Data Processing Addendum
Edition 6 · 2026-09-26 · Last updated September 26, 2026
Wharfline Technologies LLC
39 Henry B Riordan Way, North Attleboro, MA 02760, United States
support@wharfline.com
1. What this Addendum is
This Data Processing Addendum ("Addendum") covers how I handle the personal information of your callers when I run your receptionist. It forms part of the Wharfline Service Agreement between us, and it applies for as long as that Agreement is in force.
If you have not read the Service Agreement, read that first. It is at wharfline.com/service-agreement and it is the document that sets out what I build, what it costs, and how billing works. This Addendum does not change any of that. It deals only with data.
2. Who is who
You are the controller of your callers' information. You decide why your calls are answered and what your receptionist is instructed to do with what it hears.
I am your processor, or in California terms your service provider. I handle your callers' information to deliver the service to you, and for no other purpose.
Your callers are the people this Addendum protects.
I also engage platforms of my own to run the service, and in that relationship the roles shift up a level: I am the controller and those platforms are my processors. That is why Section 7 matters and why it is written the way it is.
What that role commits me to, and it is more than a label. I comply with the California Consumer Privacy Act and its regulations as they apply to me, and I give your callers' information the same level of privacy protection that the CCPA requires of you. Where this Addendum and that law point the same way, they are saying the same thing twice. Where the law asks more of me than this Addendum spells out, the law is what I follow.
3. What I process, and for how long
Subject matter. Running a managed AI receptionist on your business line.
Duration. For as long as your account is open, plus the retention periods in Section 10.
Nature and purpose. Answering your calls, capturing and qualifying leads, booking appointments, answering questions from the material you give me, taking messages, sending you call summaries, supporting your account, keeping the service secure, and fixing problems.
And that list is the limit of what you are giving it to me for. You disclose your callers' information to me only for the purposes named just above, and for nothing else. If something falls outside that list, you have not handed it to me for that.
Categories of personal information.
- Caller telephone numbers, both the number your caller is calling from and the number they reached.
- Names, and any other details a caller gives during a call, which can include an address, an email address, a description of a problem, and a requested appointment time.
- Call audio, and the transcript and written analysis produced from it.
- Your own business, account, configuration and billing details, and the contact details of the people you nominate under Section 9 of the Service Agreement.
Categories of data subjects. People who call your business, and the people you nominate as contacts.
What I do not ask for. I do not take payment card details by voice, and the receptionist is built to refuse them. That is Section 11 of the Service Agreement, and it is a design limit, not a preference.
4. Your instructions
I process your callers' information only on your instructions.
Your instructions are: this Addendum, the Service Agreement, the onboarding intake submission in which you set out how your calls should be handled, and any further reasonable written instruction you give me that is consistent with those.
If I think an instruction you give me would break a data protection law, I will tell you. I am not monitoring your compliance for you, and telling you is the whole of what I undertake to do.
5. Confidentiality
I keep your callers' information confidential and use it only to deliver the service to you.
I am a single-operator business. In practice that means one person, me, has access to your call data, and no employee, contractor or reviewer sees it unless I tell you first. If that ever changes, anyone I bring in will be under a written confidentiality obligation before they get access.
6. Security
I use reasonable administrative and technical measures appropriate to the risk. Concretely, and so you can hold me to something specific rather than to an adjective:
- Call data is stored in a managed database with access restricted to my own operator account and to your account's own rows.
- Recording links issued by the voice platform are signed and time-limited, so a link that leaks stops working rather than granting permanent access.
- Credentials are not shared, and I rotate them on a written procedure when something calls for it — a suspected exposure, a provider change, or a key used somewhere it should not have been. There is no fixed calendar behind that, and I would rather say so than imply a schedule I do not keep.
No method of storage or transmission is perfectly secure, and I do not claim otherwise.
You are responsible for deciding whether these measures meet your own legal obligations, and for telling me if your circumstances need more.
7. The platforms I use
I could not run the service without other companies, so I use them, and you are agreeing to that by accepting this Addendum.
Who I engage directly. Retell AI (voice platform), Twilio (telephony), Supabase (data storage), Cal.com (scheduling), Resend (email delivery), Stripe (payments and billing), Google Workspace (email), Cloudflare (hosting, and cookieless analytics on my public website), Formspree (website forms), and Tally (onboarding forms).
