1. Application and priority
This Data Processing Addendum (DPA) forms part of the Caretta Terms and Conditions at https://caretta.so/terms (Agreement) between Caretta Inc., a Delaware corporation (Company), and the business or organization accepting the Agreement (Customer). It applies automatically, without a separate signature, when Customer accepts the Agreement incorporating this DPA and Company processes Customer Personal Data on Customer's behalf. The person accepting for Customer represents that they are authorized to bind Customer. This DPA covers free and paid Services and continues for as long as Company or its Subprocessors retain Customer Personal Data.
If the parties have separately signed a data processing agreement covering the same processing, that signed agreement takes precedence over this DPA. Otherwise, this DPA controls conflicts about the processing of Customer Personal Data under the Agreement or Privacy Policy. The applicable EU Standard Contractual Clauses and UK Addendum control any conflicting term, including in a separately signed agreement. Other provisions of the Agreement remain in effect.
2. Definitions and roles
Customer Personal Data means personal data contained in Customer Data that Company processes on Customer's behalf, including personal data in call audio, transcripts, AI inputs and outputs, CRM records, calendar data, connected Google Workspace data, and copies of that content in logs. Data Protection Laws means laws applicable to that processing, including, where applicable, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and applicable US state privacy laws. Controller, processor, personal data, processing, and personal data breach have their meanings under applicable Data Protection Laws. A Subprocessor is another processor engaged by Company to process Customer Personal Data.
Customer is the controller and Company is its processor. If Customer acts as a processor for another controller, Company acts as Customer's subprocessor, and Customer must have that controller's authorization and convey its lawful instructions. Each party will comply with the obligations applicable to its role. Annex 1 describes the processing.
Company is an independent controller for account, billing, business contact, and service usage data that it processes for its own account administration, security, legal compliance, and business operations, as described in its Privacy Policy at https://caretta.so/privacy. This separate role does not include Customer content merely because it appears in telemetry, support materials, or logs. Company remains responsible for the lawful basis, transparency, rights, and transfer requirements applicable to its controller processing.
3. Instructions and Customer responsibilities
Company will process Customer Personal Data only on Customer's documented instructions, including this DPA, the Agreement as limited by this DPA, Customer's use and configuration of the Services, and further lawful written instructions consistent with the Services. This includes instructions about transfers. If applicable law requires other processing, Company will inform Customer before processing unless the law prohibits notice. Company will promptly inform Customer if it believes an instruction infringes Data Protection Laws and may pause the affected processing while the parties resolve the issue.
Customer is responsible for its lawful basis, required notices, and permissions for collecting and providing Customer Personal Data and instructing Company to process it. This includes recording and transcription notices and consent from call participants where required, as set out in Agreement Section 2.6. Customer controls the data it submits, its users' access, and the integrations it enables. These responsibilities do not relieve Company of its own obligations under this DPA or law.
4. Confidentiality and security
Company will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed for their authorized duties. Company will implement and maintain technical and organizational measures appropriate to the nature of the data and risks of processing, as specified in Annex 2. Company may update those measures without materially reducing their overall protection. Caretta is ISO 27001 certified.
5. Assistance and personal data breaches
Taking account of the processing and information available to it, Company will assist Customer with data subject requests, security obligations, breach notifications, data protection impact assessments, and prior consultations with regulators as required by Data Protection Laws. Company will promptly forward requests concerning Customer Personal Data to Customer and will respond only on Customer's instructions or as required by law. Company will provide information reasonably needed for Customer's transfer assessments.
Company will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will go to Customer's designated privacy or administrator email. It will describe, as information becomes available, the breach, affected data and individuals, likely consequences, measures taken or proposed, and a contact for further information. Company may provide information in stages without undue further delay and will take appropriate steps to contain, investigate, and remedy the breach. Customer is responsible for notices to regulators and individuals concerning its controller obligations, with Company's assistance; Company retains its own legal duties. Notice does not itself admit liability.
6. Subprocessors
Customer generally authorizes Company to use the Subprocessors identified at https://trust.caretta.so/?tab=subprocessors. The list will identify each legal entity, its function, processing locations, and relevant data. Company will impose written data protection obligations on each Subprocessor that provide at least the protection required by this DPA for the delegated processing, including confidentiality, security, assistance, deletion, and lawful transfers. Company remains responsible for its Subprocessors' performance of those obligations. On request, Company will provide relevant Subprocessor contract information, with redactions to protect confidential information where permitted by law.
