Data Processing Addendum (DPA)

Last updated: 29 October 2026

This Data Processing Addendum (the "DPA") is entered into between Daigest SAS, 14 avenue du Général de Gaulle, 94160 Saint-Mandé, France ("Revox", the "Processor") and the customer who accepts the Revox Terms of Sale and Use (the "Customer", the "Controller").

It forms an integral part of those Terms (https://www.getrevox.com/en/tos) and applies as soon as they are accepted, with no further formality. It meets Article 28 of the GDPR and covers the personal data Revox processes on the Customer's behalf when it places or receives calls with AI voice agents: outbound campaigns from contact files supplied by the Customer, calls placed from the dashboard or the API, and inbound calls.

A copy signed by Revox is available on request at contact@getrevox.com.

1. Our commitment

Neither Revox nor any of its providers uses your data to train or improve general-purpose AI models.

This DPA explains how we process your data to place and handle the calls you request: telephony, transcription, conversation model, speech synthesis, SMS where applicable, post-call analysis and delivery of results.

2. What we process

Nature of processing: outbound and inbound calls run by AI voice agents on the Customer's behalf, in particular to qualify contacts and book meetings; transcription; SMS where applicable; post-call analysis; delivery of results.

Contact file supplied by the Customer

PurposeRunning the campaign

RetentionDuration of the campaign; deleted when it closes or on request

Phone numbers

PurposePlacing and tracking calls

Retention12 months

Call recordings (audio)

PurposeQuality monitoring

Retention30 days

Transcripts

PurposeMonitoring, reporting

Retention12 months

Call logs and metadata

PurposeTechnical and quality monitoring

Retention12 months

SMS (number and content)

PurposeSending the configured messages

Retention12 months

Results (status, outcome, extracted fields)

PurposeReporting to the Customer

Retention12 months

Deletion on request at any time. On termination, all data is deleted within 30 days.

The Customer warrants that it has a legal basis, and has given the required notices or obtained the required consents, for the data it supplies and for calling the data subjects.

3. AI training

To be perfectly clear:

We do not use your data to train general-purpose AI models (language, transcription, voice).

We do not share your data with third parties for training purposes.

Your data is used to place the calls you request, then retained as set out in section 2.

Neither Revox nor any of its providers uses your data (prompts, contact details, call context, recordings, transcripts, results or derived data) to train or improve general-purpose AI models (language, speech recognition or speech synthesis models). All language model, transcription and speech synthesis providers are used under API or enterprise terms that exclude training on API data.

One narrow, internal exception: Revox trains its own answering machine detector (it tells a human from a voicemail or an IVR in the first seconds of the call) on short audio clips (about 2 seconds) from the start of calls, labelled with the call's result. This model is not generative, is shared with no one, runs at Revox and outputs only that label.

OpenAI: no training on API data by default, zero data retention where eligible.

Google: paid Gemini API (not the free tier).

Anthropic: no training on API data by default.

OpenRouter: providers that train on data are excluded, zero data retention routing, prompt logging disabled.

4. How we protect your data

Encryption: in transit (TLS 1.2 or higher) and at rest (AES-256).

Access control: role-based access control, multi-factor authentication, authentication through Clerk; restricted internal access.

Isolation: logical isolation per customer organization (every query is scoped to the organization); web application firewall and DDoS protection at the edge.

Location: call records, transcripts and results in the European Union (Neon, Frankfurt), application hosted in the European Union (Vercel, Frankfurt), transcription on Soniox's EU endpoint. Audio recordings are stored in the United States (AWS S3, us-east-1). Other sub-processors operate in the European Union or in the United States with the safeguards in section 5.

Certifications: SOC 2 Type II in progress (target: first quarter of 2027). No ISO 27001 certification to date.

5. Sub-processors

The conversation model, the voice and their fallbacks depend on each assistant's settings, and are only ever chosen among the providers below. The exact configuration of an account (identifiers of the models and providers in use) is available on request.

Vercel

ServiceApplication and API hosting

LocationEU (Frankfurt)

TransferSCC and DPF

Neon

ServicePostgreSQL database (call records, transcripts, results)

LocationEU (Frankfurt)

TransferNone (EU)

Amazon Web Services

ServiceRecording storage (S3); workflow execution (EC2)

LocationUnited States (us-east-1)

TransferSCC and DPF

Temporal Technologies (Temporal Cloud)

ServiceWorkflow orchestration (call scheduling and retries; holds a call's parameters while it is pending)

LocationEU

TransferSCC and DPF

Redis

ServiceCache, rate limiting, live call events

LocationEU

TransferNone (EU)

LiveKit

ServiceSIP calls and real-time media; LiveKit Inference (Gemma fallback model); agent hosting

LocationUnited States, EU

TransferSCC

Twilio

ServiceTelephony carrier (calls, SMS)

LocationUnited States, EU

TransferSCC and DPF

Telnyx

ServiceTelephony carrier (calls, SMS)

LocationUnited States, EU

TransferSCC

Soniox

ServiceTranscription (EU endpoint)

LocationEU

TransferNone (EU)

OpenAI

ServiceConversation model depending on the assistant's settings; end-of-call check; extraction fallback; labelling call openings for the answering machine detector

LocationUnited States

TransferSCC and DPF

Google (Gemini API, paid tier)

ServiceDetecting who answered from the audio; extracting the call outcome

LocationUnited States, EU

TransferSCC and DPF

Anthropic

ServiceStructured data extraction; call outcome extraction fallback

LocationUnited States

TransferSCC and DPF

OpenRouter

ServiceRouter to Anthropic for structured data extraction

LocationUnited States

TransferSCC

Cartesia

ServiceSpeech synthesis (default voice)

LocationUnited States

TransferSCC and DPF

ElevenLabs, Deepgram, Inworld, Minimax, Gradium

ServiceSpeech synthesis, only if one of their voices is selected

LocationUnited States, EU

TransferSCC

Resend

ServiceTransactional email (notifications, call summaries)

LocationUnited States

TransferSCC and DPF

Clerk

ServiceAuthentication of Revox account users

LocationUnited States

TransferSCC and DPF

SCC: the European Commission's Standard Contractual Clauses (Decision 2021/914). DPF: the EU US Data Privacy Framework. Every transfer outside the European Union is covered by one or both of these mechanisms.

Revox informs the Customer 30 days before adding or replacing a sub-processor, and updates this page accordingly.

Integrations the Customer enables itself (HubSpot, Zoho, its own webhooks, etc.) receive data on its instructions: they are the Customer's own processors, not Revox's.

6. Your rights

Data subject requests: we help you answer access, deletion or rectification requests within 2 business days.

Deletion: on request at any time; on termination, all data is deleted within 30 days.

Breach notification: we notify you of any personal data breach within 48 hours.

Documentation: our providers' DPAs and our security documentation are available on request for your own reviews (impact assessment, security review).

7. Acceptance

By accepting the Revox Terms of Sale and Use, or by using the Revox services, the Customer accepts this DPA. A copy signed by Daigest SAS is available on request for customers who wish to countersign it.

8. Contact

Revox data protection contact: contact@getrevox.com.