Data Processing Addendum

1What this addendum covers#

This addendum is part of the Terms of Service for every paid AOS Sites plan. It covers the personal information your website and your AOS Sites tools collect from other people on your behalf: your visitors, the people who call or text your business through the AI Receptionist, and the contacts you add to Email Marketing. We call that “visitor information”.

It doesn’t cover information about you as our customer, which our Privacy Policy covers. Where this addendum and the Terms differ about visitor information, this addendum wins.

2Your role and ours#

You decide what your site collects and why, so you are the business responsible for visitor information (a “controller”, or a “business” under the California Consumer Privacy Act as amended by the CPRA).

We process it for you, as your processor and “service provider” under the CCPA/CPRA and similar US state privacy laws. Agency OS LLC, which runs AOS Sites, is that processor.

3What we process, and why#

The information

• What visitors type into your forms, booking pages, quizzes and sign-up boxes: usually a name, email, phone number and message.
• Chats between visitors and AOS, your site’s assistant, and any replies you or your team send.
• With the AI Receptionist: callers’ numbers, what they tell it, call transcripts and summaries, recordings when recording is on (callers hear a notice first), and texts with your business line.
• Email Marketing contacts you import or collect, and whether they opened, clicked, bounced or unsubscribed.
• Technical details needed to keep forms free of spam, such as a one-way hash of a visitor’s network address.

The purposes

Only to provide AOS Sites to you: delivering leads to your inbox and email, running the chat, bookings, texts, calls and emails you set up, keeping your site secure and free of spam, and helping you when you ask our support team. We process visitor information for as long as you use AOS Sites, then as section 9 says.

Visitor information must not include payment card numbers, Social Security numbers or medical details. AOS Sites isn’t built for health information, and we don’t sign HIPAA business associate agreements.

4How we use it, and how we don’t#

Your instructions are these Terms and the settings you choose in AOS Sites. We follow them, unless the law requires otherwise, in which case we tell you first where the law allows. We:

• don’t sell visitor information or share it for cross-context behavioral advertising;
• don’t use it for our own purposes, or outside our direct business relationship with you, and don’t combine it with information from other sources except as the CCPA allows a service provider to;
• don’t give our AI providers permission to train their models on it;
• send it to Agency OS, our own customer system, only if you turn on lead sync in Settings, and never send it your Email Marketing contacts;
• limit who on our team can see it to the people who need to, for support you asked for or to keep the service running and safe;
• tell you if we can no longer meet these obligations, and let you take reasonable steps to stop and fix any use you didn’t authorize.

5The providers who help us#

These providers (sub-processors) handle visitor information for us, only to provide their service, under contracts that limit what they may do with it:

Our full list of providers is in the Privacy Policy. We update this list, with a new date at the top of this page, before a new provider starts handling visitor information. If you object to a new provider, tell us; if we can’t resolve it, you can cancel, and the Refund Policy applies.

6How we keep it safe#

• Information is encrypted in transit, and our database provider encrypts it at rest.
• Each business’s information is kept separate by database access rules, checked by automated tests.
• Sign-in tokens and other secrets we store are sealed with AES-256-GCM, in places no signed-in user can read; provider keys stay on our servers.
• Network addresses used to stop abuse are stored as one-way hashes, not the addresses themselves.
• Our staff reach customer information only through our admin tools, by role, in sessions that expire; account and staff actions go into an audit log that can’t be edited.
• Nightly encrypted backups, on top of our database provider’s own daily backups.
• Spam and abuse limits on forms and chat.

We don’t hold a SOC 2 report or another security certification yet. Ask us and we’ll describe these safeguards in more detail in writing.

7If something goes wrong#

If we learn that visitor information we hold was accessed or disclosed without authorization, we tell you by email without undue delay, with what we know: what happened, what information and how many people it affects, what we’re doing about it, and who to contact. We’ll keep you updated and help you meet any duty you have to notify people or authorities.

8Helping with your visitors’ requests#

Your dashboard lets you find, export and delete leads and contacts. If a visitor asks us directly to see, correct or delete their information, we pass the request to you within 5 business days and help you answer it. Unsubscribes and STOP replies are honored automatically.

9Returning and deleting it#

You can export your leads and data at any time, free. When your plan ends, your site goes offline but nothing is deleted on a timer: you keep a read-only login to your leads and data, and you can come back to the same site. See Cancelling in the Terms.

When you ask us to delete your account, we delete visitor information within 30 days, and from backups as they cycle out, except what the law requires us to keep. You can delete single leads and contacts yourself whenever you like. How long we keep each kind of information is in the Privacy Policy.

10Where it’s processed#

AOS Sites is for businesses in the United States. We are a US company, and we and our providers process visitor information mainly in the United States; some providers, including AI providers, may process it in other countries with safeguards in their contracts with us. This addendum is written for US privacy laws. We don’t yet offer terms for the GDPR or other non-US laws, such as Standard Contractual Clauses.

11A signed copy#

This addendum applies to your paid plan without a signature. If your business needs a countersigned copy for its records, email info@agency-os.ai with your business’s legal name and address, and we’ll send one.