Data processing agreement
How AhoyDesk processes the personal data of agencies' clients' callers — roles, sub-processors, security, breach notice, deletion and audits.
Updated October 3, 2026
This agreement is part of our terms of service. It covers the personal data of your clients’ callers and chat visitors that AhoyDesk processes for you: phone numbers, recordings, transcripts, messages, and the details the receptionist notes. It applies automatically. You don’t need to sign anything.
Roles
You (the agency) decide what this data is for, on your own behalf or for your client. AhoyDesk processes it for you as a processor, or as a sub-processor when you act for your client.
What we do with it
- We process it only to run the receptionists you set up: answering, transcribing, alerting, reporting, and fixing problems. We follow your written instructions, which are your settings in the dashboard.
- We don’t sell it, use it for advertising, or use it to train AI models.
- Everyone at AhoyDesk who can reach it must keep it confidential.
Security
- Encryption in transit (HTTPS).
- Encrypted provider keys.
- Hashed passwords.
- Access limited to the people who run the service.
- Separation between agencies: each agency sees only its own data, and automated tests check this.
- Nightly backups, kept for 14 days.
Sub-processors
Sub-processors are listed in our privacy policy:
- Hetzner, our hosting;
- Vapi, for voice and phone, with its speech providers;
- OpenAI, for the language model;
- Twilio, when you connect it;
- Bird, for email;
- Cloudflare.
We tell you by email at least 14 days before we add or replace one that processes this data. If you object, you may stop using the service and we refund the unused part of your term.
Data is processed in the EU (Finland) and the United States.
Breaches
If we confirm a breach affecting this data, we tell you without undue delay, and within 72 hours. We say what we know: what happened, which data, and what we are doing. We keep you updated as we learn more.
Helping you
- We help you answer requests from callers to see, correct or delete their data.
- We delete specific conversations or recordings when you ask.
- We give you the information you reasonably need to show that you comply.
Deletion
Data is deleted on the schedule in our privacy policy. When you close your account, we delete your clients’ data within 30 days, except where the law requires us to keep it.
Audits
Once a year, on written request, we answer your reasonable security and privacy questions in writing, and share the documents that support the answers. We don’t offer on-site audits.
Liability
The limits in our terms of service apply to this agreement too.