Sonaneo Data Processing Agreement (DPA)
Last updated: October 30, 2026
This Data Processing Agreement ("DPA") forms part of the Sonaneo Terms of Service (the "Terms") between the business that subscribes to Sonaneo (the "Customer", controller) and Apphive, Inc., 2810 North Church Street, Wilmington, DE 19802, USA ("we", processor). It is accepted by accepting the Terms.
1. Subject matter and roles. The Customer is the controller of the personal data of its callers and staff that we process when providing Sonaneo ("Customer Data"), and we are its processor (Art. 28 of Regulation (EU) 2016/679, "GDPR", and equivalent laws). Annex I describes the processing. We process the Customer's contact and billing data as controller, under our privacy notice.
2. Instructions. We process Customer Data only on the Customer's documented instructions: the Terms, this DPA and the Customer's configuration in Sonaneo (knowledge, notices, retention, integrations). We'll tell the Customer if we believe an instruction breaks the law, or if the law requires other processing (unless prohibited).
3. Confidentiality. People with access to Customer Data are bound by confidentiality and access it only as needed to provide or support the service.
4. Security. We apply the measures in Annex II and may improve them without lowering the level of protection.
5. Sub-processors. The Customer authorizes the sub-processors in Annex III. We'll give 30 days' notice, by email or in the service, of any addition or change; the Customer may object on reasonable data-protection grounds and, if no solution is found, terminate the affected service with a refund of prepaid, unused amounts. Each sub-processor is bound by contract to obligations equivalent to this DPA, and we remain liable for its compliance.
6. Transfers. We provide the service from the United States. For Customer Data from the European Economic Area, the Standard Contractual Clauses of Decision (EU) 2021/914, Module Two (controller to processor), apply, incorporated by reference with the options in Annex IV; the Customer is the exporter and we are the importer, and Annexes I to III of this DPA are their annexes. For the United Kingdom and Switzerland, with the addenda or adjustments their laws require. In case of conflict, the Clauses prevail.
7. Data subject rights. We help the Customer, through the service's features and, where these aren't enough, on its request, to handle requests for access, rectification, erasure and other rights (for example, deleting all calls from a number). If a person writes to us, we'll forward the request to the Customer without answering it on the merits.
8. Personal data breaches. We'll notify the Customer without undue delay and in any case within 48 hours of becoming aware of a breach affecting Customer Data, with the information available (nature, categories and approximate number of people and records, likely consequences, measures and contact), completing it in phases. Notifying the authority and the affected people is the Customer's responsibility; we'll help. Notification is not an admission of liability.
9. Assistance. We reasonably help the Customer with impact assessments and prior consultations using the information we have. Anything beyond reasonable may be charged.
10. Audits. We'll make available the information needed to demonstrate compliance (this DPA, its annexes and written answers to reasonable security questionnaires). If that isn't enough, or an authority requires it, the Customer may audit at most once a year (or after a breach affecting its data), with 30 days' notice, preferably remotely, during business hours, without access to other customers' data or sub-processors' systems, and at its own cost.
11. End of service. On termination, the Customer may export its data or ask us for a copy within the following 30 days. We then delete it from active systems, no later than 30 days after termination, and confirm when. Backups aren't edited: data disappears from them when their cycle expires, no later than 35 days after, and meanwhile they're used only for disaster recovery. This doesn't apply to data the law requires us to keep.
12. Liability. Liability under this DPA is subject to the limits in the Terms, except where it can't be limited under the Clauses or the law. Nothing in this DPA limits data subjects' rights.
13. Term, precedence and law. This DPA lasts as long as we process Customer Data. In case of conflict, the Clauses, this DPA and the Terms prevail, in that order. Except for the Clauses, it's governed by the law of the Terms.
Annex I — Description of the processing
- Exporter (controller): the Customer, with its Sonaneo account details. Importer (processor): Apphive, Inc., 2810 North Church Street, Wilmington, DE 19802, USA; contact: hello@sonaneo.com. Activity: AI voice agents as a service.
- Data subjects: people who call the Customer (its customers, prospects and the public) and the Customer's staff who use Sonaneo.
- Data: phone number, real-time voice (not recorded), transcript, summary and what the person says in the call; data from the Customer's support inbox conversations that the assistant looks up (first name, status and topic). Sensitive data isn't sought; card numbers, passwords and health data are removed from what is stored.
- Nature and purpose: receiving and handling calls on the Customer's behalf (speech-to-text, AI replies, synthetic voice), transcribing, summarizing, following up in the Customer's inbox and providing metrics.
- Where it's stored: transcripts and summaries on our servers (Hetzner, Virginia); the summary also as a private note in the Customer's inbox in our support tool (Chatwoot, running on our servers).
- Frequency: continuous during the service.
- Retention: as configured by the Customer; by default, up to 24 months after each number's last contact; on termination, per clause 11.
- Supervisory authority: that of the exporter's Member State.
Annex II — Technical and organizational measures
- Encryption in transit: HTTPS/TLS for the website, API and dashboards; WhatsApp call media with mandatory SRTP.
- Voice isn't recorded; only the transcript and a summary are stored, with automatic masking of card numbers, passwords, health data, emails and addresses in technical logs and stored data.
- Our own servers at Hetzner (Virginia, USA); server access only for authorized staff with SSH keys; credentials in a secrets manager (AWS Secrets Manager), not in code.
- Per-customer separation: each agent uses only its customer's knowledge, number and inbox; context lookups are filtered by customer and product.
- Deletion: automatic purge 24 months after the last contact (or the Customer's period) and on-request deletion of all calls from a number.
- Daily server backup (7 days). Incident register with Customer notice within 48 hours.
- Voice and AI sub-processors configured not to use data for training where the provider allows it (Deepgram: opted out of its model improvement program).
Annex III — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers (agent, our own LiveKit, transcripts) | USA (Virginia) |
| Deepgram, Inc. | Speech-to-text | USA |
| ElevenLabs, Inc. | Assistant's synthetic voice | USA |
| Anthropic, PBC | Assistant's replies and summaries | USA |
| Meta Platforms, Inc. | WhatsApp calls and messages | USA |
| Amazon Web Services, Inc. | Email (Amazon SES) | USA |
Annex IV — Options of the Clauses (Module Two)
Clause 7: included. Clause 9(a): option 2, general authorization with 30 days' notice. Clause 11(a): no independent body. Clause 13(a): exporter's authority. Clause 17: law of Ireland. Clause 18(b): courts of Ireland. Official text: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj