Voisnap

Data Processing Agreement

Last updated: October 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Torqueshift Inc., 2810 N Church St, STE 88224, Wilmington, DE 19802, USA, operator of the Voisnap and Torqueshift platforms ("Provider", "we", "us"), and the customer that uses the Service ("Customer"), and applies whenever we process Personal Data on Customer's behalf. It applies automatically, without signature, to every workspace whose use of the Service involves Personal Data; countersigned copies are available on request at legal@voisnap.ai.

The body of this DPA applies to all Customers. The regional appendices apply as follows: Appendix A where processing is subject to European Data Protection Law; Appendix B where processing is subject to US State Privacy Laws; Appendix C where processing is subject to Israeli Privacy Law. More than one appendix can apply to the same Customer.

1. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person that we process on Customer's behalf in providing the Service, as described in Annex I.
  • "Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including: (a) "European Data Protection Law" — the EU GDPR (2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and implementing laws; (b) "US State Privacy Laws" — the California Consumer Privacy Act as amended by the CPRA and other comprehensive US state privacy laws; and (c) "Israeli Privacy Law" — Israel's Protection of Privacy Law, 5741-1981 (as amended, including Amendment 13), the Protection of Privacy Regulations (Data Security), 5777-2017, and the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
  • "controller", "processor", "data subject", "processing", and "personal data breach" have the meanings given by the applicable Data Protection Laws (under Israeli Privacy Law, "controller" is read as the database owner and "processor" as the holder).
  • "SCCs" means the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914.
  • "Sub-processor" means a third party we engage to process Personal Data.

2. Roles and scope

  • Customer is the controller (or, where Customer acts for its own client, a processor with its client's authorization) of the Personal Data described in Annex I, and we are Customer's processor.
  • We remain an independent controller for account, billing, and usage data as described in our Privacy Policy; that processing is outside this DPA.
  • Each party will comply with the Data Protection Laws applicable to it. Customer is responsible for the lawfulness of the Personal Data it submits, for the required notices and consents (including call-recording notices), and for its processing instructions being lawful.

3. Processing on instructions

We will process Personal Data only on Customer's documented instructions, which consist of: the Agreement, this DPA, the configuration Customer sets in the Service (including recording, retention, redaction, residency, and integration settings), and any further written instructions the parties agree. We will inform Customer if, in our opinion, an instruction infringes applicable Data Protection Laws, and we may suspend the affected processing until the instruction is confirmed or changed. We will not sell Personal Data or process it for our own purposes.

4. Confidentiality

We ensure that persons we authorize to process Personal Data are bound by contractual or statutory confidentiality obligations and process it only as needed to provide the Service.

5. Security

We implement and maintain the technical and organizational measures described in Annex II, which take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, and which satisfy the security requirements of the applicable Data Protection Laws, including the Israeli Data Security Regulations. We may update the measures provided the protection level is not materially reduced.

6. Sub-processors

  • Customer provides general written authorization for the Sub-processors listed in Annex III and for replacements and additions made in accordance with this section.
  • We will give Customer at least 30 days' notice (by email or in the console) before adding or replacing a Sub-processor that processes Personal Data. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the period after termination.
  • We impose data-protection obligations on Sub-processors that are no less protective than this DPA, and we remain liable for their performance.

7. Assistance

  • Data subject requests. Taking into account the nature of the processing, we will assist Customer with appropriate technical and organizational measures (including the console's search, export, redaction, and deletion features) in fulfilling data subject requests for access, correction, deletion, portability, restriction, and objection. If a data subject contacts us directly, we will forward the request to Customer without undue delay and will not respond on the merits except as required by law.
  • DPIAs and consultations. We will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, taking into account the information available to us.

8. Personal data breach

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Data, and in any event within 48 hours of confirmation. The notice will describe, to the extent known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will cooperate with Customer's own notification obligations (including, where Israeli Privacy Law applies, Customer's reporting duties to the Privacy Protection Authority under the Data Security Regulations). Our notice is not an admission of fault.

