Data Processing Addendum

This Data Processing Addendum (“Addendum”) is part of the Terms of Service between Rivet Solutions LLC, a Wyoming limited liability company (“Rivet”, “we”), and the business that uses Rivet to answer its phone (“you”). It takes effect when the Terms do.

When somebody calls your business and Rivet answers, the caller is your customer. You decide why their information is collected and what happens to it; we handle it for you. In the language of the state privacy laws, you are the “business” or “controller”, and Rivet is your “service provider” or “processor”.

Call Data — the personal information in calls to the line you forward to Rivet that we process on your behalf: the call audio, the transcript, the details a caller gives to book (name, callback number, service address, what is wrong, the window they chose), the caller ID and the time and length of the call, a caller’s stated preferences (their language, and whether they declined recording), and the appointment we put on your calendar or send you.

Subprocessor — a vendor we use to provide the service that processes Call Data for us.

Words like “personal information”, “sell”, “share”, “business purpose” and “deidentified” mean what they mean in the law that applies to the data in question (see section 12).

This Addendum does not cover:

• Your own account, contact and billing details. Rivet handles those as its own business, under the Privacy Policy.
• Calls between Rivet’s independent sales partners and business owners. There Rivet is the responsible business, not anyone’s service provider (Privacy Policy §1).
• Anything outside the United States. We do not offer the service in the European Economic Area or the United Kingdom, so this Addendum contains no cross-border transfer clauses.

The service is not built for health, financial-account or payment-card information. The Terms prohibit using it for medical, legal or financial-advisory intake, and the assistant refuses card numbers outright.

We process Call Data only on your documented instructions. Your instructions are the Terms, this Addendum, and the choices you make in your account: your greeting, hours, services and prices, service area, the calendar you connect, and the numbers that get alerts. Changing a setting changes the instruction.

If we believe an instruction would break the law, we will tell you and we will not carry it out. Some things are not instructions you can give, because the service cannot do them lawfully or at all: switching off the AI and recording notice, placing outbound calls to your customers, or using call content to train an AI model.

Two instructions you give us by agreeing to this Addendum: when a caller asks us directly to delete the recording of their own call, we delete it and tell you (this is what the Call Recording & AI Notice promises callers); and when a caller asks not to be recorded, we honour that on their future calls to your line.

If a law, court order or subpoena requires us to disclose Call Data, we will tell you before we do, unless the law forbids us to, and we will disclose no more than it requires.

The only purposes for which we process Call Data are providing the service to you, keeping it secure and working, billing you accurately, and meeting our own legal obligations. Specifically, we will not:

• sell or share it. Not for money, not for anything else of value, and not for cross-context behavioral advertising.
• retain, use or disclose it for any other purpose — including any commercial purpose of our own — than the business purposes in this section.
• retain, use or disclose it outside our direct business relationship with you. Your callers’ information is not a Rivet asset, and it does not follow a caller to another business.

We do not use Call Data to train, fine-tune or evaluate AI models — ours or anyone else’s — and we do not create voiceprints or any other biometric identifier from a caller’s voice (see 740 ILCS 14/15). Speaker labels in a transcript come from separate audio channels, never from analysis of a voice. These are not settings; there is no tier or instruction that turns them on.

If we ever determine that we can no longer meet an obligation in this Addendum, we will tell you promptly. You may then take reasonable and appropriate steps to stop and fix any use of Call Data you have not authorised, including suspending or ending the service.

We do not combine Call Data with personal information we receive from or on behalf of anyone else, or collect from our own dealings with a person — including other contractors’ Call Data and the data from Rivet’s own sales calls — except where the regulations expressly allow a service provider to do so, such as to detect security incidents or protect against fraud or illegal activity (Cal. Code Regs. tit. 11, §7050).

In practice: someone who calls two businesses that use Rivet is two unrelated records in two separate accounts. A preference they state to one — their language, or that they do not want to be recorded — is remembered for that business only. Every account is walled off from every other at the database level, not just in application code.

Counts about how the service runs — how many calls, how many minutes, how often the assistant escalated — are how we bill you and keep the system healthy. Where such a figure cannot reasonably be linked to a caller, to you or to your business, we treat it as deidentified information (Cal. Civ. Code §1798.140(m)): we take reasonable steps to keep it that way, we commit here not to try to reidentify it, and anyone we share it with must make the same commitment. We never build a dataset out of call content.

We use the vendors named in the Privacy Policy. Those that process Call Data do so only to provide their service to us, under a written contract that holds them to obligations at least as protective as this Addendum, and none of them trains AI models on it. We are responsible to you for what they do with it.

• Telephony and text messaging — carrying the call and the texts we send you.
• OpenAI (through its API) — the AI that answers, speaks, understands and transcribes the call and drafts the summary. It does not use API data to train its models, and we send every request with storage switched off. Its standard API retention still applies: it may keep request data for a limited period, generally up to 30 days, to detect abuse, and then deletes it.
• Cloud hosting and database, including where recordings are stored — in the United States.
• Email delivery — the booking notices and calendar files we email you.
• Google Calendar or Microsoft Graph — only if you connect one, and only to check your availability and write the appointment you asked us to book.

