Effective 2026-05-29 — Version 1.0
This Data Processing Addendum ("DPA") is incorporated into and forms part of the agreement (the "Agreement") between Customer and 7x Systems LLC (d/b/a CallVault) ("Provider", "we", "us") governing Customer's use of the CallVault service.
This DPA is built on the Common Paper Data Processing Addendum, a community-maintained open standard. We use it because it is widely understood by buyers and counsel; CallVault-specific terms are filled into the variable fields below and any deviations from the underlying standard are called out explicitly.
| Field | Value |
|---|---|
| Provider name | 7x Systems LLC (d/b/a CallVault) |
| Provider address | 1309 Coffeen Ave, Ste 17642, Sheridan, WY 82801, United States |
| Provider contact | support@callvaultai.com / +1 315-335-8779 |
| Provider Data Protection Officer | Andrew Naegele (sole principal); support@callvaultai.com |
| Effective date | The date Customer first agrees to the Agreement, or 2026-05-29, whichever is later |
| Governing law | Wyoming, United States (per the Terms of Service at callvaultai.com/terms) |
Terms used in this DPA that are not defined here have the meanings given in the Agreement or in the applicable Data Protection Laws.
Provider acts as a processor of Customer Personal Data. Customer is the controller of Customer Personal Data and is responsible for the lawful basis of processing, the accuracy and quality of the personal data, and obtaining any necessary consents from data subjects.
Provider processes Customer Personal Data:
Provider does not sell or share Customer Personal Data within the meaning of the CCPA or any other Data Protection Law.
Provider does not train any AI model on Customer Personal Data.
| Item | Detail |
|---|---|
| Nature and purpose of processing | Provision of the CallVault service — a long-term call intelligence vault for revenue teams. Storage, indexing, search, transcription enrichment, and (when invoked by Customer) AI-assisted summarization, action-item extraction, sentiment analysis, and coaching note generation. |
| Categories of data subjects | Customer's employees and contractors who use the CallVault service; participants in calls Customer ingests into CallVault; Customer's contacts. |
| Categories of personal data | Call transcripts and recording metadata; contact names, email addresses, phone numbers; calendar event metadata; authentication identifiers; derived AI outputs (summaries, action items, sentiment, coaching notes). |
| Special categories of data | Provider does not solicit special category data. Customers operating in healthcare-adjacent verticals are responsible for not ingesting Protected Health Information unless a separate Business Associate Agreement is executed; see Section 11. |
| Duration of processing | Lifetime of the Customer account, subject to Customer-initiated deletion per Section 7. |
| Frequency of transfer | Continuous, in line with Customer's use of the service. |
Customer provides general authorization for Provider to engage Subprocessors to process Customer Personal Data, subject to the requirements of this Section 4.
The current list of Subprocessors is published at callvaultai.com/trust and reproduced here as of the effective date:
| Subprocessor | Purpose | Customer data processed |
|---|---|---|
| Supabase | Database, authentication, Edge Functions | All Customer Personal Data (primary storage) |
| Vercel | Frontend hosting, edge functions, CI/CD | Request logs, deployment metadata (does not include transcript content) |
| Polar | Subscription billing of record | Billing email, subscription state |
| Stripe (via Polar) | Payment processing | Card data (Stripe-hosted Checkout iframe; never touches CallVault servers), payment receipts |
| OpenRouter | LLM routing layer for AI-tier MCP tools | Transcript text submitted at AI-tool invocation only |
| Anthropic | LLM provider (via OpenRouter) | Transcript text submitted at AI-tool invocation only |
| OpenAI | LLM provider (via OpenRouter) | Transcript text submitted at AI-tool invocation only |
Provider will provide Customer with at least 15 days' advance notice of any addition or replacement of a Subprocessor by updating the trust page at callvaultai.com/trust and (where Customer has subscribed) by email. Customer may object to a change by emailing support@callvaultai.com within the notice period. If the parties cannot reach a reasonable resolution, Customer may terminate the affected Service with proportionate refund of pre-paid fees.
Provider remains responsible for the acts and omissions of its Subprocessors as if they were its own and will enter into a written agreement with each Subprocessor containing data protection terms at least as protective as those in this DPA.
