Draft, under legal review. Last updated 2026-11-02.
This page summarises the data processing addendum ("DPA") that forms part of our terms of service. The signed DPA is available on request: privacy@larynth.com. If this summary and the signed DPA differ, the signed DPA wins.
Roles and scope
You, the customer, are the controller of the personal data processed through your account: call audio, recordings, transcripts, summaries, extracted details, contacts, consent records and opt-outs. Larynth is your processor (a "service provider" under US state privacy laws). The DPA covers this data only. Data about you as our customer is covered by our privacy policy.
- Data subjects: people who call your numbers or are called by your agents, your contacts, and your staff on transferred calls.
- Data categories: phone numbers, names and details collected on calls, voice audio, transcripts, call metadata, consent and opt-out records. You should not configure agents to collect special category data, payment card numbers or government ids unless we agree in writing.
- Duration: the term of your account plus the deletion period below.
Our commitments as processor
- We process your data only on your documented instructions, which are the terms, your configuration and your use of the API and dashboard. We tell you if we think an instruction breaks the law.
- We do not sell or share your data, and we do not use it for our own purposes or to train AI models, unless you turn on the training opt-in (off by default).
- Staff with access are bound by confidentiality.
- We help you answer data subject requests, including deleting call data by phone number across our systems, and with impact assessments and regulator questions.
- We make the information needed to show compliance with the DPA available, and allow audits as set out in the signed DPA. [counsel: audit mechanics, frequency and cost]
Subprocessors
You authorise the subprocessors on our subprocessors page. We bind each to data protection terms at least as protective as the DPA and remain responsible for them. We give at least 30 days' notice before adding or replacing a subprocessor that handles your call data. You may object on reasonable data protection grounds; if we cannot resolve it, you may end the affected service and receive a refund of unused prepaid credit for it. [counsel: notice period, notice channel and objection remedy]
Security measures
- Encryption in transit for API, dashboard and browser calls (TLS and DTLS-SRTP).
- Recordings encrypted at rest with a key unique to each customer account; destroying the key makes them unreadable.
- Every recording download is logged; access is limited by role.
- Personal data scrubbed from error reports; analytics limited to internal ids.
- Separate production environments per region; whole-machine backups by our infrastructure provider.
- Staff access limited to those who need it. [counsel: owner to confirm MFA on every admin path before stating it]
More detail is on our security page. The signed DPA lists the full technical and organisational measures. [counsel: annex of technical and organisational measures]
International transfers
Call data is stored and processed in the region of your account. Some subprocessors process data outside that region, as shown on the subprocessors page. Where personal data subject to EU, UK or Swiss law is transferred to a country without an adequacy decision, the DPA incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2 controller to processor and Module 3 processor to processor) and the UK International Data Transfer Addendum, or relies on the EU-US Data Privacy Framework where the recipient is certified. [counsel: SCC annexes, Swiss amendments, transfer impact assessment; Quebec Law 25 transfer assessment and written agreement; PIPEDA clauses]
Breach notice
We will notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data. The notice will describe what happened, the data and people affected, the likely effects, and what we are doing about it, and we will update it as we learn more. We will help you meet your own notice duties.
Deletion and return
- During the account, data is kept for the periods in our privacy policy: recordings 90 days by default (you can shorten this or extend it up to 1 year), transcripts 1 year, compliance evidence 5 years.
- You can delete contacts and shorten recording retention through the dashboard and the API, and ask us at any time to export or delete any of your data.
- When your account closes we delete or return your data within 30 days, and remove it from backups within a further 90 days, except compliance evidence and records we must keep by law, which we keep securely for the required period and then delete. [counsel: deletion and backup windows; legal-hold carve-out for compliance evidence]
US state privacy laws
As a service provider under the CCPA and similar laws, we process your data only for the business purposes in the terms, do not sell or share it, do not combine it with other data except as those laws allow, and will tell you if we can no longer meet these duties. [counsel: CCPA/CPRA service-provider clauses in full]
Contact
To request the signed DPA or ask about it: privacy@larynth.com.