Data Processing Addendum

All legal pages · Terms · Privacy Policy · Acceptable Use · Cookies · DPA · Subprocessors · Report a security problem

This addendum is part of the agreement between Savage and Co Digital LLC, a Wyoming limited liability company ("Digital Minions", "we") and the client business ("Client", "you"). It covers personal data we process for you. Where it differs from the Terms of Service on data protection, this addendum wins.

1. Roles

• You decide why and how personal data is used. You are the "controller" under the state privacy laws, and the "business" under the CCPA.
• We process it on your behalf. We are the "processor", and the "service provider" under the CCPA.
• Where we act for ourselves (our own billing, and our own marketing-site forms), we are responsible for that data on our own account. [Counsel to confirm.]

2. What we process (Annex 1)

• Subject matter and purpose: running Digital Minions for you.
• People:
  • your staff;
  • your customers and leads;
  • callers, people who text or message you, and visitors who use your website form or chat;
  • people who get your email, texts and calls.
• Data:
  • Contact details: names, phone numbers, emails, addresses.
  • Records of contact: call recordings, transcripts and summaries; texts and messages; chat transcripts; form entries.
  • Consent and opt-out records: the wording, time, IP address and page.
  • Customer records and notes.
  • Your own content: business knowledge, drafts and outputs; staff chats; meeting recordings and recaps.
  • Texting registration details (including the EIN).
  • Number-porting paperwork: deleted after the port.
  • Content from connected services that you authorize.
• Sensitive data: none. Protected health information isn't allowed (section 10).
• Duration: the term of the agreement, plus the deletion period in section 9.

3. Your instructions

We process personal data only on your documented instructions. Your instructions are:

• the agreement;
• your settings, approvals and policies in the app;
• your choice of AI models and features.

We will tell you if we believe an instruction breaks the law.

4. Confidentiality and our access

• Everyone at Digital Minions who can reach client data is bound to confidentiality.
• Support access:
  • only when an owner allows it, for a period the owner sets (30 days by default, 90 at most);
  • an owner can end it at any time;
  • every sign-in is in your access log, and owners are told;
  • support sees what an admin sees, never private chats or private notes, and can't export data, read the audit log or close the workspace.
• Our operator console receives counts and health flags only.

5. Security measures (Annex 2)

[Gaps, honestly listed for counsel and engineering:

• database encryption at rest is Railway's (to confirm);
• backups are plain unless the client vault is set up;
• no independent penetration test yet;
• no point-in-time recovery (recovery is to the last snapshot).]

6. Subprocessors (Annex 3)

• The current list is at /legal/subprocessors, with what each one receives.
• Services you connect with your own account are your own providers. [Counsel to confirm that characterisation.]
• Changes: we will give [30] days' notice of a new subprocessor, by email and on that page. You may object [and terminate].
• Flow-down: each subprocessor is bound by terms that protect the data at least as well as these. [Check each provider's DPA, retention and training terms before go-live.]

7. Helping with people's requests

Tools you can use in the app today:

• download what we hold about one customer;
• forget a customer, which also asks Twilio to delete its copies;
• export the whole workspace;
• opt-outs, honoured on every channel.

We will help with anything the tools don't cover, within [10] business days. [Fees for help beyond self-serve: counsel.]

8. Security incidents

• We will tell you without undue delay, and within 72 hours, after we confirm a breach of your personal data.
• The notice will say:
  • what happened;
  • what data and people are affected;
  • what we have done;
  • who to contact.
• We will keep you updated, and work with you on any notices to people and regulators. Those are yours to give unless we agree otherwise.
• Our process is in our incident response plan. [Counsel: confirm the timeline and the content of the notice.]

9. Return and deletion

• During the term: you delete data in the app. Deleted data leaves the backups as old snapshots age out (Backups, in section 5).
• At the end:
  1. You can export within [30] days.
  2. Closing the workspace deletes the business's data, local snapshots and off-site copies, after a 14-day cooling-off period.
  3. The audit and access logs, legal holds, opt-outs and forget marks remain until we remove the deployment, within [30] days. [Counsel.]
• Phone numbers are released or transferred under the Terms.

10. Health data

Digital Minions doesn't process protected health information and doesn't sign Business Associate Agreements. If health information reaches the service anyway, the app removes obvious health terms from customer notes, and you should ask us to delete it.

11. CCPA and state processor terms

[Counsel to insert:

• the CCPA service-provider restrictions (Cal. Civ. Code 1798.100(d), 1798.140(ag); 11 CCR 7051);
• the processor-contract terms the state laws require (Virginia, Colorado, Connecticut, Texas and similar): instructions, confidentiality, deletion or return, information to show compliance, audits, and subprocessor flow-down.]

12. Audits

Once a year, we will answer a reasonable security questionnaire. We will also share third-party reports when they exist. On-site audits need reasonable notice and are at your cost. [Counsel.]

13. Where data is processed

Your workspace runs in the region chosen when it was made (US West, US East, EU West or Asia Southeast), and off-site backups stay in that region. Some subprocessors, such as the AI providers, may process requests in the United States. [Counsel: international transfer terms, if any workspace uses EU West or serves people in the EU or UK.]