai (a sole proprietorship of Özge Savasci, Québec enterprise number 2282178096), Montréal, Québec, Canada ("Aillo", the processor or service provider) and the business or agency using the Service (the "Customer", the controller or the organization responsible). It applies automatically whenever Aillo processes personal information on the Customer's behalf and meets Article 28 of the GDPR and UK GDPR, sections 18.3 and 17 of Québec's Law 25, PIPEDA and Article 12 of Türkiye's KVKK. Where an agency uses the Service for its clients, the agency is the Customer and passes these commitments on to its clients.

1. Subject matter, nature and duration

• Purpose: answering and forwarding the Customer's phone calls, booking appointments, taking messages, sending notifications and providing the dashboard, as instructed by the Customer through its settings.
• Data subjects: people who call the Customer; the Customer's clients, staff and users.
• Personal information: phone numbers, names, call metadata, call transcripts (audio is processed in real time and not stored), appointment details, messages and anything a caller chooses to say. The Customer should not configure the Service to collect special-category or sensitive information unless it has a lawful basis to do so.
• Duration: the term of the Customer's account, plus the deletion period in section 9.

2. Instructions

Aillo processes this personal information only on the Customer's documented instructions — these Terms, this DPA and the Customer's configuration — and not for its own purposes, unless the law requires otherwise, in which case Aillo informs the Customer first unless the law prohibits it. Aillo tells the Customer if it believes an instruction breaks data protection law.

3. Confidentiality

Aillo ensures that the people authorized to process the personal information are bound by confidentiality and access it only as needed to provide, secure or support the Service.

4. Security

Aillo maintains technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS) and encryption of stored calendar credentials;
• tenant isolation enforced in the database, so each Customer sees only its own data;
• least-privilege access for staff and service accounts, with logging of administrative actions;
• no storage of call audio, and automatic deletion of transcripts, messages and appointment details on the schedule in section 9;
• secure software development, dependency and security reviews, and tested recovery procedures.

5. Confidentiality incidents

Aillo notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any incident affecting the Customer's personal information, with the information the Customer needs to assess it, notify authorities and people where required (for example within 72 hours under the GDPR) and keep its own incident register. Aillo also records the incident in its own register and takes steps to reduce the risk of harm.

6. Sub-processors

The Customer authorizes Aillo to use the following sub-processors. Aillo binds each one by written agreement to data protection obligations at least as protective as this DPA and remains responsible for them.

• Supabase — database and authentication — Canada.
• Railway — application hosting — United States; voice service — European Union.
• Cloudflare — network delivery and security — global.
• Telnyx — telephony and number verification — United States.
• Google (Gemini API) — real-time speech understanding and response — United States.
• Resend — email notifications — United States.
• Google Calendar / Microsoft Outlook — only if the Customer connects them.

Aillo will announce any new or replacement sub-processor by email or in the Service at least 30 days in advance. The Customer may object on reasonable data protection grounds; if the parties cannot resolve it, the Customer may terminate the affected Service without penalty.

7. International transfers

Personal information may be processed in Canada, the European Union and the United States. For personal data from the European Economic Area, the United Kingdom or Switzerland, transfers rely on adequacy decisions (including for Canada), the EU–US Data Privacy Framework and its extensions where the recipient is certified, or the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) with the UK Addendum, which are incorporated into this DPA by reference for such transfers. For Québec, Aillo has assessed the protection given outside Québec as required by section 17 of Law 25. For Türkiye, transfers follow Article 9 of the KVKK and use the standard contracts it provides where required.

8. Assistance

Taking into account the nature of the processing, Aillo helps the Customer respond to requests from people exercising their rights (access, correction, deletion, portability, objection), carry out privacy impact assessments and prior consultations, and meet its security and incident obligations. Aillo forwards to the Customer any request it receives from one of the Customer's callers and does not answer it directly except on the Customer's instructions.

9. Deletion and return

During the account, transcripts are erased after 90 days, read messages after 12 months, and caller details in appointments after 24 months, and the Customer can delete items sooner in the dashboard. When the account ends, Aillo deletes the Customer's personal information within 30 days, or returns it on request made before then, except billing records that the law requires Aillo to keep.

10. Audits

Aillo makes available the information needed to demonstrate compliance with this DPA and answers reasonable written questionnaires. Where that is not sufficient, the Customer may, at its own cost and with 30 days' notice, have an independent auditor bound by confidentiality carry out an audit once a year, in a way that does not disrupt the Service or expose other customers' data.

11. Precedence and contact

If this DPA conflicts with the Terms, this DPA prevails for personal information processed on the Customer's behalf; the Standard Contractual Clauses prevail over both where they apply. Questions: [email protected].