Trust
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Stephens Quantum LLC ("Processor", "we") and the business using CallRoom Pro ("Controller", "you"). It applies whenever we process personal data on your behalf.
1. Roles
You are the controller of the personal data about your leads and customers that you, your team or your website collect in CallRoom Pro ("Customer Personal Data"). We are your processor. You decide what data is collected and why; we process it only to provide the service.
2. Our commitments
- Instructions. We process Customer Personal Data only on your documented instructions (these terms, your configuration of the product and your actions in it), unless the law requires otherwise, in which case we'll tell you unless prohibited.
- Confidentiality. Our personnel with access are bound by confidentiality.
- Security. We maintain the measures in section 6.
- Subprocessors. We use only the subprocessors listed below and will give at least 14 days' notice before adding or replacing one, so you can object.
- Assistance. We help you respond to individuals' requests (access, correction, deletion, portability, objection) through product tools such as per-customer erasure and full data export, and with reasonable additional help.
- Breach notice. We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need.
- Support access. You authorise our personnel to access your room and Customer Personal Data to provide the service, to give support and Concierge help, and to investigate errors, security and abuse. Each platform administrator visit to your room is time-limited and recorded in our own audit log. Concierge and support requests, with their files and comments, can be read by our staff and engineers, including through a read-only view.
- Deletion and return. You can export your data at any time. After your account ends we delete Customer Personal Data from live systems after the retention period in the Terms, and backups roll off within 14 days.
- Audits. We make available information reasonably necessary to demonstrate compliance and allow reasonable audits (no more than once a year, on 30 days' notice, at your cost).
3. Your commitments
- You own your leads and customer data and are solely responsible for it: where it came from, your legal right to contact each person, and having any required notices and consents for the data you collect and for the calls, texts, emails and advertising you carry out. We do not check your lead sources.
- You are responsible for call recording and monitoring consent. Get every consent the law requires before you record or monitor a call.
- You are responsible for complying with the TCPA, do-not-call lists, the CAN-SPAM Act, state telemarketing laws and other consent laws, and with any laws that govern your industry's advertising, disclosures and fees (for vacation and getaway offers, these may include state-specific disclosure, fee and registration rules; ask your own counsel).
- You configure roles, masking and session settings appropriately for your team.
- You are responsible for the notice your signing page shows and for any consent the law requires before you collect a signer's IP address, location, device details or fingerprint. The notice is on by default for new rooms and you can edit it.
- You choose who receives the emails you automate (flows, info emails, offers, invitations) and what they say, and you must have the legal right to send them. You must keep your info email webhook token and customers' personal offer links confidential and replace the token if it may have been exposed; anyone holding them can use them.
- You will not enter card numbers, security codes or other sensitive data into the AI rebuttal generator, you will treat its output as a draft to be reviewed, and you will not use it to generate promises, guarantees or statements that are false or that the law does not allow.
- Photos and files you publish or share by link can be seen by anyone with the link. Upload only what you have the right to publish.
- You are responsible for the accuracy of company facts and team members' names you publish, and you must have each person's permission to list them. Published pages, and the markup and summary files generated from them, are public and may be copied by search engines, AI tools and others; your crawler preferences are requests that not every crawler honours.
We process your data only as a software provider. We are not responsible for how you obtain, contact or use leads, or for your sales practices or disputes with your customers (see sections 6 to 8 and 15 of the Terms).
4. Details of processing
| Subject matter | Hosting and processing of Customer Personal Data to provide CallRoom Pro. |
|---|---|
| Duration | The term of your subscription plus the post-termination retention period. |
| Data subjects | Your leads and customers, website visitors who submit forms, and your staff users. |
| Categories of data | Contact details; details you record about the matter being discussed; call notes and outcomes; callbacks; deal records; website inquiries with consent wording, IP address and browser; do-not-call status; automation and template emails the Customer sends from its website (recipient, subject, content, send time and delivery result) and the progress of each customer through an automation flow; personal offer-page views (time, offer shown, browser type); staff names, emails and roles for invitations; photos and files the Customer uploads; company facts the Customer chooses to publish (legal name, registration and license wording, year started, names and titles of listed team members, profile links) with an internal log of who saved them, when and from which IP address; in-app notification text (sender name and the start of a message); email correspondence sent to the Customer's own connected domain (sender name and address, subject, plain-text body, sender-check results, and attachments that pass safety checks); signing records and agreement-signing records (server times, IP address and approximate location, device and browser details and fingerprint hash, document viewing activity, signature, email delivery events and, if the signer shares it, precise browser location). |
| AI rebuttal generator | If a user of the Customer's room uses it, the objection text they type (with card numbers, security codes, emails, phone numbers and ID numbers removed first), the objection type, and for a chosen lead only its resort, state and up to three recent non-private notes are sent to the AI subprocessor to generate suggested wording. The lead's name, phone number, email and address are not sent. The typed text and the generated suggestions are stored in the Customer's room; usage counts and refused-request excerpts are kept in our platform records. |
| Sensitive data | Not intended. CallRoom Pro does not process payments. For cards recorded on deals it stores only the card brand, last 4 digits, expiry and a reference to the Customer's own Authorize.net record (plus name on card and billing address where entered), never the full number or security code. Cards are entered into Authorize.net's secure card window and processed and stored only in the Customer's own Authorize.net account; the Customer is responsible for its own PCI DSS compliance and merchant relationship. As a safety net, CallRoom Pro also masks card-like numbers typed into notes and other free-text fields when they are saved (keeping only the last 4 digits), but please never type a card number or security code into notes or any other field. Don't store government ID numbers or health information. |
5. Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. (virtual private server) | Application and database hosting, encrypted backups | United States |
| Resend, Inc. (email delivery) | Invitations, password resets, signed agreement copies, billing and plan notices, contract, automation, offer and notification emails sent from a Customer's website. Email that people send to a Customer's connected domain is not handled by Resend: it is received on our own servers | United States |
| Stripe, Inc. (subscription billing) | Billing for the CallRoom Pro subscription only. It receives no Customer Personal Data about your leads or customers. Card saving for deals uses the Customer's own Authorize.net account, which is the Customer's own provider, not our subprocessor | United States |
| xAI (AI rebuttal generator) | Receives the cleaned objection text, objection type and limited lead context described in section 4, only when a user of the Customer's room uses the AI rebuttal generator. Per xAI's published terms it does not train on API inputs or outputs without explicit permission and retains API requests for up to 30 days for abuse review | United States |
6. Security measures
- Each room's data separated by database row-level security, not only application code.
- Role-based access; closed deals restricted to room admins and customer support; contact details masked for roles that don't need them.
- Encrypted connections (HTTPS); passwords hashed with a modern algorithm; rate-limited sign-in.
- Configurable idle and absolute session timeouts; sign-in history; one-click sign-out of all sessions.
- Append-only audit log of significant actions, including every view of a closed deal and every data export.
- Nightly database backups encrypted at rest with a separately held key, kept 14 days.
- Least-privilege runtime database account; secrets kept outside source control.
7. International transfers
We host in the United States. Where Customer Personal Data is transferred from the EEA, UK or Switzerland, the parties agree to the standard contractual clauses that apply to that transfer, incorporated by reference, with you as the exporter and us as the importer.
8. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms regarding personal data, this DPA prevails.