Who they engage in turn. The voice platform reaches speech, language and logging providers of its own to do the actual work of a call. That chain is longer than the list above, it is maintained by the platform rather than by me, and it changes. It is published at trust.retellai.com/subprocessors and that link, not a copy of it, is the disclosure.
One of them I am naming here rather than leaving to the link, and I want to explain why. ElevenLabs provides the text-to-speech that produces your receptionist’s voice, so it processes the audio your receptionist speaks on every call. I reach it through the voice platform and not directly: I hold no ElevenLabs account, no ElevenLabs credential and no contract with ElevenLabs, and the voice is selected from the voice platform’s own catalogue. So my contractual route to it runs through my agreement with the voice platform, and the protections you have in respect of ElevenLabs are the ones that agreement passes down to you. I am naming it because it was not on the published list when I checked it on 15 September 2026, and a provider that touches call audio should not be something you have to take on trust that a link covers. If the published list and this paragraph ever disagree about who is in the chain, read them together rather than treating either as complete.
I have chosen to link the maintained list rather than reprint a snapshot of it here, and the reason is worth stating: a list copied into a contract is accurate on the day it is written and silently wrong afterwards, and this one is contractually changeable on fifteen days' notice. A link is right tomorrow. A snapshot is not.
Notice, and what you can do about a change. The voice platform gives me at least fifteen days' notice before a new provider touches your data, and I have ten days to object on reasonable data protection grounds.
I pass that through to you, and I want to be precise about what it is worth. I will tell you when I learn of a new provider in the chain. If you object on reasonable data protection grounds, I will raise it upstream and work with you in good faith. I cannot promise you a veto, because I do not have one. My own remedy if an objection is not resolved is to terminate and take a pro-rated refund, and the equivalent remedy is what I can offer you: if you object to a change and we cannot resolve it, you may cancel without penalty and I will refund the unused part of the period you have paid for.
That is a smaller right than a veto and I would rather say so than let you discover it later.
8. Helping you answer your callers' requests
If one of your callers asks you for a copy of their information, or asks you to delete it, that is your request to answer, because you are the controller. If they ask me directly, I will point them to you rather than act on it myself, because I handle this information on your behalf rather than for myself.
I will help you answer, whatever the request is. On request I will retrieve what I hold about a caller, correct it where you tell me it is wrong, and delete it where you tell me to, subject to Section 10. If a caller makes some other request the law gives them, tell me what you need and I will give you what I hold so that you can answer it.
9. If there is a security incident
If I become aware of a security incident affecting your callers' information, I will tell you without undue delay and in any event within 72 hours of becoming aware. I will tell you what I know, what I am doing about it, and what I do not yet know.
The arithmetic behind that number, because a shorter one would be a promise I could not keep. For an incident that happens at the voice platform rather than in my own systems, that platform has 48 hours to tell me, and my 72 hours begins when it does. In the worst case that is 120 hours from the platform becoming aware to you hearing from me. I cannot compress the first 48 hours because they are not mine to compress, and quoting you a tighter figure would mean quoting one that depends on somebody else keeping a promise faster than they agreed to.
For an incident in my own systems the 72 hours is the whole of it.
Telling you about an incident is not me accepting fault for it.
Unsuccessful attempts that compromise nothing, such as failed logins and port scans, are not incidents and I will not notify you of them.
10. Deletion, and what I can and cannot delete
This section is deliberately in three layers, because "your data is deleted after 24 months" is a simpler sentence than the truth and I would rather give you the truth.
Layer 1: what I delete, by my own act. The transcript of a call, the written analysis of it, the link to its recording, the summary of it I sent you, and the caller's own telephone number are erased from my systems 24 months after the call. That runs automatically on a monthly job, not on request, and not by hand.
Layer 2: what I can only ask for. The recording itself is stored by the voice platform, not by me. I hold a link, not the audio. Your agent is configured with a 730 day retention setting, which is 24 months, so the platform's own schedule matches mine. If you ask me to delete a recording sooner, I pass that request to the platform and confirm to you when it reports back. I am relaying a request, not performing a deletion, and if the platform does not act I can tell you that but I cannot override it.
Layer 3: what may survive both. The platform is entitled to keep data where the law requires it, or in line with its own backup and record retention policies. That means a copy may persist in a backup after both of the above have run. I do not control it, I am not told when it expires, and I will not tell you it is gone when I do not know that.
