Skip to main content
IntakeNexus
Sign In

Data Processing Addendum

Effective Date: October 13, 2026

This Data Processing Addendum ("DPA") forms part of the IntakeNexus Terms of Service (the "Agreement") between IntakeNexus, Inc. ("IntakeNexus," "we," "us") and the customer that accepts the Agreement ("Customer," "you"). It governs our processing of Customer Personal Data and is incorporated into the Agreement by reference; accepting the Agreement accepts this DPA. In the event of a conflict between this DPA and the Agreement with respect to the processing of Customer Personal Data, this DPA controls.

1. Definitions

  • "Customer Personal Data" means personal data or personal information relating to your customers, leads, callers, message senders, and website visitors that IntakeNexus processes on your behalf in providing the Service.
  • "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data, including the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
  • "Sub-processor" means a third party engaged by IntakeNexus to process Customer Personal Data in support of the Service.
  • The terms "controller," "processor," "data subject," and "processing" have the meanings given in the GDPR; "business," "service provider," "sell," and "share" have the meanings given in the CCPA.

2. Roles and Scope

As between the parties, Customer is the controller (or business) of Customer Personal Data and IntakeNexus is the processor (or service provider). Customer is responsible for the lawfulness of the Customer Personal Data it collects and submits to the Service — including providing any notices and obtaining any consents its own customers are owed. IntakeNexus processes Customer Personal Data only on Customer's documented instructions, which are: the Agreement, this DPA, and Customer's configuration and use of the Service. We will inform you if, in our opinion, an instruction infringes Data Protection Laws.

3. Details of Processing

  • Nature and purpose: operating an AI-assisted intake and messaging platform — receiving and responding to calls, messages, chats, and form submissions; extracting and organizing lead details; scheduling appointments; generating quotes and follow-ups; and the related analytics, storage, and support described in the Agreement.
  • Categories of data subjects: Customer's customers, prospective customers, callers, message senders, website visitors, and staff whose details appear in conversations.
  • Categories of personal data: names, phone numbers, email addresses, service addresses, the content of conversations and call transcripts, appointment and service details, and any other personal data data subjects choose to share during an interaction. Callers may incidentally disclose sensitive information (for example, health-related details); the Service treats all call content as potentially sensitive as described in the Privacy Policy.
  • Duration: the term of the Agreement plus the post-termination window in Section 9.

4. Processor Obligations (GDPR Article 28)

IntakeNexus will:

  • process Customer Personal Data only on documented instructions as set out in Section 2, including with regard to international transfers;
  • ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations;
  • implement and maintain the technical and organizational measures described in Section 7;
  • respect the conditions in Sections 6 for engaging Sub-processors, and impose data-protection obligations on them no less protective than this DPA;
  • taking into account the nature of the processing, assist Customer with data-subject requests (access, correction, deletion, portability) through the Service's built-in export and erasure tooling and, where that is insufficient, on request to privacy@intakenexus.com;
  • assist Customer in meeting its obligations regarding security, breach notification, and data protection impact assessments, taking into account the information available to us;
  • notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably required for Customer's own notification obligations as it becomes available;
  • delete or return Customer Personal Data at the end of the engagement as set out in Section 9; and
  • make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in Section 8.

5. CCPA/CPRA Service Provider Terms

To the extent Customer Personal Data includes personal information of California residents, IntakeNexus acts as Customer's service provider and:

  • will not sell the personal information or share it for cross-context behavioral advertising;
  • will not retain, use, or disclose it for any purpose other than providing the Service (including the business purposes enumerated in the CCPA), or outside the direct business relationship between the parties, except as permitted by the CCPA;
  • will not combine it with personal information received from other sources, except as permitted for service providers;
  • will impose equivalent restrictions on any Sub-processor handling the personal information;
  • certifies that it understands the restrictions in this Section and will comply with them, and will notify Customer if it can no longer meet its obligations under the CCPA — upon which Customer may take reasonable steps to stop and remediate unauthorized use; and
  • grants Customer the right to take the reasonable and appropriate steps contemplated by the CCPA to ensure that IntakeNexus uses the personal information consistently with Customer's obligations.

