The DPA
for the careful.

You are the Controller (or Business under CCPA) of personal data processed by your AI receptionist. Christian G Flair LLC, operating as Handled ("we", "Processor"), processes that data on your documented instructions, defined by these terms, the Privacy Policy, and your account configuration.

We process: caller phone numbers, voice recordings, transcripts, structured event metadata, and the destinations you configure (CRM contacts, calendar events, transfer endpoints).

We do not sell, share, or train external models on your data. We use it only to operate the service for your account and improve quality monitoring of that account.

We use the subprocessors listed below. We notify you of changes by email at least 14 days before a new subprocessor handles your data. You can object in writing; if we cannot resolve, you may terminate the affected service for refund of the unused term.

All transit is TLS 1.2+. Stored recordings and transcripts are encrypted at rest by the subprocessor (AES-256). Access is restricted by role; we run least-privilege on Vapi, Supabase, and Stripe consoles. We don't store payment card numbers — Stripe is the system of record.

We log access to customer data on the operations side and audit it monthly. Production deployments are reviewable in Vercel + git history.

If we become aware of a personal-data breach affecting you, we notify you without undue delay and in any case within 72 hours, with what we know, what we don't, and what we're doing about it.

You are responsible for the lawful basis of every call your assistant makes or receives — consent for outbound, disclosure on inbound. Our compliance posture (FCC + CA AB 2905 + NY GBL § 396-b + two-party recording auto-honor) is set up; you must keep your call lists, dialer configurations, and recipient consent records lawful.

We assist you in responding to access, deletion, correction, and portability requests within applicable legal windows. The dashboard exposes self-service export and deletion; for unusual cases, contact privacy@handled.build.

Data flows from the controller's region to the US (where Handled and most subprocessors operate). Where required, we rely on Standard Contractual Clauses (2021 modules) plus the EU-US Data Privacy Framework via Stripe / Vercel / Twilio's certifications.

On termination, you have a 30-day window to export account data, recordings, and transcripts. After 30 days we delete (or anonymize) all customer-identifiable data unless retention is required by law (typically 7 years for tax records).