On termination. When your account closes I delete the material in Layer 1 and pass a deletion request for Layer 2. Layer 3 is unchanged by your account closing.
What stays on your account record after all of that. Layer 1 removes everything the caller gave me and everything I derived from it. What is left is the bare shape of the call: the number it came in on, the time, how long it lasted, and what the outcome was. Those four are what your invoice is built from, so I keep them, and none of them says who called or what they said. Account and billing records are kept for as long as the law requires.
I would rather tell you that than let you read "deleted after 24 months" and picture more than happens.
11. Information and audit
On reasonable written request, and not more than once a year unless a security incident or a regulator gives you cause, you may take reasonable and appropriate steps to satisfy yourself that I am handling your callers' information as this Addendum says and in a way that is consistent with your own obligations under the California Consumer Privacy Act. I will give you the information you reasonably need to do that.
That means answering your questions in writing, and giving you what I have from my platforms. It does not mean physical access to systems I do not own.
And if you think something is wrong, here is what you can do about it. If you tell me in writing that you believe I am using your callers' information in a way this Addendum or the CCPA does not permit, you may take reasonable and appropriate steps to stop that use and to put it right, and I will cooperate with them. That includes telling me to stop, telling me to delete anything that came out of it, and asking me to show you that I have. If we cannot resolve it, you may cancel without penalty and I will refund the unused part of the period you have paid for.
12. Where information is processed
The service is built for businesses in the United States, and I operate it from the United States.
I am not going to tell you that every provider in Section 7 processes your data only inside the United States, because I have not verified that for each of them and I will not assert what I have not checked. The platform chain is published at the link in Section 7 and several of those providers are global companies.
This service is for United States businesses only, and that is a settled position rather than a current limitation. If your business is subject to the EU or UK GDPR, whether because you are established there or because you offer goods or services to people there, I am not the right supplier for you and you should not sign up. This Addendum does not carry the transfer mechanisms those laws require and it is not going to. I would rather turn the work away than take it on terms I cannot meet. I do not screen for this at signup. There is no question on my onboarding form that asks it, and I am not going to add one, because a screening question would imply there is a right answer that gets you in. There is not. This paragraph is the screen, and I am relying on you to read it.
One thing none of that covers, and I would rather name it than let you find it. Your callers are your callers, and I have no say in where one of them happens to be standing when they dial your number. A United States business can take a call from someone sitting in London or Berlin. My position is that answering a call someone chose to place to a US business is not offering goods or services to people in the EU or the UK: Wharfline does not sell there, does not advertise there, and does not seek those callers, and the caller starts the conversation. That is my reasoned judgement and not a settled point of law. I am telling you it is a judgement rather than dressing it up as something firmer, and I have decided to run the service on it rather than leave the question unwritten.
13. What I do not do with your Call Data
You own your Call Data. I do not claim it.
I do not sell it. I do not share it for cross-context behavioural advertising. I do not use it to train models. I do not use it to build or improve a product. I do not combine it with information from anywhere else except as a service provider is permitted to. I do not use it or keep it for any purpose outside delivering the service to you, and I do not use it outside our direct business relationship. If I ever conclude I can no longer meet those commitments, I will tell you promptly.
That covers what I do, and there is a limit to it that you should know about. Part of your Call Data sits with the voice platform. Its own terms let it use de-identified and aggregated data derived from calls for developing and improving its models. I do not control those terms, I did not write them, and I do not make promises on that platform's behalf. What I can tell you is that this is a real thing that happens and not a theoretical one, and I would rather you learned it here than later.
14. Which document controls
If this Addendum and the Service Agreement disagree about how your callers' information is handled, this Addendum controls on that question. On everything else, including what the service is, what it costs, and how cancellation works, the Service Agreement controls.
If this Addendum and my Privacy Policy disagree, this Addendum controls between you and me, because this is the document you accepted. The Privacy Policy tells your callers and the public how I handle information generally, and I keep the two consistent.
15. Changes to this Addendum
I may update this Addendum. If a change materially reduces the protections in it, I will give you at least 30 days' notice by email before it applies to you, and you may cancel before it takes effect if you do not accept it.
Routine changes that do not reduce your protections, such as adding a provider to Section 7 or correcting a description, take effect when published, and Section 7 governs how I notify you about a new provider.
Every published edition carries an Edition number and a date at the top of the page.
Contact
Questions about this Addendum? Email support@wharfline.com.