IntakeNexus does not use Customer Personal Data to train machine-learning models. We send it to OpenAI and Anthropic through their business APIs, whose terms do not permit use of API data for model training by default, and every transcription request to Deepgram carries its opt-out from model improvement. For speech synthesis, ElevenLabs receives the assistant's reply text; IntakeNexus will apply the most protective data-use settings available on its ElevenLabs account, and does not represent that ElevenLabs processes that text in a zero-retention mode.

6. Sub-processors

Customer provides general authorization for IntakeNexus to engage the Sub-processors listed in Privacy Policy Section 3.1 ("Third-Party Data Processors"), which identifies each Sub-processor, its purpose, and the data it processes. That table is the authoritative, current list. We will update it before adding or replacing a Sub-processor; if Customer reasonably objects to a change on data-protection grounds and no resolution is found, Customer may terminate the affected portion of the Service under the Agreement's termination terms. IntakeNexus will have written terms in place with each Sub-processor before it processes Customer Personal Data — a data processing agreement or the Sub-processor's standard data processing terms — imposing data-protection obligations no less protective than this DPA, and remains responsible for its Sub-processors' performance under this DPA. Integrations Customer chooses to connect under its own accounts (Privacy Policy Section 3.2) are not Sub-processors; data sent to them at Customer's direction is governed by Customer's agreement with that provider. Nor are the optional services listed in Privacy Policy Section 3.3, such as Meta's Messenger and Instagram platforms, which handle data under their own terms as independent businesses; Customer decides whether to enable them and is responsible for any notice or consent its own customers are owed for that use.

7. Security Measures

IntakeNexus implements and maintains appropriate technical and organizational measures for the risk presented, as described in Privacy Policy Section 5, including: encryption in transit (TLS); encryption at rest (AES-256-GCM) for personal-data fields, call transcripts, and message content to the extent stated there; multi-tenant isolation through application-level tenant scoping of database queries, with database row-level-security policies for the same boundary deployed and tested but not yet an enforcing layer (as Privacy Policy Section 5 explains); webhook signature verification for third-party integrations; role-based access controls; audit logging with tamper-evident hash chaining; and documented incident-response and breach-notification runbooks. We may improve these measures over time and will not materially reduce the overall protection of Customer Personal Data during a subscription term.

8. Audits

Upon written request no more than once per twelve-month period (or following a personal data breach affecting Customer Personal Data), IntakeNexus will make available information reasonably necessary to demonstrate compliance with this DPA — security documentation, sub-processor terms summaries, and written responses to reasonable security questionnaires. Where Data Protection Laws grant Customer a mandatory audit right that cannot be satisfied this way, an audit may be conducted on at least 30 days' notice, during business hours, no more than once annually, under confidentiality, at Customer's expense, and without access to other customers' data.

9. Deletion and Return

During the term, Customer can export Customer Personal Data and execute verified deletion requests through the Service's compliance tooling. Following termination of the Agreement, or the end of Customer's paid plan or free trial without renewal or conversion to a paid plan, IntakeNexus keeps Customer Personal Data for 90 days so that Customer can request an export (as disclosed in the Privacy Policy). Within 30 days after that window ends, IntakeNexus will delete Customer Personal Data or de-identify it so that it no longer identifies individuals — except where retention is required by law or falls within the retained categories disclosed in the Privacy Policy (invoices and payment records, consent and opt-out records, signed authorizations and the minimum related records needed to keep them meaningful, privacy-request records, audit logs, and encrypted backups until they expire), which remain protected under this DPA until destroyed.

10. International Transfers

IntakeNexus stores Customer Personal Data in the United States. Some Sub-processors may process it in other countries where they or their own sub-processors operate, under the terms described in Section 6. Where the GDPR applies to a transfer from the EEA, the United Kingdom, or Switzerland, the parties incorporate by reference the EU Standard Contractual Clauses (Module Two: Controller to Processor), with IntakeNexus as data importer and Customer as data exporter, completed with the processing details in Section 3, the security measures in Section 7, and the Sub-processor list in Section 6 (including the UK Addendum and Swiss adaptations where applicable).

11. Liability and Order of Precedence

Each party's liability under this DPA is subject to the limitations of liability in the Agreement. This DPA supersedes any conflicting privacy or data-processing terms previously agreed between the parties with respect to Customer Personal Data.

12. Contact

Questions about this DPA, requests for a countersigned copy, and data-protection inquiries:

IntakeNexus, Inc.
Email: privacy@intakenexus.com