To the extent Provider's processing involves the transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country not subject to an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, as applicable, the UK International Data Transfer Addendum or the Swiss Data Protection Act provisions apply and are incorporated by reference. Provider acts as data importer; Customer as data exporter.
The applicable module is Module Two: Controller to Processor.
Provider implements the security measures described in Section 6 and the EU Standard Contractual Clauses Annex II.
Provider maintains a written information security program and implements appropriate technical and organizational measures designed to protect Customer Personal Data, including:
These measures are documented in Provider's Information Security Policy and derivative policies, available on request under NDA.
Provider requires its personnel to maintain the confidentiality of Customer Personal Data and to complete security awareness training at least annually.
If Provider receives a request from a data subject relating to Customer Personal Data (including requests for access, rectification, erasure, restriction, portability, objection, or non-automated decision-making), Provider will:
The CallVault service includes the following self-serve mechanisms that Customer can use to fulfill data subject requests directly:
delete_call MCP toollist_calls, get_transcript, list_contacts, list_folders)Customer may submit deletion or export requests on behalf of data subjects to support@callvaultai.com. Provider commits to acknowledge such requests within 2 business days and complete fulfillment within 30 days.
Provider will notify Customer of a Security Incident affecting Customer Personal Data without undue delay and in any event within 72 hours after Provider becomes aware of the incident.
The notification will include, to the extent then known:
Provider will cooperate with Customer in responding to the Security Incident, including providing reasonable assistance with Customer's notification obligations to data subjects or regulators.
Provider will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. This includes:
To the extent permitted by Provider's own infrastructure providers, Customer may request an on-site audit on 30 days' prior written notice, no more than once per twelve-month period, conducted during normal business hours and in a manner that does not unreasonably interfere with Provider's operations. The parties will agree in advance on scope, timing, and cost allocation. In lieu of an on-site audit, Provider may satisfy the audit obligation by providing the materials described in Section 9.1.
Upon termination of the Agreement, and at Customer's option, Provider will:
Provider will complete the chosen action within 30 days of the termination date. Customer Personal Data may persist in Provider's backups for the duration of the applicable backup retention window. Provider will not restore Customer Personal Data from such backups for any purpose other than disaster recovery.
CallVault is not currently offered as a HIPAA-eligible service. Customers operating in healthcare-adjacent verticals must not ingest Protected Health Information into CallVault unless and until the parties execute a separate Business Associate Agreement.
CallVault is not directed to children under the age of 13 (or the equivalent age in the applicable jurisdiction). Customer warrants that it will not knowingly submit personal data of children to the CallVault service.
For the purposes of the CCPA, Provider is a service provider and not a third party with respect to Customer Personal Data. Provider does not retain, use, sell, share, or disclose Customer Personal Data for any purpose other than the specific business purpose of providing the CallVault service.
The liability of each party arising out of or related to this DPA is subject to the limitations and exclusions set forth in the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA controls solely with respect to the processing of Customer Personal Data.
This DPA takes effect on the Effective Date and continues for the duration of the Agreement. Sections of this DPA that, by their nature, are intended to survive termination (including Sections 10 and 12) survive termination of the Agreement.
Provider may update this DPA from time to time to reflect changes in applicable law, the Subprocessor list, or Provider's processing activities. Material updates will be communicated by updating the publication URL at callvaultai.com/dpa and, where Customer has subscribed, by email. Customer's continued use of the service following a material update constitutes acceptance of the updated DPA.
Questions about this DPA, requests for an executed counterpart, or notices required under this DPA should be sent to:
7x Systems LLC
Attn: Data Protection
1309 Coffeen Ave, Ste 17642
Sheridan, WY 82801, United States
support@callvaultai.com
+1 315-335-8779
This DPA is based on the Common Paper Data Processing Addendum (v2.0), a community-maintained open standard. The Common Paper text is licensed under Creative Commons CC-BY-4.0. CallVault-specific facts have been inserted into the variable fields; no substantive deviations from the underlying standard have been made.
Effective date: 2026-05-29 | Version 1.0