9. Deletion and return

During the subscription, Customer can delete Personal Data through the Service. Upon termination, we will, at Customer's choice exercised within the export window stated in the Agreement, return Personal Data in a commonly used format and/or delete it, and we will delete remaining copies thereafter, except where law requires retention. Residual copies in encrypted backups are overwritten on the regular backup cycle and remain protected by this DPA until deleted.

10. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of penetration tests and third-party audit reports when available. Where the applicable Data Protection Laws grant Customer an audit right that cannot be satisfied by such documentation, Customer (or an independent auditor that is not our competitor) may audit our relevant processing operations no more than once per 12-month period, on at least 30 days' notice, during business hours, under confidentiality, without accessing other customers' data, and at Customer's expense.

11. International transfers

We process Personal Data in the workspace region selected by Customer (US, EU, or Israel), with the ancillary cross-region processing described in the Privacy Policy (model inference per Customer's configuration, central account administration, and support access). We will not transfer Personal Data subject to European Data Protection Law or Israeli Privacy Law outside its originating legal area except under a valid transfer mechanism described in the applicable appendix.

12. General

  • This DPA prevails over conflicting terms of the Agreement with respect to the processing of Personal Data; where an appendix conflicts with the body of this DPA, the appendix prevails for the data it covers; the SCCs prevail over everything else for the transfers they govern.
  • Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where the applicable Data Protection Laws do not permit such limitation.
  • This DPA terminates automatically when we no longer process Personal Data for Customer.

Annex I — Description of processing

  • Subject matter and nature: operation of AI voice and chat agents and related features: real-time conversation handling, speech-to-text, text-to-speech, LLM orchestration, recording and transcription (where enabled), post-conversation analysis, knowledge-base retrieval, tool and integration execution, storage, and analytics.
  • Duration: the term of the Agreement plus the deletion periods in Section 9.
  • Purpose: providing the Service to Customer as configured by Customer.
  • Data subjects: Customer's end users (callers, chat and messaging users), Customer's personnel using the Service, and other individuals whose data Customer submits.
  • Categories of data: voice audio and recordings, transcripts, chat and messaging content and identifiers (phone number, messaging account), contact details and other information disclosed in conversations, agent configurations and knowledge-base content, and conversation metadata. Where Customer operates under Section 6 of the Terms (regulated industries) with the required agreements in place, data may include health data (see the BAA), financial data, or other special categories; Customer must configure the workspace accordingly.
  • Frequency: continuous, as driven by Customer's and its end users' use.

Annex II — Technical and organizational measures

  • Encryption in transit (TLS 1.3) and at rest; application-layer AES-256-GCM encryption for credentials, access tokens, and recordings;
  • Per-tenant logical isolation; role-based access control; regional data residency (US, EU, or Israel) enforced per workspace;
  • Selective PII redaction of recordings and transcripts; configurable retention and deletion; consent-management features;
  • Least-privilege, logged, and audited personnel access; personnel confidentiality undertakings;
  • Tamper-evident audit trails; security monitoring, incident response, and breach-notification procedures;
  • Periodic penetration testing and vulnerability management; secure development practices and code review;
  • Infrastructure hosted on Google Cloud Platform with provider physical and environmental controls; encrypted backups with scheduled overwrite cycles;
  • Business continuity through managed cloud infrastructure and multi-zone regional deployments;
  • A security program aligned with the Israeli Data Security Regulations' requirements for the applicable database security level, and a SOC 2 Type II examination program underway.

Annex III — Authorized Sub-processors

  • Google Cloud Platform (cloud hosting, storage, networking) — workspace region (US / EU / Israel);
  • Google (Gemini / Vertex AI, Speech services) — AI inference, per workspace configuration;
  • OpenAI — AI inference, per workspace configuration;
  • Anthropic — AI inference, per workspace configuration;
  • ElevenLabs — text-to-speech, per workspace configuration;
  • Amazon Web Services — speech services in certain regions, per workspace configuration;
  • Twilio, Telnyx, Vonage — telephony carriage, where telephony channels are enabled;
  • Meta Platforms — WhatsApp, Messenger, and Instagram message carriage, where those channels are enabled;
  • Stripe — payment processing (controller-side billing data);
  • Twilio SendGrid — transactional email delivery.