Two vendors the Privacy Policy names do not receive Call Data: Deepgram transcribes Rivet’s own sales calls only, and our payment processor sees your billing details, not your callers.

Before a new subprocessor starts processing Call Data we will give you notice by email and in the app, and you may object on reasonable grounds. If we cannot resolve the objection, you may cancel before the change takes effect — cancelling is one click and there is no fee.

We maintain security measures appropriate to the nature of Call Data, including:

• Every row of customer data is isolated per account at the database level, not just in application code.
• Before a transcript is stored we automatically remove payment card numbers, Social Security numbers, and bank routing and account numbers.
• Third-party tokens, such as a connected calendar, are encrypted at the application layer with a key held outside the database.
• Access to production data is limited to the people who need it, and administrative actions are logged with a required reason.
• We never email a full transcript. Emails link to it behind a login.

Everyone at Rivet who can access Call Data is bound by a duty of confidentiality, and uses it only as this Addendum allows.

If we confirm a security incident that affects your Call Data, we will notify you without unreasonable delay and within 72 hours of confirming it. The notice will say what happened, what data was involved as far as we know it, what we have done about it, and who to talk to; we will add to it as we learn more.

We will help you meet the notice duties that fall on you as the owner of the data — state breach laws require a service provider to tell the data owner promptly (for example, Cal. Civ. Code §1798.82(b)) and leave notifying the affected people to the owner. We will not notify your callers or a regulator on your behalf unless you ask us to or the law requires it.

If a caller asks us to see, correct or delete their information, we send the request to you and help you answer it, except that we delete a caller’s own recording when they ask (section 3). Most of what you need is self-serve in your account; anything that is not, we will do for you on request.

We will also give you the information you reasonably need to meet your own obligations under the laws in section 12, including for a data protection assessment.

While your account is open, Call Data is deleted on the retention schedule in the Privacy Policy.

When your account closes, we delete Call Data within 30 days and will confirm it in writing if you ask. If you would rather have it back, ask us before you close and we will send you your recordings, transcripts and booking records in a commonly used format first.

The one exception is anything the law requires us to keep — for example, evidence that the recording notice was given. We keep that only for as long as the law requires, use it only for that purpose, and hold it under this Addendum until it is deleted.

Once a year, or after an incident that affected your Call Data, you may ask us to show that we are keeping this Addendum. We will answer a reasonable written questionnaire and give you the information needed to demonstrate compliance.

If that is not enough, you may have a qualified, independent assessor review our compliance, at your cost, on 30 days’ written notice, during business hours, under a duty of confidentiality, and without access to other customers’ data. Instead, we may arrange for a qualified, independent assessor to perform the review and give you the report.

Several state privacy laws require a contract like this one to contain particular terms. We intend this Addendum to meet each of them, and where one of them requires a term that is not spelled out above, it is part of this Addendum as if it were:

• California (CCPA, as amended by the CPRA): Cal. Civ. Code §§1798.100(d), 1798.140(ag) and 1798.140(m); Cal. Code Regs. tit. 11, §§7050–7051.
• Virginia: Va. Code Ann. §59.1-579.
• Colorado: Colo. Rev. Stat. §6-1-1305.
• Connecticut: Conn. Gen. Stat. §42-521.
• Utah: Utah Code Ann. §13-61-301.
• Texas: Tex. Bus. & Com. Code §541.104.
• The equivalent processor provisions of any other state consumer-privacy law that applies to Call Data.

Many of these laws apply only above a size threshold that a small contracting business may never reach. We follow this Addendum for every customer regardless.

If this Addendum and the Terms disagree about Call Data, this Addendum wins. Anything it does not address is governed by the Terms, including how either of us can end the agreement and how changes are made: we will give at least 30 days’ notice of a material change, and you may cancel before it takes effect. Our obligations here last for as long as we hold any of your Call Data, including after your account closes.

Rivet Solutions LLC · privacy@rivet.llc

By post: Rivet Solutions LLC, c/o Republic Registered Agent LLC, 5830 E 2nd St, Ste 7000, Casper, WY 82609.

Open items for counsel: whether any state listed in section 12 requires its service-provider language restated verbatim rather than cited; the complete list of states, and each citation, as of launch (Oregon, Montana, Iowa, Delaware, New Jersey, Tennessee, Indiana, Kentucky, Minnesota, Maryland and any enacted since); the named subprocessor list, the notice period for a new subprocessor and whether a right to object is sufficient without a right to terminate for cause; how liability under this Addendum sits with the cap in Terms §11; reconciling the Privacy Policy’s “everything purged within 30 days” with its longer rows for booking and consent records; whether Terms §10’s ownership of what Rivet “learns in aggregate” needs narrowing to match section 5; and whether this Addendum should be signed separately by customers who ask for a countersigned copy.