Caretta will give affected Customers at least fifteen (15) calendar days' notice before a new or replacement Subprocessor processes affected Customer Personal Data, by emailing those Customers and updating the list at https://trust.caretta.so/?tab=subprocessors. Customer may object within that notice period on reasonable data-protection grounds. Caretta will work in good faith to resolve the objection before the proposed Subprocessor processes that Customer's data.
Notwithstanding any contrary provision of the Agreement, while an objection remains unresolved, Caretta may suspend the affected Services or, where necessary, the account. Suspension stops the disputed processing, including background jobs and transfers of stored data. Caretta will not allow the proposed Subprocessor to process the affected Customer Personal Data while the objection remains unresolved and is not required to maintain a separate provider arrangement for one Customer. If the objection is not resolved, Customer may end the affected Services without an early termination penalty and receive a refund of unused prepaid Fees for those Services.
7. Deidentified data and Google data
Company may create and use deidentified and aggregated data from Customer Personal Data to operate and improve its products and services, provided the data can no longer reasonably identify any individual. Company will not attempt to reidentify it. Google and Slack API data is excluded from these datasets.
Company's use and transfer of data obtained through Google APIs, including all data derived from it and aggregated, anonymized, or deidentified versions, will comply with the Google API Services User Data Policy, including Limited Use requirements. Company will use that data only for permitted purposes, including providing or improving prominent user-facing Caretta features, and will restrict transfers and human access as that policy requires. Company will not use that data to train or improve generalized AI or machine learning models. These restrictions apply despite any broader data-use permission in the Agreement or this DPA and continue to apply to derived data that is no longer personal data.
8. Return, deletion, and retention
Customer may request deletion of Customer Data at any time, or delete its account within the Services where that option is available. Company will delete the applicable Customer Data within thirty (30) days of the request or account deletion, in accordance with Company's Privacy Policy, except where retention is required by law. Backup copies are deleted within ninety (90) days and are not used except for disaster recovery. If Company terminates Customer's account, Company will make Customer Data available to Customer for electronic retrieval for thirty (30) days and will then delete it on the same basis.
The ninety (90) day backup deletion period starts on the deletion request or account deletion or, where Company terminates Customer's account, at the end of the thirty (30) day electronic retrieval period. Company will ensure that its Subprocessors delete on the same basis; retained copies remain protected by this DPA until deleted, and legally required retention is limited to the data, purpose, and period required by law.
9. Compliance information and audits
Company will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation and any available independent reports. Where that information is insufficient, Company will allow and contribute to audits, including inspections, by Customer or its independent auditor, subject to reasonable notice, confidentiality, and measures that protect other customers' data and avoid unnecessary disruption. Routine audits are limited to once in twelve months; that limit and notice requirement do not apply where a breach, reasonable evidence of noncompliance, regulator request, applicable law, EU SCCs, or UK Addendum requires more. Each party bears its own ordinary compliance costs. Any fees for exceptional assistance must be agreed in advance and must not prevent legally required assistance or oversight.
10. International transfers
Customer authorizes processing in the United States and the other locations disclosed in the Subprocessor list, subject to this Section. For transfers requiring safeguards under EU or UK Data Protection Laws, the EU SCCs and UK Addendum apply as completed in Annex 4. Company will ensure that onward transfers comply with the applicable transfer requirements and will assist with required assessments and supplementary safeguards. Company will notify Customer if it can no longer comply and will suspend affected transfers where required. No Data Privacy Framework certification is asserted or relied on by this DPA.
11. Applicable US state privacy laws
Where applicable US state privacy laws require Company to act as a processor, service provider, or contractor, Company will process Customer Personal Data only for the specified business purposes of providing the Services and other purposes permitted by those laws and this DPA. Company will not sell or share it for cross-context behavioral advertising, retain, use, or disclose it outside those purposes or the direct business relationship, or combine it with data from other sources except as permitted by those laws. Company will provide the same level of privacy protection those laws require, notify Customer if it can no longer meet those obligations, and permit reasonable steps to verify compliance and stop and remediate unauthorized use. Company certifies that it understands these restrictions and will comply with them. Deidentified data must meet the applicable statutory requirements as well as Section 7.
12. Liability, changes, and contact
The Agreement's liability provisions apply to this DPA only to the extent permitted by applicable law. They do not limit liability or remedies required by the EU SCCs or UK Addendum, data subjects' enforceable rights, or regulators' powers. Changes to this DPA follow the Agreement's update process and must preserve compliance with Data Protection Laws and the applicable transfer clauses. Changes to the Subprocessor list follow Section 6. This DPA does not change a separately signed enterprise DPA.
Data protection requests may be sent to founders@caretta.so, for the attention of the privacy contact. Customer must keep its administrator and privacy contact details current.
