Draft, not in effect. This is an outline for counsel review. It does not form part of any agreement until a final version is published and signed.
Data processing agreement
Roles
The customer is the controller (under CCPA, the business); Good Halo is the processor (service provider) and processes personal data only on the customer's documented instructions.
Data and purpose
Call metadata, logged dispositions, rep identities and work locations, and transcripts of selected calls, processed only to compare reported activity with the call evidence and support the customer's review. Transcripts are fetched only on plans with transcript checks, and only for recorded calls of 60 seconds or more: calls a check selects (at most 40 per rep per week, including ordinary long conversations) and calls already in an open finding. Being selected for a transcript is not a finding.
Security
Tenant isolation with forced row-level security, encrypted credentials and uploaded files, role-based access, an audit log of access and decisions.
Retention
Transcripts kept 30 days at most; transcripts labeled as personal calls deleted at once; uploaded call exports stored encrypted and deleted as soon as their import finishes; other data kept for the periods in the customer's retention settings; all customer data deleted at the end of the contract. A legal hold keeps the held case's data and blocks deletion of the organization until it is released.
Subprocessors
Listed on the Trust page; changes notified to customers.
AI
Where the plan includes AI review, Anthropic receives, for a selected call, first only the redacted lines from the call's first 60 seconds (about the first minute of speech when the transcript has no timing) and the call's direction, to decide whether the call is work-related. A call set aside as personal stops there: only the label is kept and its transcript is deleted. For every other call, Anthropic then receives the redacted transcript (the whole transcript when it fits, otherwise its first three minutes and last minute), a few call facts (connected duration, direction, the dialed account's name, the logged disposition, speech-timing measurements) and the rep's first name. Emails, phone numbers, card-like numbers, street addresses and names in common phrases are masked before sending. Model calls use Anthropic's standard Messages API, which is eligible for zero data retention; Anthropic's batch interface, which is not, is off. A zero-data-retention arrangement with Anthropic, and Anthropic's written confirmation that this use is permitted, are not yet in place; until the arrangement is, Anthropic's standard API data retention applies. No training on customer data; no emotion, biometric or personality inference.
Assistance and audits
To be drafted by counsel: data-subject requests, breach notification, audits, international transfers.