Data Processing Addendum

Effective date: October 14, 2026

This Data Processing Addendum ("DPA") is part of the Terms & Conditions at /terms (the "Terms") between bizvoid l.l.c. ("bizvoid," "we," "us") and the person or business that holds a bizvoid account ("you"). By accepting the Terms you also accept this DPA. Where this DPA and the Terms differ on how we handle Customer Personal Data, this DPA applies.

1. What this DPA covers

"Customer Personal Data" means personal data about your own customers, clients, callers, leads and other contacts that we process for you when you use the Service. It includes:

• Payment follow-up: your customers' names and email addresses, their phone numbers while text reminders are on, their invoices, orders and payments (number, amount, description, due date, paid date, status and pay link), read from the sources you connect (Stripe, Square, QuickBooks, Xero, Shopify or Wix), uploaded in a CSV file or entered by hand, and the reminders sent to them;
• Client billing: your clients' billing names and emails and the invoices you send them;
• Bookings: the names, emails, phone numbers and appointment details of people who book with you through your bizvoid booking page;
• AI agents and texts: the phone numbers of people who call or text your bizvoid numbers, their messages, call transcripts on plans that keep them, opt-outs, and the consent records you or your pages collect;
• Cold Call Coach: the numbers you call and the text transcripts of those calls;
• Website forms: what people send through the forms on websites you built with bizvoid.

It does not cover the personal data of you and your team members as bizvoid users. Our Privacy Policy at /privacy covers that, and for it we are the controller.

2. Our roles

For Customer Personal Data, you are the controller and we are your processor. Under US state privacy laws, you are the business and we are your service provider. You are responsible for having a lawful basis to collect Customer Personal Data and to ask us to process it, including any consent the people involved must give before they are emailed, texted or called, and for the accuracy of what you give us.

3. Processing only on your instructions

We process Customer Personal Data only to provide the Service to you as the Terms, our Privacy Policy and the settings you choose in bizvoid describe. Together these are your instructions. If we believe an instruction breaks the law, we will tell you. We do not:

• sell or share Customer Personal Data, or use it for advertising;
• use it to train AI models, ours or anyone else's;
• put Payment follow-up or Client billing data (who your customers are, what they owe or paid, or their invoices) into any AI prompt;
• use it for any purpose of our own, except to keep the Service secure, to prevent fraud and abuse, to meet our legal obligations, and to improve Cold Call Coach from the few lines of a call around a suggestion you vote down, as our Privacy Policy describes.

4. Confidentiality

Only bizvoid staff who need Customer Personal Data to support the Service can reach it. Before they get access, staff accept written terms that require them to treat customer data as confidential, to access only what their work needs, and never to copy, export or disclose it except as their role requires.

5. Security

We keep these measures in place and may improve them over time:

• Encryption: data travels over TLS (HTTPS) between you, our servers, our database and our providers. Our database encrypts data at rest (AES-256), and backups kept by our database provider are encrypted too. The access tokens for accounts you connect (Stripe aside, which needs none) are encrypted again by our own servers with AES-256-GCM before they are stored, and are never shown in the app.
• Access controls: each account, with its agency team where it has one, sees only its own data. Payment follow-up's records can be read and written only by our servers, never directly from a browser.
• Staff access: staff reach customer data only through our separate admin app, which requires a password and a two-factor code to sign in and a PIN for sensitive changes. When staff view records with Customer Personal Data in it, the view is logged with who viewed which record and when, never the data itself.
• Data minimization: we collect only what each feature needs. Payment follow-up stores no postal addresses, card numbers or bank details, and takes a customer's phone number only while text reminders are on.
• Logs: we keep customer names, emails and phone numbers out of our application logs on payment paths.
• Policies: we keep a written security incident response policy and a data loss prevention policy, and review both at least once a year.

6. Subprocessors

We use these subprocessors for Customer Personal Data:

• Supabase: our database, file storage and sign-in, for all Customer Personal Data;
• Railway: hosting for our app and servers, for all Customer Personal Data;
• Resend: delivering emails, including the payment reminders, booking emails and form notifications sent for you;
• Twilio: phone numbers, calls and text messages, including payment reminder texts;
• Stripe: payments for Client billing and booking deposits;
• Deepgram and OpenAI: speech recognition, the agent's voice and the agent's replies on AI agent calls (OpenAI's model runs through Deepgram);
• AssemblyAI and Google (Gemini): live transcription of Cold Call Coach calls and the coaching suggestions made from it.

Payment follow-up data is processed only by Supabase, Railway, Resend and Twilio. The services you connect yourself (your own Stripe, Square, QuickBooks, Xero, Shopify, Wix, Google or Zoom account) are your providers, not our subprocessors: we read from or write to them only because you connected them. We will update this list before a new subprocessor starts processing Customer Personal Data and will tell account owners of the change by email or in the app. If you object to a new subprocessor, you can stop using the feature it serves or close your account.

7. Personal data breaches

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your Customer Personal Data, we will notify you without undue delay, and in any case within 72 hours of becoming aware of it. We will tell you what happened, what data and how many people are involved as far as we know, what we have done to contain it, and who to contact, and we will update you as we learn more. We will help you meet any duty you have to notify regulators or the people affected. Where a breach involves data from a Shopify store, we also notify Shopify as its terms require.

8. Helping you with requests from the people involved

If someone asks us to access, correct or delete their personal data, or objects to how it is used, and the request concerns Customer Personal Data, we will pass it to you, unless the law requires us to answer it ourselves, and we will help you respond. For Shopify stores, we act on Shopify's customer data requests and erasure requests as our Privacy Policy describes.

9. Deletion and return

• While your account is active, we delete Customer Personal Data as our Privacy Policy describes, for example when you disconnect a payment source.
• When your account is permanently deleted (30 days after you delete it, or sooner if you ask, as Section 13 of the Terms describes), we delete the Customer Personal Data we hold for you, except records the law requires us to keep, which we keep confidential and use only for that purpose.
• Before your account is deleted, you can ask us at support@bizvoid.com for a copy of the Customer Personal Data we hold for you, and we will send it in a common, machine-readable format.

10. Where data is processed

We and our subprocessors process Customer Personal Data in the United States and in other countries where those subprocessors operate, under the safeguards their own terms describe.

11. Information and audits

On request, we will answer reasonable written questions about how we protect Customer Personal Data and share a summary of our security policies. Where the law gives you a right to audit our processing, we will work with you on a reasonable audit, with reasonable notice, at your cost, and no more than once a year unless a regulator requires it or after a breach.

12. Duration

This DPA applies for as long as we process Customer Personal Data for you.

13. Contact

Questions about this DPA: support@bizvoid.com · bizvoid l.l.c., Texas, United States.