Annex 1: Parties and processing details
A. Parties (EU SCC Annex I.A)
Data exporter: Customer, the business or organization identified in the account or applicable order. Address, contact name, position, and email: the details supplied by Customer for its account or order. Role: controller, or processor where it acts for another controller. Activities: using Caretta for sales calls and related business workflows and providing the data described below.
Data importer: Caretta Inc., 625 2nd Street, Suite 204, San Francisco, CA 94107, United States. Contact: Pavlos Markesinis, Co-founder and Secretary, founders@caretta.so. Role: processor or subprocessor. Activities: providing the Services and processing described below.
Customer's acceptance of the Terms constitutes its signature to this DPA, including the applicable EU SCCs and UK Addendum, on the date of acceptance.
B. Processing and transfers (EU SCC Annex I.B)
Subject matter and purpose: operating a real-time AI assistant for sales calls, including call transcription, context retrieval, summaries, suggestions and other AI outputs, CRM and calendar workflows, connected-file processing, support, maintenance, and security. Section 7 describes permitted deidentification.
Nature of processing: collection, receipt, transmission, recording or transcription where enabled, organization, storage, retrieval, analysis and generation of outputs, disclosure to authorized users and approved providers, export, deidentification where permitted, and deletion.
Data subjects: Customer's employees and contractors, users, prospects, customers, business contacts, and other call participants or people whose information Customer submits.
Data categories: names, business contact details, professional roles and affiliations; voice and call audio; transcripts and meeting content; AI prompts, context and outputs; CRM contacts and deal records; calendar events and attendee information; connected Google Workspace files and metadata; and associated identifiers and operational metadata processed on Customer's behalf. The categories depend on features and integrations used.
Sensitive data: Customer will not intentionally submit special category data or criminal offence data.
Frequency: continuous or recurring during Customer's use, including transfers when users initiate calls or integrations synchronize data. Duration and retention: for the processing Services, including a continuing free account, followed by return and deletion under Section 8; legal retention only as permitted there. Subprocessor subject matter, nature, and duration are limited to each listed function and the same instructions and deletion requirements.
Processing locations: United States; any further storage, support, or remote-access locations must be stated in the Subprocessor list.
C. Supervisory authority (EU SCC Annex I.C)
The competent authority is determined under EU SCC Clause 13: the authority for Customer's EU establishment; if Customer is subject to GDPR Article 3(2) without an EU establishment, the authority for its Article 27 representative, or, where no representative is required, an authority in a Member State where affected individuals are located. Customer will identify that authority and any required representative in its account information or on request. For UK transfers, the competent authority is the Information Commissioner's Office as provided by the UK Addendum.
Annex 2: Technical and organizational measures (EU SCC Annex II)
1. Access and personnel controls
Caretta uses authentication, role-based permissions and organization-aware access checks. Multi-factor authentication is required for all staff and administrator accounts, including production systems and provider consoles. Our designated security lead approves and removes production access according to least privilege. We review access at least annually and whenever roles change, and remove departing team members' access within twenty-four (24) hours or one business day, whichever is shorter. All team members are bound by signed confidentiality obligations covering company and customer information and complete security training annually.
2. Encryption in transit and at rest
We encrypt Customer Personal Data in transit using TLS on all connections, including connections within our cloud network, and at rest in databases, file and recording storage, caches and backups. Keys we manage in AWS Key Management Service rotate automatically each year. Our cloud providers manage and rotate their own keys under their security programmes. Stored OAuth access and refresh tokens also use application-layer authenticated encryption.
3. Data separation, logging and monitoring
Customer data access uses organization-aware database policies and application authorization checks. Recording storage blocks public access and requires signed playback access. Only authorized team members may access production data and logs, under the control of our designated security lead. We log security events, including logins, administrative actions and privilege changes, with the user, time and source, and regularly review high-risk events.
Application and observability logs may contain request and response content. We treat that content as Customer Personal Data, with the same access restrictions and deletion process. Production logs expire automatically after 365 days, subject to earlier deletion under Section 8 and retention required by law.
4. Secure development and vulnerability management
Every production change goes through a pull request and requires approval by a second person, without a bypass. Automated checks, including tests and dependency vulnerability scans, must pass before merge. We fix high and critical security issues before release. Our designated security lead owns vulnerability triage; remediation follows severity-based deadlines, with critical issues prioritized. We scan at least monthly and after major changes. An independent firm tests the application at least annually; the most recent test covered the web application and API.
