Data Processing Terms

1. Roles

1.1 For Customer Data processed through the Service, the Customer is the business/controller (it decides why and how its callers' and customers' information is processed), and MyMiaAI is the processor / service provider (it processes that data only to provide the Service). Each party complies with the privacy laws applicable to its role.

2. Processing on documented instructions

2.1 We process Customer Data only on your documented instructions — which are: these Terms, your account configuration, the information and rules you give Mia, and your in-product directions — and solely to provide, secure, support, and bill for the Service. We will inform you if an instruction appears to violate applicable law, and we will not follow an instruction that requires us to break the law.

2.2 We do not "sell" or "share" (as those terms are defined in state privacy laws) Customer Data, we do not retain, use, or disclose it for any purpose outside providing the Service (other than permitted de-identified aggregation under Terms §8.3), and we do not disclose it to third parties except as the Terms and these Data Processing Terms allow.

3. Subject matter and nature of processing

3.1 Processing includes: receiving and routing calls; recording and transcribing calls; extracting booking, job, and contact details; sending messages and invoices as configured; storing records, dashboards, and audit trails; metering usage; and support/troubleshooting. Categories of data are described in the Privacy Policy §2. Data subjects are your callers, customers, and team members.

4. Confidentiality and personnel

4.1 Personnel authorized to process Customer Data are bound by confidentiality obligations and role-based access controls; access is limited to what the role requires (see Privacy Policy §9).

5. Security measures

5.1 We maintain technical and organizational measures appropriate to the data, including: encryption in transit; per-customer data separation enforced in the platform's repositories; access controls and audit logging for administrative actions; centralized secret management (credentials are stored in a managed secrets store, not in application code or dashboards); monitoring and alerting for service failure; and regular backup of platform data. A fuller description is available to customers on request.

6. Subprocessors

6.1 You authorize the subprocessors listed in Privacy Policy §5 (Google Cloud/Gemini, Twilio, Stripe, Square, Resend, OpenAI, Vercel, Neon), each engaged under written terms requiring protections consistent with these Data Processing Terms, and each receiving only the data its function requires.

6.2 Changes. We will give customers at least 30 days' notice (email or dashboard) before adding a subprocessor that will process Customer Data or replacing one in a way that materially changes how Customer Data is handled. If you object on reasonable data-protection grounds, we will discuss in good faith; if unresolved, you may terminate the affected service before the change takes effect.

7. Assistance with data-subject requests

7.1 Taking into account the nature of the processing, we will assist you with reasonable tools and cooperation so you can respond to your callers' and customers' requests (access, correction, deletion, portability) — through the dashboard, exports, and deletion functions, and by routing requests we receive directly (Privacy Policy §10.2). We will not respond directly to your customers' requests except on your instruction or where law requires.

8. Breach notification

8.1 We will notify you without undue delay — and in any event within 72 hours after we become aware — of a confirmed personal-data breach affecting your Customer Data, with the information then available (nature, categories, likely consequences, measures taken), and we will update as the investigation proceeds, cooperate with your investigation, and document the incident. Notification under this section is not an admission of fault.

9. Return and deletion at termination

9.1 At termination, your Customer Data is handled under Terms §15.4: 30-day export window, then deletion from production systems within 60 days, subject to legal-retention, backup-cycle, and de-identified-aggregation exceptions. Deletion certification is available on written request.

10. Processing location

10.1 The platform is hosted in the United States (Google Cloud U.S. regions) and the Service is offered for U.S. use. Some subprocessors may process data in other countries under their own terms and safeguards; the current list and roles are in Privacy Policy §5.

11. Audits and information

11.1 On reasonable written request (not more than once per year, under confidentiality), we will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms, such as summaries of our security practices and controls. Enterprise plans may include additional audit rights by written agreement.

12. Precedence

12.1 If these Data Processing Terms conflict with the Terms of Service about Customer Data, these terms control for that subject.