Processor commitments for EarlyBird AI

EarlyBird AI - Data Processing Addendum Version 2.3 (document id EB-DPA-2.3). Effective November 8, 2025. Last updated October 29, 2026. This Data Processing Addendum ("DPA") is effective as of November 8, 2025, was last updated on October 29, 2026, and is entered into between EarlyBird AI, LLC ("EarlyBird") and the customer that has accepted the EarlyBird AI Terms of Service (the "Customer"). This DPA is incorporated into and forms part of the Terms of Service available at oneearlybird.ai/legal/tos (the "Agreement") and applies to EarlyBird's processing of Customer Content on Customer's behalf. It applies identically whether Customer's account is billed by EarlyBird or by a Partner under Section 21 of the Agreement. 1. Definitions. a. "Applicable Data Protection Laws" means the privacy and data protection laws that apply to the processing of Customer Content under the Agreement, including as applicable the California Consumer Privacy Act as amended ("CCPA"), the Virginia Consumer Data Protection Act, and other United States state privacy laws. b. "Customer Content" has the meaning given in the Agreement and, for purposes of this DPA, includes the personal information within it. c. "Processing" means any operation performed on personal information, and "process" is construed accordingly. d. "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Customer Content processed by EarlyBird. e. "Subprocessor" means a third party engaged by EarlyBird to process Customer Content on EarlyBird's behalf. f. "Partner" has the meaning given in the Agreement: an independent company approved by EarlyBird to resell access to the Service and to bill the businesses it introduces. 2. Roles And Scope. Customer is the controller of, or the business with respect to, Customer Content; EarlyBird processes Customer Content as Customer's processor or service provider. Each party will comply with its own obligations under Applicable Data Protection Laws. The subject matter, duration, nature, and purposes of processing and the categories of personal information and of individuals are described in Annex A. A Partner is not a party to this DPA, is not a Subprocessor, and is not a processor or service provider of Customer: EarlyBird discloses no Customer Content to any Partner, a Partner has no access to Customer's account, and a Partner cannot give EarlyBird instructions about Customer Content. The account-level billing information EarlyBird shares with a Partner under Section 21(g) of the Agreement is Account Data processed by EarlyBird as a controller and described in Section 14 of the Privacy Policy; it is not Customer Content and is not within the scope of this DPA. 3. Instructions. EarlyBird will process Customer Content only on Customer's documented instructions, which consist of the Agreement, this DPA, Customer's configuration of the Service, and instructions given through the Service's features, unless processing is required by law, in which case EarlyBird will inform Customer unless legally prohibited. EarlyBird will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws. Instructions come from Customer alone; a request from a Partner concerning Customer Content is not an instruction and will not be acted on. 4. Service Provider Commitments. EarlyBird will not: (a) sell Customer Content or share it for cross-context behavioral advertising; (b) retain, use, or disclose Customer Content for any purpose other than providing the Service under the Agreement, as permitted for service providers under Applicable Data Protection Laws, or as required by law; (c) retain, use, or disclose Customer Content outside the direct business relationship between the parties; or (d) combine Customer Content with personal information from other sources except as permitted for service providers under Applicable Data Protection Laws. EarlyBird certifies that it understands and will comply with these restrictions, and will notify Customer if it determines it can no longer meet its obligations under Applicable Data Protection Laws. Customer may take reasonable and appropriate steps described in this DPA to ensure EarlyBird's use of Customer Content is consistent with Customer's obligations and may, upon reasonable notice, require EarlyBird to stop and remediate unauthorized use. 5. Confidentiality. EarlyBird ensures that personnel authorized to process Customer Content are bound by written or statutory confidentiality obligations. 6. Security. EarlyBird will maintain appropriate technical and organizational measures designed to protect Customer Content, including at least the measures described in Annex B. EarlyBird may update those measures from time to time, provided the updates do not materially reduce the overall protection of Customer Content. 