5. Incident response
Our designated security lead owns incident response, including outside working hours, with a designated backup. Automated monitoring alerts the responsible engineer for triage. Our Incident Response Policy covers investigation, containment, eradication, recovery, validation, incident records and a review after each incident. We notify Customer without undue delay after becoming aware of a breach affecting Customer Personal Data, as required by Section 5, using Customer's designated privacy or administrator contact. We provide further details in stages as they become available.
6. Backup, recovery and deletion
Production databases have point-in-time recovery or automated daily backups. Backups expire automatically and are used only for disaster recovery. We and our Subprocessors delete active copies within thirty (30) days and all backup copies within ninety (90) days, on the basis and from the dates defined in Section 8, except where retention is required by law. Our documented recovery plan sets the restore order and steps for each production store, and we test restoration at least annually.
Customers submit deletion and export requests by email to founders@caretta.so. Authorized team members identify the account and remove linked data from databases, file storage, observability systems and application logs under Section 8. There is no self-service account deletion button. We record completed deletions in a restricted register, kept separate from systems that may be restored. The register contains the request reference, account identifiers, scope, systems checked and completion dates, but no customer content. Automated monitoring alerts us before deletion deadlines and when a deadline is missed. Before restored data returns to use, an authorized team member checks the register, deletes again any data recorded as deleted, verifies the result and only then restarts the affected Services.
7. Data minimization and data subject requests
Authorized team members handle requests for access, export, correction and erasure received by email, verify the request against the account's known contact, and respond within applicable legal deadlines. Where we process data on Customer's behalf, we promptly forward requests to Customer and assist as instructed, as required by Section 5.
We do not currently create deidentified or aggregated datasets. Any future improvement dataset must satisfy Section 7's effective-deidentification requirements before use. Removing account identifiers alone is insufficient: we will also remove or mask names, companies and other identifying details and check that individuals cannot be reidentified. Google and Slack API data is excluded from these datasets. We will not attempt to reidentify deidentified data, and the Google-data restrictions in Section 7 continue to apply.
8. Subprocessor management
Our designated security lead reviews each Subprocessor before use and periodically thereafter, and we have a data processing agreement with each Subprocessor. We review cloud providers' security and physical safeguards annually. Authorized team members maintain the Subprocessor list and handle notices, objections and assistance requests. We email affected Customers and update the list at least fifteen (15) calendar days before a new or replacement Subprocessor processes affected Customer Personal Data. Objections, suspension of disputed processing, termination and refunds are handled under Section 6; deletion follows Section 8.
Annex 3: Subprocessors
The current list of Subprocessors is available at https://trust.caretta.so/?tab=subprocessors.
Annex 4: International transfer terms
A. EU transfers
For a transfer of Customer Personal Data subject to the GDPR that requires appropriate safeguards and for which the clauses apply, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, are incorporated in full by reference. Customer is the data exporter and Company the data importer. Module 2 applies where Customer is a controller; Module 3 applies where Customer is a processor. The parties agree to the applicable module through their acceptance described in Annex 1.
For each applicable module: Clause 7 (docking) does not apply. Clause 9 uses Option 2, general written authorization, with fifteen (15) calendar days' prior written notice through the list update and affected-Customer email mechanism set out in Section 6. The optional language in Clause 11 does not apply. Clause 13 is completed according to Annex 1.C. Clause 17 uses Option 1 and Irish law. Under Clause 18(b), the courts are those of Ireland, without limiting the rights provided by the EU SCCs. Annex 1 supplies EU SCC Annex I; Annex 2 supplies EU SCC Annex II. Annex 3 and the linked list identify generally authorized Subprocessors; the specific-authorization Annex III is not required for Option 2.
B. UK transfers
For transfers subject to the UK GDPR that require appropriate safeguards, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner's Office (UK Addendum), is incorporated and applies to the EU SCCs selected above, with its mandatory adaptations. Official text: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf.
Table 1: The parties, roles, contact details, signatures and start date are those in Annex 1.A. Table 2: The Approved EU SCCs are the 2021/914 clauses with Modules 2 and 3 and the selections set out in Annex 4.A, using the module appropriate to the transfer. Table 3: Appendix Information is supplied by Annexes 1, 2 and 3. Table 4: Neither party may end the UK Addendum under Section 19 solely because the Approved Addendum changes. Its mandatory update provisions continue to apply.
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.
Attribution
Adapted from Common Paper's Data Processing Agreement Standard Terms, version 1.1 (https://commonpaper.com/standards/data-processing-agreement/1.1/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Changes include automatic incorporation through Caretta's Terms, Caretta-specific processing and deletion, subprocessor notice, deidentified and Google-derived data provisions, and completed transfer selections. This is a modified version, not the unmodified Common Paper standard.