Data Processing Agreement
Version 2026-10-16
This agreement forms part of our Terms of Service and covers the personal data we process for you under UK GDPR (Article 28) and the Data Protection Act 2018.
1. Roles
You are the controller of your callers' and customers' personal data. Arcscribe processes it on your behalf, only to provide the service and on your documented instructions (these terms, and the settings you choose in Keystone).
2. What we process
- Whose data: people who call or text your Arcscribe number, and your customers.
- What data: phone numbers, names, addresses, the details of their enquiry, transcripts of calls the AI assistant answers, text messages, and photos they send.
- Why: to answer and route your calls and texts, take messages and bookings, and show them to you in Keystone.
- How long: for as long as you use the service, within our retention periods. Call transcripts are kept for 90 days and call records for 12 months by default.
3. Sub-processors
We use these sub-processors to provide the service:
| Sub-processor | What for |
|---|---|
| Twilio | Phone numbers, calls and text messages |
| Deepgram | Speech recognition and the AI assistant's voice |
| Anthropic | The AI model that understands callers and writes replies |
| Stripe | Payments and invoices (your billing details, not your callers' data) |
| Our server hosting provider | Running Keystone and storing data |
- We'll tell you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may cancel without charge for the remaining period.
- Some sub-processors process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Addendum.
4. Security, confidentiality, breaches, deletion
- Security: we protect the data with appropriate technical and organisational measures, including encryption in transit, access limited to those who need it, and secure, access-controlled storage.
- Confidentiality: everyone at Arcscribe who can access the data is bound by confidentiality.
- Breaches: we'll tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- Requests: we'll help you respond to requests from people exercising their data protection rights (for example access or deletion). Keystone has tools to export or delete a caller's data.
- Assistance: we'll give you reasonable help with data protection impact assessments and with the regulator.
- End of the service: when the service ends, you can export your data from Keystone. We then delete it within our retention periods, unless the law requires us to keep it.
- Audits: we'll make available the information reasonably needed to show we meet this agreement.