DATA PROCESSING AGREEMENT (DRAFT)
GPT Business
Draft of 2026-11-07. NOT SIGNED. Written in-house.
This draft is not binding until both sides sign a final version.

1. Who this is between
"GPT Business", "we": the provider of the GPT Business service. Legal entity name and address: [to be inserted at signing].
"Customer", "you": the business named in the order or signup: [Customer name and address].

2. What this covers
When you use GPT Business we process personal data on your behalf: your customers' and leads' names, phone numbers, email addresses, messages, call audio and transcripts (and recordings where you turn them on), notes, files, schedules, consent and opt-out records, and billing references. You are the controller of this data. We are your processor.

3. What we do with it
We process it only to provide the service you asked for (answering calls and texts, booking, reminders, quotes, invoices, reports, handoffs to people) and to follow your written instructions, including your settings in the product. We do not sell it. Our AI providers' own terms on training and retention apply to what they receive; see our Privacy Notice at https://gptbusiness.io/privacy/.

4. Our staff
Only people who need access to run and support the service can reach your data, and they are bound to keep it confidential.

5. Security
Each customer's data is kept separate from every other customer's. Access keys are kept out of our code and rotated when needed. We do not store full card numbers; Stripe handles them. We have no SOC 2 report or other security certification today: SOC 2 is not yet achieved and controls are in progress. We do not promise a certification we do not hold.

6. Sub-processors
You agree we may use these companies to process your data: OpenAI (AI models and speech), Anthropic (AI models), Telnyx (phone numbers, calls and texts), Stripe (payments), Supabase (database, sign-in and storage) and Cloudflare (network, hosting and email sending). The current list is at https://gptbusiness.io/trust/. We give you at least 30 days' notice before adding one that handles your data. If you object in writing within that time, we will talk with you about a fix, and if we cannot agree you may cancel. We remain responsible for our sub-processors.

7. Retention and deletion
Retention periods are listed on https://gptbusiness.io/trust/. After you cancel you can export your data for at least 30 days. After that we erase your customers' personal records, after writing to you with the date, except records the law requires us to keep (such as consent, opt-out, billing and call detail records).

8. Requests from people
If one of your customers asks us for a copy of their data or for deletion, we tell you, and we help you answer within the time the law allows (we aim for 45 days). We do not answer on your behalf unless you ask us to.

9. Problems with your data
If we learn that your data was accessed or lost without permission, we tell you what happened, what data was involved and what we are doing, as soon as we know. [Notice deadline in hours: to be agreed at signing.]

10. Your checks
On reasonable written request, we give you the information we have showing we follow this agreement. [Audit terms: to be agreed at signing.]

11. Transfers
Your data is processed in the United States and wherever our listed sub-processors operate. [Transfer terms for customers outside the United States: to be agreed at signing.]

12. When it ends
When the service ends, section 7 applies. This agreement lasts as long as we hold your data.

13. Contact
Questions or signing: support@gptbusiness.io. Security concerns: security@gptbusiness.io.

Signed for GPT Business: ____________________  Date: ____________
Signed for Customer:    ____________________  Date: ____________