Effective date: October 30, 2026 · Last updated: October 30, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the business customer ("Customer") and Softbuildsapps LLC of Salt Lake City, Utah, operator of Answer Line AI ("Answer Line AI", "Processor"). It governs how we process the personal information of the Customer's callers and customers ("Caller Data"). Questions can be sent through the contact page.
For Caller Data — caller phone numbers, names and intake details, call recordings and transcripts, message threads, and job and booking records — the Customer is the controller (it decides why and how its callers are contacted and what its assistant is configured to do), and Answer Line AI is the processor, processing Caller Data only to provide the service. For the Customer's own account and billing information, Answer Line AI acts as controller, as described in the Privacy Policy.
We process Caller Data only on the Customer's documented instructions, which consist of the Terms of Service, this DPA, and the Customer's in-product configuration: its scripts, services, prices, hours, on-call rotation, connected integrations and messaging settings. We will inform the Customer if an instruction appears to infringe applicable data-protection law. The subject matter and duration of processing are the provision of the service for the life of the account plus the retention period in Section 8; the types of data and data subjects are those listed in Section 1.
Caller Data is treated as confidential. Access is limited to personnel and systems that need it to operate, support and secure the service. Support inspection of a Customer's account from the platform console is read-only, scoped to that Customer's business, and time-limited.
We implement the following technical and organizational measures, as actually deployed in the service:
We use the following subprocessors for the features a Customer activates. Each receives only the data needed for its function:
| Subprocessor | Function | Data involved |
|---|---|---|
| Twilio | Telephony and SMS carrier services (when live calling/texting is activated) | Caller numbers, call audio, message content |
| Vapi, Retell, or OpenAI (per account configuration) | Real-time voice AI processing (when live calling is activated) | Call audio and transcript, intake details |
| Stripe | Subscription billing | Account-holder billing details (no caller data) |
| Railway | Application hosting and database infrastructure | All platform data, as host |
| Resend (when configured) | Transactional email delivery | Account-holder email, report/brief content |
Systems the Customer itself connects (Google, Microsoft, Jobber, ServiceTitan, Housecall Pro) act on the Customer's own authorization and are the Customer's providers, not our subprocessors.
We will give notice of any new subprocessor that will process Caller Data — by updating this page and, for material changes, by email to account holders — at least 15 days before it begins processing, so the Customer can object or cancel.
If a caller or customer of the Customer asks us for access to, correction of, or deletion of their Caller Data, we will route the request to the Customer and provide reasonable assistance — including the in-app access, export and deletion tooling the Customer already has — so the Customer can respond within the time the law allows. The Customer can delete individual records and, through the contact page, request account-level deletion.
If we confirm a security incident involving Caller Data, we will notify affected Customers without undue delay and in any event within 72 hours of confirmation, with the information then available about the nature of the incident, the data involved, and the measures taken. We will cooperate with the Customer's own notification obligations.
At the end of the service, the Customer's account remains accessible for 30 days so the Customer can export its recordings, transcripts and job records. After that window, we delete or anonymize Caller Data on the retention schedule in the Privacy Policy — recordings are retained 13 months by default, or the shorter period the Customer configured — except records we must keep for legal or accounting obligations. On request, we will confirm deletion in writing.
On reasonable request, we will make available the information needed to demonstrate compliance with this DPA, and will answer written security and privacy questions from Customers. This DPA does not claim certifications the service does not hold: Answer Line AI does not currently hold SOC 2 or HIPAA certifications, and the service is not designed for protected health information.
If this DPA conflicts with the Terms of Service on the processing of Caller Data, this DPA controls. Otherwise the Terms of Service — including Utah governing law — apply.