The current list, including entity details and processing locations, is available at any time from privacy@voisnap.ai. AI and speech Sub-processors apply only to the providers enabled in Customer's workspace configuration.

Appendix A — EEA, United Kingdom, and Switzerland (GDPR)

Applies to Personal Data subject to European Data Protection Law.

  • We process such data in accordance with Article 28 GDPR, and this DPA constitutes the contract required by Article 28(3).
  • Transfers. Where Customer transfers Personal Data to us in a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two (controller → processor) or Module Three (processor → processor), as applicable; Clause 7 (docking) included; Clause 9 Option 2 (general authorization, 30 days' notice); Clause 11 optional language not used; Clause 17 governed by the law of Ireland; Clause 18 courts of Ireland. Annexes I, II, and III above serve as the SCC Annexes. For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated with the tables completed by this DPA. For Swiss transfers, the SCCs apply with the adaptations required by the FDPIC (references to the GDPR read as the FADP; supervisory authority: FDPIC).
  • Transfers from the EU to our Israeli region may additionally rely on the European Commission's adequacy decision for Israel.
  • EU-region workspaces are served from europe-southwest1 (Madrid, Spain), and workspace databases, recordings, and transcripts remain in that region.

Appendix B — United States (CCPA/CPRA and state privacy laws)

Applies to Personal Data subject to US State Privacy Laws.

  • We act as Customer's "service provider" / "processor". We will not: sell or share Personal Data (as defined by the CCPA); retain, use, or disclose it for any purpose other than performing the Service or as permitted by the CCPA; retain, use, or disclose it outside the direct business relationship with Customer; or combine it with personal information from other sources except as permitted for service providers.
  • We certify that we understand these restrictions and will comply with them, will notify Customer if we can no longer meet our obligations, and grant Customer the rights to take reasonable steps to stop and remediate unauthorized use of Personal Data.
  • We will assist Customer in responding to verifiable consumer requests (access, deletion, correction, opt-out) as described in Section 7.
  • Equivalent service-provider/processor terms apply under other comprehensive US state privacy laws (including Virginia, Colorado, Connecticut, Utah, and Texas) to the extent they govern the Personal Data.

Appendix C — Israel (Protection of Privacy Law)

Applies to Personal Data subject to Israeli Privacy Law.

  • Customer is the owner of the relevant database and we act as its holder/processor under an outsourcing arrangement. Customer is responsible for any database registration or notification duties that apply to it and for appointing a data protection officer where Amendment 13 requires one; we will provide the processor-side information reasonably needed for those duties.
  • Data security. We maintain the measures in Annex II in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, applied to the security level applicable to the database, including access management, documentation of security incidents, and periodic review. We will report security incidents affecting the database to Customer as per Section 8 and provide the details Customer needs for any report to the Privacy Protection Authority required of it.
  • Residency and transfers. Israeli-region workspaces are served from me-west1 (Tel Aviv), and workspace databases, recordings, and transcripts remain in Israel. Any transfer of data from an Israeli database abroad (for example, where Customer enables a foreign-hosted model provider) is made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including reliance on the data subject's consent, transfer to countries receiving EU-adequate protection, or the recipient's binding undertaking to apply Israeli-equivalent protections.
  • Data subject rights. We will assist Customer in honoring inspection, correction, and deletion rights under sections 13–14 of the Protection of Privacy Law within the timeframes it prescribes.
  • Processing under this Appendix is also subject to the direct-marketing and notification provisions of the Protection of Privacy Law and, for electronic messages, section 30A of the Communications Law; compliance with those provisions toward end users is Customer's responsibility, supported by the Service's consent and opt-out features.

Contact

Torqueshift Inc. (operating the Voisnap and Torqueshift platforms) · 2810 N Church St, STE 88224, Wilmington, DE 19802, USA · legal@voisnap.ai · privacy@voisnap.ai