Data Processing Addendum (DPA)
The legal contract between Sonotech (processor) and the tenant (controller). Auto-applies when you sign up — you accept it during onboarding.
Roles
You (Tenant) = data controller. You determine purposes and means of collection.
Sonotech = data processor. We process per your documented instructions and the safeguards in this DPA.
Data residency
Persistent storage and compute 100% in Canada (Google Cloud Montréal region). AI processing via Google's paid AI infrastructure (no training, no long-term retention, no human review without consent).
Sub-processors
- Google LLC (Google Cloud Platform — infrastructure + AI)
- Twilio Inc. (voice + SMS)
- Twilio SendGrid (transactional email)
We notify you at least 30 days before adding any new sub-processor.
Retention
Defaults: 30d audio · 90d transcripts · 24mo metadata · 730d consent events (legal proof). Configurable per-tenant on request to privacy@sonotech.ai.
Subject rights
End-callers have access / deletion / rectification / portability rights via /privacy/request. We respond within 30 days per Loi 25 Art. 27-28.
Breach notification
We notify you and CAI within 72h of any security incident affecting your tenant's data.
Termination
Upon termination, we delete or return all your personal data within 30 days. Backups purged within an additional 30 days.
Full DPA text available via the link above. For custom enterprise terms, contact legal@sonotech.ai.