Home › Data Processing Addendum
Data Processing Addendum
How we handle personal data on your behalf when our agent answers your phone. Forms part of the Terms of Service.
1. Roles
For personal data processed through the service, the Client is the controller and Brimeo is the processor. You decide what is collected on your calls and why. We act on your documented instructions. This Addendum forms part of the Terms of Service and is entered into by Creatrixe Solutions Limited, a company incorporated in British Columbia, Canada, which operates Brimeo.
2. What we process
| Item | Detail |
|---|---|
| Subject matter | Answering, handling and logging inbound calls and messages |
| Duration | While you hold an account, plus the retention periods in our Privacy Policy |
| Categories of people | Your callers, your customers and prospects, your staff who use the dashboard |
| Categories of data | Phone numbers, names, call audio, transcripts, summaries, appointment details, anything a caller volunteers |
| Special category data | Not permitted. See Prohibited Data in the Terms. |
| Territory | Service offered in the United States only; data stored in the United States; controller-side operations in Canada and Pakistan |
3. Our instructions from you
We process personal data only to provide the service, and on your instructions. We will tell you if an instruction appears to breach data protection law, and we may refuse an instruction that would violate someone's privacy or publicity rights.
We do not use your call data to train AI models and we do not sell it. Training on customer data is disabled in our provider configurations.
You are responsible for having a lawful basis, giving callers the notice they are owed, obtaining recording consent where the state requires it, and configuring AI disclosure where it applies.
4. Confidentiality
Anyone with access to your data is bound by confidentiality obligations, background checked, and granted the minimum access needed to do their job. Access is logged.
5. Subprocessors
You authorise us to use the subprocessors listed in the Privacy Policy — currently Vapi, Twilio, Telnyx, Deepgram, ElevenLabs, OpenAI, Supabase, Vercel, Google and Airwallex. Each is bound by written terms no less protective than this Addendum. We give 30 days' notice before adding a subprocessor that processes call content, and you may object; if we cannot resolve the objection you may terminate without penalty for the remainder of the term.
6. Security measures
- Encryption in transit and at rest
- Role-based access control and multi-factor authentication (2FA) on all administrative access
- Access logging and audit trails
- Segregation of client data
- Background checks on personnel with production access
- Documented retention and destruction schedule, enforced in storage we control
- Regular backups
7. Data subject requests
If a caller contacts us directly we will direct them to you and let you know. We will help you respond within your statutory deadline, including finding, exporting or deleting a specific caller's records. Deletion tools are in the dashboard so most requests need no help from us.
8. Breach notification
If we become aware of a personal data breach affecting your data we will notify you without undue delay and within 72 hours. Where PIPEDA requires it, we will also report the breach to the Office of the Privacy Commissioner of Canada and keep a record of it for 24 months. We will tell you with what we know, what we are doing, and what we recommend you do. We will support your own notification obligations.
9. Where data is held and accessed
Brimeo is operated from Canada. Call data is stored in the United States, and the service is offered to US businesses only. Our engineering and operations team accesses systems from Pakistan, under contractual confidentiality obligations, role-based access limits, multi-factor authentication and access logging.
10. Return and deletion
On termination you can export your data for 90 days. After that we delete it, including from backups within the normal backup cycle, unless the law requires us to keep it.
11. Audit
We will make available the information reasonably needed to show we are meeting this Addendum, and respond to a security questionnaire once a year. On-site audits by arrangement, at your cost, with reasonable notice.
Questions: privacy@brimeo.io.