Attorney-review draft — not legally approved
This document has been drafted but has not been reviewed by a lawyer. It is published here so you can see our intent and so counsel can review it. It is not a final agreement, and EveryContact Technologies, Inc. does not represent it as legally approved or enforceable.
Data Processing Summary
A plain-language summary of processing roles, purposes and transfers.
Draft prepared for review · EveryContact Technologies, Inc.
Roles
For the personal information of your customers, you are the controller and we are the processor. We process it on your instructions to provide the service.
For your own business account information, we are the controller.
An important nuance: the service applies its own safety rules to message content (for example, directing a customer to call 911). That is a product behavior we determine, not an instruction from you. [ATTORNEY REVIEW REQUIRED: whether this affects the processor characterization.]
Categories of data
Contact identifiers: phone number, name, email, service address.
Communication content: message bodies, transcripts, conversation summaries.
Property and job information: damage descriptions, affected areas, insurance claim status where volunteered.
Consent records: status, purpose, source, evidence and timestamps.
Operational metadata: delivery statuses, usage counts, salted IP hashes.
Purposes
Responding to customer inquiries on your behalf.
Qualifying inquiries and identifying urgent situations.
Notifying the contacts you designate.
Scheduling appointments.
Demonstrating messaging compliance.
Preventing fraud and controlling provider cost.
Transfers
All sub-processors listed in the Privacy Policy are in the United States. We do not currently transfer data outside the United States.
Security measures
Database row-level security for isolation between businesses; encryption at rest for credentials; TLS in transit; multi-factor authentication for administrative access; audit logging of privileged actions; PII redaction in application logs.
Open questions for counsel
Published deliberately. These are the points we know we cannot resolve ourselves, listed so a reviewer can start with them rather than discover them.
- Whether a formal Data Processing Agreement is required with each sub-processor, and whether our customer-facing DPA terms are adequate.
- Whether the safety-rule behavior creates joint-controller status, and the consequences if so.
- Whether any customer may require EU or UK terms, and what that would entail.