Effective 2026-06-25 · Version 1.0
This Data Processing Addendum ("DPA") forms part of the Sellphone Terms of Service between PG Insights LLC dba Sellphone ("Sellphone," "we," "us," or "our") and the Customer (the organization or individual that has agreed to those Terms). It sets out the obligations of each party with respect to personal data that Sellphone processes on the Customer's behalf in connection with the Sellphone service ("Service"). Enterprise customers who require a signed copy may contact support@sellphone.pro.
The Customer is the data controller of the personal data of their callers, contacts, and other individuals whose personal data is transmitted through or stored in the Service. The Customer determines the purposes for which personal data is processed (for example, maintaining a contact book, routing business calls, and sending SMS messages).
Sellphone is the data processor acting on behalf of and under the instructions of the Customer. Sellphone processes personal data solely to provide the Service and as otherwise described in this DPA and the Privacy Policy. Sellphone does not process personal data for its own independent purposes, and does not sell, license, or share Customer personal data with third parties except as a data sub-processor for the purpose of providing the Service.
To the extent Sellphone processes personal data for its own purposes (for example, billing records, fraud prevention, or analytics derived from aggregated usage data), Sellphone acts as an independent data controller for those purposes and is separately responsible for such processing.
Sellphone will process personal data as a processor only:
The categories of personal data processed and the categories of data subjects affected are those arising from the Customer's use of the Service, including but not limited to: names and contact details of the Customer's callers and contacts; call audio recordings (where the Customer has enabled call recording); voicemail audio and transcription; SMS/MMS message content and metadata; and any personal data the Customer imports into the contact book.
Sellphone will process personal data only in accordance with the Customer's documented instructions, as set out in this DPA and the Terms of Service. The Customer instructs Sellphone to process personal data for the purposes described in Section 2. If Sellphone is required by applicable law to process personal data other than as instructed by the Customer, Sellphone will inform the Customer of that requirement before such processing, unless the law prohibits such notification.
Sellphone will ensure that all personnel authorized to process personal data on Sellphone's behalf are subject to appropriate confidentiality obligations. Sellphone will not disclose personal data to any person except as expressly permitted by this DPA, the Terms of Service, or applicable law.
Sellphone implements commercially reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, at a minimum:
The Customer is responsible for implementing appropriate security measures on their own systems and for the secure use of the Service (including credential management, device security, and compliance with applicable recording-consent laws).
The Customer authorizes Sellphone to engage the following sub-processors in connection with providing the Service. Each sub-processor is bound by contractual obligations consistent with this DPA:
| Name | Purpose | Location |
|---|---|---|
| Twilio Inc. | Telephony infrastructure, call routing and recording, SMS/MMS delivery and Conversations API, voicemail recording, A2P 10DLC campaign management, and interim call-recording storage prior to offload. | USA |
| Stripe, Inc. | Payment processing, subscription billing management, off-session payment method charging (auto-reload and top-ups), and Customer Portal. | USA |
| Supabase, Inc. | PostgreSQL database hosting (all account and communications metadata) and private object storage for voicemail recordings and offloaded call recordings. | USA |
| Resend, Inc. | Transactional email delivery for account setup notifications, payment alerts, and A2P status communications. | USA |
| Google LLC | OAuth 2.0 identity verification (Google Sign-In) for Customers who choose to authenticate via Google; optional analytics (Google Analytics 4) where configured by Sellphone. | USA |
Sellphone may update the list of sub-processors from time to time. Before authorizing any new sub-processor to process personal data, Sellphone will provide the Customer with reasonable prior notice (which may be given by updating this DPA or by email to the Customer's registered address). If the Customer reasonably objects to a new sub-processor on grounds that the change materially degrades the data-protection protections provided under this DPA, the Customer may notify Sellphone in writing within thirty (30) days of receiving the change notice. The parties will seek to resolve the objection in good faith. If the parties are unable to resolve the objection, the Customer may terminate the Service on written notice, subject to the Terms of Service.
Sellphone will, taking into account the nature of the processing, provide reasonable assistance to the Customer in fulfilling its obligations to respond to data-subject requests under applicable data protection law (including requests for access, rectification, erasure, restriction of processing, data portability, and objection). If Sellphone receives a data-subject request directly that relates to personal data processed on the Customer's behalf, Sellphone will promptly redirect the data subject to the Customer and will not respond to such requests independently except as required by applicable law.
The Customer acknowledges that it is the primary point of contact for its callers and contacts and is responsible for responding to data-subject requests relating to personal data the Customer controls. Sellphone's assistance will be limited to making available to the Customer the functionality of the Service that allows the Customer to retrieve, correct, export, or delete personal data, as well as providing information reasonably requested by the Customer to complete a response.
Sellphone will notify the Customer without undue delay, and in any event within seventy-two (72) hours of Sellphone becoming aware, of any personal data breach affecting personal data processed under this DPA, to the extent permitted by applicable law. Sellphone will provide the Customer with sufficient information to allow the Customer to meet any applicable breach-notification obligations to supervisory authorities and data subjects, including: (a) a description of the nature of the breach; (b) the categories and approximate number of data subjects and records concerned; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach.
Notification by Sellphone of a breach shall not constitute an acknowledgment by Sellphone of fault or liability with respect to such breach. The Customer is responsible for determining whether the breach triggers notification obligations under applicable law and for making any required notifications to data subjects or supervisory authorities.
Upon termination or expiration of the Customer's subscription, or upon the Customer's written request at any time, Sellphone will, at the Customer's election, delete or return to the Customer all personal data processed on the Customer's behalf, except to the extent that Sellphone is required by applicable law to retain a copy. Sellphone will securely destroy residual copies of personal data not returned to the Customer within a commercially reasonable time after termination (typically within 30 days of account closure), in accordance with Sellphone's data-retention policies.
In practice, the Customer can export call logs and contact data from within the Service prior to account closure. Wallet ledger records (which include personal data such as billing email) are retained by Sellphone for at least seven years for financial and tax compliance purposes, as described in the Privacy Policy.
Sellphone will make available to the Customer, upon reasonable written request, information reasonably necessary to demonstrate Sellphone's compliance with its obligations under this DPA. Sellphone will permit audits or inspections of its relevant data-processing practices, at the Customer's expense and on reasonable prior written notice (not less than thirty (30) days), subject to the following limitations: (a) audits may not occur more than once per calendar year; (b) audits must be conducted during normal business hours and in a manner that does not unreasonably disrupt Sellphone's operations; and (c) the Customer (and any appointed auditor) must execute a reasonable non-disclosure agreement before conducting any audit.
Where Sellphone maintains third-party audit reports, security certifications, or penetration-test summaries, Sellphone may satisfy audit requests by providing such reports in lieu of permitting a direct audit, where the auditor agrees such reports are reasonably sufficient.
Enterprise customers. Enterprise customers and those operating under a regulatory framework that requires a signed DPA (including the GDPR, UK GDPR, or similar data-protection regimes) may request a signed copy by contacting support@sellphone.pro. Sellphone will work in good faith with enterprise customers to execute a mutually acceptable DPA.
Conflict with Terms of Service. In the event of any conflict between this DPA and the Terms of Service with respect to data-processing obligations, this DPA will prevail. In all other respects, the Terms of Service continue to govern.
Processor-to-processor relationships. This DPA governs Sellphone's role as a processor on behalf of the Customer. It does not create any obligation by Sellphone toward the Customer's data subjects as third-party beneficiaries, nor does it create any liability on the part of Sellphone beyond what is set forth in the Terms of Service.
PG Insights LLC dba Sellphone
Email: support@sellphone.pro