Data Processing Agreement
This agreement forms part of the Jack Terms of Service and is accepted with them at Stripe Checkout.
1. Parties and roles
You (the business named at checkout) are the controller. Sam Part, trading as Jack, of 185 Tamworth Lane, Mitcham, CR4 1DH ("we") is the processor. We process personal data only to provide Jack to you.
2. Processing details (schedule)
| Item | Detail |
|---|---|
| Subject matter | Answering and handling calls and messages for your business, booking work, sending messages, keeping records |
| Duration | For as long as we provide Jack, plus the return/deletion period in clause 10 |
| Nature and purpose | Handling calls live with an AI assistant, transcribing them, collecting job details and photos, booking, sending texts and emails, alerting you, reviewing calls to improve Jack, reporting |
| Data subjects | Your callers, customers and prospective customers; your staff who receive alerts |
| Personal data | Names, phone numbers, email and postal addresses, job details, photos sent to us, call transcripts and summaries, appointment details, messages. Audio recordings are kept only if you have chosen to record calls (your setup summary says which). |
| Special category data | Not intended. Callers may mention it (for example health or access needs); we process it only as part of the call record |
3. Our commitments
3.1 We process personal data only on your documented instructions (these terms, your setup summary and your written requests), unless the law requires otherwise; we'll tell you if we think an instruction breaks the law.
3.2 Anyone who processes the data for us is bound by confidentiality.
3.3 We keep the data secure with appropriate technical and organisational measures (clause 7).
3.4 We help you respond to people exercising their rights (access, deletion, correction, objection) and pass on any request we receive.
3.5 We help you with security, breach notification and data protection impact assessments, as far as reasonable. We may charge for significant extra work.
3.6 We give you the information you reasonably need to show compliance, and allow one reasonable audit or inspection a year, on 30 days' written notice, at your cost.
4. Sub-processors
4.1 You give general authorisation for us to use the sub-processors listed below. Each is bound by data protection terms at least as protective as this agreement.
4.2 We'll give you at least 14 days' notice of a new or replacement sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may end the service without penalty.
4.3 We remain responsible to you for our sub-processors.
| Sub-processor | What for | Location | Data kept |
|---|---|---|---|
| Vapi | Runs the AI voice assistant during the call | US | Nothing after the call (zero data retention on; recording off unless you chose it) |
| AI model and transcription providers used through Vapi (OpenAI or Anthropic; Deepgram) | Understanding and transcribing the call | US | Not used for training; short abuse-monitoring logs only |
| Twilio | Phone numbers, calls, text messages | US (and others) | Call and message records under Twilio's DPA |
| n8n | Automations that connect the systems | EU | Short execution logs |
| Google (Drive, Sheets, Calendar) | Your sheet, transcripts folder and diary | UK/EU/US | As set out in clause 9 |
| Stripe | Billing (your business details only) | US/EU | Billing records |
5. International transfers
Some sub-processors process data outside the UK, mainly in the US. We only use providers whose terms include a safeguard UK law accepts (the UK-US data bridge for certified providers, or the ICO's International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses).
6. AI training
We don't use your data to train AI models, and we configure our providers not to: zero data retention on Vapi, and provider training controls switched off where available.
7. Security
Access limited to the people who need it; accounts protected with strong passwords and two-factor authentication; your data kept in your own folder and sheet, shared only with you; audio not recorded unless you chose it; transcripts deleted on schedule.
8. Personal data breaches
We'll tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with the information you need to report it to the ICO within 72 hours where required.
9. Retention
- Audio recordings are not made unless you chose that option.
- Call transcripts are kept in your Drive folder for 30 days so we can review calls and improve Jack, then deleted automatically.
- Job and call summaries in your sheet are your records; you decide how long to keep them.
- You can ask us in writing for a shorter or longer period.
10. End of the service
Within 30 days of the service ending we will, at your choice, return your data (export of your sheet and any transcripts still held) or delete it, and delete remaining copies unless the law requires us to keep them. Our providers' backups are deleted on their own schedules.
11. Liability
Liability under this agreement is covered by the liability clause in the Terms of Service.