7. Subprocessors. a. Authorization and list. Customer generally authorizes EarlyBird to engage the Subprocessors listed in Exhibit 1. EarlyBird will maintain the current Subprocessor list at oneearlybird.ai/legal/dpa. b. Changes. EarlyBird will provide notice of a new Subprocessor (by updating the list and by email or in-product notice) at least 15 days before the new Subprocessor processes Customer Content, except where earlier engagement is reasonably necessary to maintain the Service, in which case notice will be given as soon as practicable. Customer may object in writing on reasonable data protection grounds within 15 days of notice; the parties will discuss in good faith, and if EarlyBird cannot reasonably accommodate the objection, Customer may terminate the affected portion of the Service and receive a pro rata refund of prepaid, unused fees for it (for a Partner-Billed Account, any such refund is a matter between Customer and its Partner, as Section 21(e) of the Agreement provides). c. Flow-down and liability. EarlyBird will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA to the extent applicable to the services the Subprocessor provides, and EarlyBird remains responsible for each Subprocessor's performance. 8. Assistance. a. Individual requests. Taking into account the nature of the processing, EarlyBird will assist Customer by appropriate technical and organizational measures (including the export, deletion, consent, and opt-out capabilities of the Service) in fulfilling Customer's obligation to respond to requests from individuals to exercise their rights. If EarlyBird receives such a request directly and can identify the relevant Customer, EarlyBird will forward the request to Customer without undue delay and will not respond substantively except to direct the individual to Customer, unless required by law. EarlyBird will not forward such a request to, or involve, a Partner. b. Security Incidents. EarlyBird will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident, and will provide information reasonably available to EarlyBird about its nature, the categories and approximate volume of affected data, measures taken, and recommended steps, supplementing the notice as information becomes available. EarlyBird's notice is not an admission of fault. Notice is given to Customer directly, not to a Partner. c. Assessments. EarlyBird will provide reasonable assistance with data protection assessments and regulator consultations required of Customer under Applicable Data Protection Laws, to the extent they concern EarlyBird's processing. 9. Deletion And Return. The retention, export, and deletion of Customer Content are governed by Section 12 of the Agreement. Upon account closure and verified request, EarlyBird will delete Customer Content from active systems within 30 days, subject to the compliance, audit, financial, and legal-hold retention described in the Agreement, with residual backup copies purged on routine cycles not exceeding 35 days. Upon written request, EarlyBird will confirm deletion in writing. Only Customer may request closure, export, or deletion; a Partner cannot. 10. Audits And Information. Upon written request no more than once per 12-month period (and additionally following a Security Incident affecting Customer), EarlyBird will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of security practices, policies, and any third-party assessments or reports EarlyBird holds at the time. EarlyBird does not currently hold SOC 2 Type 2 certification. Where Applicable Data Protection Laws grant Customer a mandatory audit right that cannot be satisfied by documentation, the parties will agree on the scope, timing, duration, and confidentiality of a remote or on-site review, conducted at Customer's expense, during business hours, no more than annually, and without access to other customers' data. 11. Processing Location. EarlyBird stores Customer Content exclusively within the United States. EarlyBird and its Subprocessors process Customer Content primarily within the United States, as described in Exhibit 1. 12. General. This DPA is effective for as long as EarlyBird processes Customer Content, notwithstanding expiration or termination of the Agreement. In the event of a conflict between this DPA and the Agreement with respect to the processing of Customer Content, this DPA controls. Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement. If any provision of this DPA is held invalid, the remainder remains in effect. Exhibit 1 - Subprocessors The Subprocessors below process Customer Content to provide the Service. Each entry states the Subprocessor's principal processing location. 1. Amazon Web Services, Inc. - Cloud infrastructure: compute, storage, databases, encryption and key management, logging, and identity; AI model inference through Amazon Bedrock; speech-to-text through Amazon Transcribe; SMS delivery through AWS End User Messaging; email delivery through Amazon Simple Email Service; push notification delivery through Amazon Simple Notification Service; business address lookup through Amazon Location Service. Data: all categories of Customer Content described in Annex A. Location: United States. 2. Twilio Inc. - Telephony carrier services, telephone number provisioning, live call audio transport, and call recording. Data: telephone numbers, call metadata, call audio, and recordings. Location: United States. 3. ElevenLabs Inc. - Speech recognition, end-of-turn detection, and speech synthesis during calls, configured for zero retention. Data: live call audio, the text of replies to be spoken, and the greeting configured for the business; transcripts are produced in real time and are not retained by ElevenLabs. Location: United States; processing may also occur in ElevenLabs' other regions. 