Data Processing Agreement (DPA)
Last updated: September 20, 2026 · Forms part of the Terms of Service
This Data Processing Agreement ("DPA") governs our processing of end-customer personal data that we process on your behalf when delivering the Service. In this DPA, you (the Client) are the "Controller" and Zero Headache is the "Processor" (or "Service Provider" under applicable state privacy laws). This DPA satisfies the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR), the UK GDPR, and applicable US state data privacy regulations.
1. Scope and roles
We process end-customer personal data strictly to provide the Service and solely in accordance with your documented instructions (including your account configuration, qualification parameters, and the Terms of Service).
2. Processing details
- Subject matter: Capture, qualification, scheduling, and CRM synchronization of inbound leads.
- Duration: The active term of the client's service subscription plus applicable post-termination deletion windows.
- Nature and purpose: Placing and receiving calls, exchanging text messages, generating transcripts, qualifying leads according to client rules, and syncing booking data.
- Data types: Identifiers (name, phone number, email address), conversation content (audio, SMS, web chat, transcripts), booking details, and lead-source information.
- Data subjects: Prospective and existing customers who contact the Client.
3. Obligations of the processor
Zero Headache commits to the following:
- Documented instructions: We process data only on documented client instructions, unless required by applicable law.
- No model training: We do not use client or end-customer personal data, audio, or transcripts to train or refine generalized artificial intelligence models without express written permission.
- Personnel confidentiality: All personnel authorized to process personal data are subject to binding confidentiality obligations.
- Security measures: We implement and maintain the technical and organizational security measures detailed in Annex 2.
- Assistance: We assist the Controller in fulfilling data-subject requests (access, rectification, erasure) and complying with security and breach notification obligations.
- Breach notification: We notify the Controller without undue delay (and in any event within 72 hours) upon confirming a personal data breach affecting client data.
- Data return and deletion: Upon termination of the Service, the Client may request export of lead data within 30 days. Following that period, we delete or anonymize all remaining records, unless retention is required by statutory tax or legal obligations.
4. Sub-processors
The Controller grants general authorization for the sub-processors listed in Annex 1 below. We contractually require each sub-processor to maintain data protection standards equivalent to this DPA.
We will provide at least 30 days' advance notice of any planned addition or replacement of a sub-processor by updating this page. If you object to a new sub-processor on reasonable data protection grounds, you may terminate the affected service without penalty by providing written notice before the change takes effect.
5. International transfers
Where personal data subject to GDPR or UK GDPR is transferred internationally to countries not recognized as providing an adequate level of data protection, the parties agree to incorporate the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) or the UK International Data Transfer Addendum. A Transfer Impact Assessment is available upon request.
6. Audits
We make available information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior notice, we allow for and contribute to audits conducted by the Controller or an independent auditor, subject to appropriate confidentiality and operational security safeguards.
7. Limitation of liability
Each party's total liability under or in connection with this DPA is subject to the liability limitations and exclusions set forth in the Terms of Service.
Authorized sub-processors
The following third-party service providers process data on behalf of Zero Headache to deliver our conversational front desk, telephony, data storage, and CRM integration infrastructure:
| Sub-processor | Purpose | Data Processed | Region |
|---|---|---|---|
| Twilio | Telephony & SMS transport | Phone numbers, call/message metadata & content | US/EU |
| Vapi | Voice-agent orchestration | Call audio, metadata | US |
| Retell AI | Conversational voice API | Call audio, transcripts | US |
| ElevenAgents | Conversational AI voice generation | Call audio generation | US |
| OpenRouter | LLM routing & inference | Conversation text | US |
| Zernio | Knowledge retrieval & agent memory | Business context & transcripts | US |
| Zapier | Automation & CRM integration | Lead & appointment records | Global |
| Composio | Lead-source & CRM integration layer | Lead & appointment records | US |
| Cal.com | Scheduling & calendar sync | Appointment & contact details | EU |
| Supabase | Database & application hosting | All Service data | US/EU (Region-pinned) |
| Trigger.dev | Background jobs & sync orchestration | Lead/appointment records | US |
| Resend | Transactional email notifications | Email addresses, message content | US |
| Sent | SMS delivery | Phone numbers, message content | US |
| Dodo Payments | Payment processing (Merchant of Record) | Billing & contact details | Global |
| Paddle | Backup payment processing (Merchant of Record) | Billing & contact details | Global |
| PostHog | Website analytics | Anonymized usage telemetry | US/EU |
| AWS Lightsail | Application hosting & deployment | Service operational data | US/EU |
| Langfuse | LLM observability & tracing | Conversation logs | US |
Technical and organizational security measures
Zero Headache implements and maintains the following technical and organizational safeguards to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure:
1. Encryption in transit and at rest
All network communication with our web applications, APIs, and management dashboard is encrypted in transit using TLS 1.2 or higher. Stored data, database snapshots, and call recordings are encrypted at rest using AES-256 standard encryption.
2. Access control and least privilege
Access to production systems, server environments, and customer data is strictly restricted to authorized engineers on a least-privilege basis. Multi-factor authentication (MFA) is mandatory for administrative access, and privileges are immediately revoked upon role modification or departure.
3. Hosting and region isolation
Our infrastructure is deployed across hardened cloud data centers. Regional data storage options are supported for European and North American clients requiring localized data residency.
4. Sub-processor security compliance
Every sub-processor undergoes security and compliance verification prior to onboarding and is contractually held to strict security, confidentiality, and breach notification standards.
5. Incident management and response
We maintain an incident-response protocol. In the event of a confirmed security incident involving client personal data, we notify affected clients within 72 hours of verification and cooperate fully in incident remediation.
6. Data retention controls
Clients control retention policies for their end-customer data. Call audio and transcripts are retained for a 6-month default period, with instant purging available through our zero-retention configuration.
7. No model training on private data
Customer communications, transcripts, and personal data are never used to train, fine-tune, or improve public foundation models without explicit written agreement.
8. Security audits and certifications
Our hosting and integration infrastructure relies on vendors holding SOC 2 Type II and ISO 27001 certifications. Detailed security summaries are available to prospective enterprise clients under NDA.
Controller signature:
Accepted electronically upon account creation or checkout, forming an integral part of the Terms of Service. Countersigned PDF copies are available upon request.
Processor:
Zero Headache
