Data Processing Addendum
Last updated September 20, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between AXO Solutions, Inc. ("AXO") and the customer for AXO.Voice, whether that agreement is the Terms of Service or a signed contract. It applies to personal information that AXO processes on the customer’s behalf ("Customer Personal Information"). If this DPA and the agreement conflict about the processing of Customer Personal Information, this DPA controls.
1. Roles
The customer, and where the customer is an agency, its clients, decide why and how Customer Personal Information is processed. AXO processes it on their behalf as a processor or service provider. The customer’s instructions are the agreement, this DPA, and the way the customer configures and uses the service. AXO will tell the customer if it believes an instruction breaks the law, unless the law prohibits that.
Where the customer is an agency acting for its clients, the agency confirms that it is authorised to give these instructions on its clients’ behalf and is AXO’s sole point of contact for them.
2. What is processed
| Item | Detail |
|---|---|
| Subject matter | Transcription, analysis, storage and display of calls, and the conduct of automated phone conversations, as the customer configures. |
| Duration | The term of the agreement, plus the export and deletion periods in section 8. |
| Individuals | People who take part in the customer’s calls, such as callers, candidates and prospects, and the customer’s own staff. |
| Information | Call audio, call details including phone numbers, transcripts and what was said in them, output generated from them, staff names and, where enabled, staff voiceprints and voice samples. |
| Sensitive information | Voiceprints are biometric information and are processed only where the customer enables voice identification for a named, consenting staff member. The customer must not submit health information, payment card numbers or government identity numbers. |
3. AXO’s commitments
- Process Customer Personal Information only to provide the service and as the customer instructs, and not sell it, share it for cross-context behavioural advertising, or combine it with information from other sources except as the law permits a service provider to do.
- Not use it to train machine-learning models offered to other customers.
- Keep it confidential and make sure the people authorised to handle it are bound to confidentiality.
- Maintain the security measures in section 5.
- Help the customer, as far as is reasonable given the nature of the processing, to respond to individuals exercising their legal rights, including by deleting a named individual’s records on the customer’s instruction.
- Give the customer the information reasonably needed to show compliance with this DPA, and allow an audit no more than once a year, on thirty days’ notice, during business hours, under confidentiality, and at the customer’s cost. A current third-party report or a completed security questionnaire satisfies this where one is available.
- Notify the customer if AXO can no longer meet its obligations under applicable privacy law.
4. The customer’s commitments
- Have a lawful basis for the processing, and give every notice and obtain every consent the law requires, including for recording calls, for automated or artificial-voice calls, and for creating a staff member’s voiceprint or cloned voice.
- Submit only information it has the right to submit, and none of the prohibited categories above.
- Configure retention, redaction and user access to suit its own obligations.
5. Security
- Encryption of data in transit and at rest.
- Isolation of every customer table by workspace at the database level, with client workspaces under an agency isolated from one another.
- Role-based access within each workspace; agency access to client workspaces limited to owners and admins.
- Encrypted storage of third-party credentials, and hashed storage of ingest tokens.
- Database back-ups with a documented restore procedure.
6. Sub-processors
The customer authorises AXO to use the sub-processors listed on the Sub-processors page. AXO binds each of them to data-protection terms consistent with this DPA and remains responsible for what they do with Customer Personal Information. AXO will give at least thirty days’ notice before adding a sub-processor that will process Customer Personal Information, by updating that page and notifying account owners who have asked to be told. The customer may object on reasonable data-protection grounds within that period. If the objection cannot be resolved, the customer may terminate the affected service without penalty.
7. Security incidents
AXO will notify the customer without undue delay, and in any case within seventy-two hours, after confirming unauthorised access to, or disclosure or loss of, Customer Personal Information. The notice will describe what happened, the information and individuals affected as far as known, and what AXO is doing about it, and AXO will keep the customer updated and cooperate with its investigation. Where the customer is an agency, AXO notifies the agency, and the agency is responsible for notifying its clients.
8. Return and deletion
The customer can export and delete Customer Personal Information in the service at any time. For thirty days after the agreement ends the customer may export it. AXO then deletes it within sixty days, other than back-up copies that age out in the ordinary course and information AXO must keep by law, which remains protected by this DPA. On written request AXO will delete sooner and confirm in writing.
9. Location and international transfers
AXO.Voice is hosted and Customer Personal Information is processed in the United States. The service is offered to customers in the United States. A customer that needs to submit personal information from the European Economic Area, the United Kingdom or Switzerland must tell AXO first so that the appropriate transfer terms can be agreed in writing.
10. Liability
Liability under this DPA is subject to the limits in the agreement.
Questions about this DPA: hello@axoapp.ai, or by mail to AXO Solutions, Inc., 6125 El Monte St, Fairway, KS 66205, USA.