4. Anthropic, PBC - Large language model inference during calls and for post-call processing, engaged through Amazon Bedrock. Data: call transcripts and business configuration used in agent prompts. Location: United States. 5. Stripe, Inc. - Payment processing, invoicing, and billing operations. Data: billing contact details and transaction data for Customer (not caller payment cards, which EarlyBird does not collect). Location: United States. 6. Vercel Inc. - Hosting and delivery of the web applications. Data: web session and request data. Location: United States, with a global edge network for web delivery. 7. Google LLC - Google Analytics (website usage analytics for EarlyBird's websites, configured without Google advertising features) and Google Workspace (EarlyBird business email and support correspondence). Data: website usage data; the content of correspondence sent to EarlyBird mailboxes. Location: United States. 8. Apple Inc. - Delivery of push notifications to Apple devices. Data: device push tokens and notification content. Location: United States. Third-party services that Customer connects to its account (for example Google Calendar, Microsoft 365, HubSpot, Salesforce, Pipedrive, Zoho CRM, Slack, GoHighLevel, Jobber, Follow Up Boss, Wealthbox, Calendly, and Acuity Scheduling) are independent services authorized by Customer, not Subprocessors of EarlyBird. Partners in the EarlyBird Partner Program are independent resellers that receive no Customer Content and are not Subprocessors of EarlyBird. Annex A - Description Of Processing a. Subject matter and duration. Provision of the EarlyBird AI virtual receptionist service for the term of the Agreement, plus the retention periods described in Section 12 of the Agreement. b. Nature and purposes. Answering, routing, and recording telephone calls; transcription and AI-generated summaries and caller profiles; appointment and reservation management; SMS and email notifications; outbound communications configured by Customer; consent and compliance record-keeping; billing; security; and support. c. Categories of individuals. Customer's users and staff; Customer's callers, contacts, clients, and prospective clients. d. Categories of personal information. Names; telephone numbers; email addresses; call audio, recordings, and voicemail; transcripts; call metadata; booking and reservation details; message logs; food orders; consent and opt-out records (which may include IP address and user agent); automated call summaries and caller profiles, which may include occupation, preferences, dietary restrictions, vehicles, property or access notes, and interaction history as shared by callers; and business configuration containing staff details. Annex B - Security Measures a. Encryption in transit (TLS) and at rest across storage systems. b. Storage dedicated to each business profile for call recordings and transcripts, encrypted with an AWS KMS key created for that business profile alone, whose policy refuses any other business profile's identity; database storage, including call records, encrypted with AWS KMS keys that EarlyBird creates and governs, with automatic key rotation. c. Isolation between customers enforced through per-workspace and per-business-profile access roles with attribute-tagged sessions. d. Authorization through a policy engine that fails closed on unmapped routes; least-privilege OAuth scopes for Customer-connected integrations. e. Webhook authentication, including signature validation for telephony events and HMAC verification for voice AI events. f. Append-only audit logging, including an authentication and session audit trail written to write-once storage, and automated masking of telephone numbers and email addresses in operational logs. g. Secrets held in managed secret stores; no storage of full payment card numbers. h. Personnel access controls, background infrastructure managed by AWS, and incident response procedures supporting the notification commitments in Section 8(b). i. Separation of the Partner Program: Partners' systems run in a separate environment with their own sign-in, each Partner's role reaches only that Partner's own records, and no Partner credential or system has a path into any Customer account or Customer Content. Version history. Version 1.0, July 25, 2026 (first complete addendum, replacing the November 8, 2025 placeholder). Version 2.0, September 6, 2026 (processing location in Section 11; Subprocessor list restated at vendor level with locations and the addition of Anthropic). Version 2.1, October 6, 2026 (Partners defined in Section 1(f) and excluded from the roles, instructions, assistance, and Subprocessor provisions in Sections 2, 3, 7(b), 8, and 9 and Exhibit 1; Partner Program separation added to Annex B; isolation wording in Annex B restated without changing the controls described). Version 2.2, October 28, 2026 (Exhibit 1: ElevenLabs restated as speech recognition, end-of-turn detection, and speech synthesis with zero retention; Anthropic engaged through Amazon Bedrock only). Version 2.3, October 29, 2026 (Annex B(b): database storage, including call records, encrypted with AWS KMS keys that EarlyBird creates and governs, with automatic key rotation; call recordings and transcripts encrypted with a key created for each business profile alone).