Legal

Vendor Data Processing Agreements

Effective Date: May 19, 2026 · Version 1.0

This document sets out the data processing agreements in place with each third-party vendor Radiant Calls engages to deliver its service, what data each vendor processes, and the key terms that apply.

1. Purpose & Scope

Radiant Calls ("Radiant Calls") operates an AI-powered voice receptionist service. To deliver this service, Radiant Calls engages a number of third-party vendors who process personal data on its behalf. By using Radiant Calls, business clients and their callers acknowledge that personal data will be processed by the vendors listed below in accordance with each vendor's DPA. Radiant Calls requires all vendors to meet its data protection standards and has confirmed that a DPA or equivalent agreement is in place with each vendor listed herein.

2. Radiant Calls as Data Controller

For the purposes of data protection law, Radiant Calls acts as the data controller in respect of caller personal data. Each vendor listed below acts as a data processor on Radiant Calls's behalf, processing data only as instructed by Radiant Calls and only for the purposes required to deliver the service.

3. Vendor Agreements

Vapi Inc.

AI Voice Processor

Role Powers the AI agent that handles inbound phone calls, conducts conversations, and generates end-of-call reports including transcripts and structured lead data. Data processed Caller voice audio; call transcripts; call metadata (call ID, duration, timestamps); assistant configuration and prompts. DPA status Incorporated into Vapi Terms of Service. Vapi acts as a data processor on behalf of Radiant Calls. DPA URL vapi.ai/terms-of-service

Vapi processes data solely to provide and improve the voice AI service
Data use is limited to enhancing call features, latency, and AI performance
Each sub-provider (transcription, LLM, voice generation) has its own contractual terms
GDPR-compliant; HIPAA-capable accounts available

Note: Vapi does not monitor or guarantee sub-provider compliance on Radiant Calls's behalf. Radiant Calls reviews the terms of any sub-providers enabled within its Vapi configuration.

Twilio Inc.

Telephony & SMS

Role Provisions the inbound phone number, routes calls to Vapi, handles the fallback IVR flow, and sends outbound SMS notifications to the business owner. Data processed Caller phone numbers (via caller ID); SMS message content (lead summary); call routing metadata. DPA status Automatically incorporated into Twilio Terms of Service. Updated April 2025. DPA URL twilio.com/legal/data-protection-addendum

Twilio processes customer data as a processor, except for Communications Usage Data where it acts as an independent controller for billing and fraud prevention
Certified under the EU-US Data Privacy Framework and Swiss-US DPF
Twilio may process data for AI model training to combat spam and fraud
Radiant Calls is responsible for obtaining caller consent — call recording disclosure is included in the Radiant Calls opening greeting

Supabase Inc.

Database & Storage

Role Hosts the database where all caller lead records, transcripts, and call metadata are stored. Data processed All caller lead data: name, phone number, issue, callback time, call transcript, call ID, timestamps, tenant ID, notification status. DPA status Available for signature by emailing privacy@supabase.io. Version dated 14 March 2025. DPA URL supabase.com — DPA PDF

Supabase processes data solely for the purpose of providing hosted database services as instructed by Radiant Calls
Data is hosted on AWS infrastructure in the United States
Transfer mechanism for EU data: Standard Contractual Clauses (Module 2: Controller to Processor)
Row Level Security (RLS) is Radiant Calls's responsibility to configure

Action required: Sign and return the Supabase DPA to privacy@supabase.io to formalise the processor relationship, particularly before onboarding any EU-based clients.

Resend (Plus Five Five, Inc.)

Email Notifications

Role Delivers email notifications to the business owner when a new lead is captured. Data processed Business owner email address; email content including caller name, issue, callback time, and phone number. DPA status Incorporated into Resend Terms of Service upon account creation. DPA URL resend.com/legal/dpa

Resend acts as a data processor for email delivery; Radiant Calls is the data controller
Certified under the EU-US Data Privacy Framework and UK Extension
Does not use customer data for advertising or sell personal data
SOC 2 Type II and ISO 27001 certified infrastructure

Functional Software, Inc. (Sentry)

Error Monitoring

Role Captures runtime errors and performance data from the Radiant Calls server. Data processed Application error data; limited call metadata in error context (phone numbers are masked); server performance metrics. DPA status Available for self-service acceptance in Sentry account Settings > Legal & Compliance. Version 5.1.0. DPA URL sentry.io/legal/dpa

Sentry acts as a data processor; Radiant Calls is the data controller
Does not retain, use, or disclose personal data beyond providing the error monitoring service
Does not sell or share personal data under the CCPA
Self-certified under the EU-US Data Privacy Framework, UK Extension, and Swiss-US Framework

Action required: Accept the Sentry DPA under Settings > Legal & Compliance. Ensure full call transcripts are not being sent to Sentry — only masked, limited metadata should be included in error context.

Render Services, Inc.

Cloud Hosting

Role Hosts the Radiant Calls Express.js server that receives Vapi webhooks, processes leads, and serves the dashboard. Data processed All data processed by the Radiant Calls server passes through Render's infrastructure, including caller lead data in transit. Also processes Radiant Calls account and server usage data. DPA status Automatically incorporated into Render Terms of Service. DPA URL render.com/dpa

Render acts as a data processor; Radiant Calls is the data controller
Certified under the EU-US Data Privacy Framework as of January 6, 2025, including UK Extension and Swiss-US DPF
Processes personal data only as required to provide the hosting service
Application logs on free tier retained for 30 days

Note: Render free tier has limitations including shared infrastructure and shorter log retention. Consider upgrading to a paid plan for production deployments handling sensitive caller data.

4. Client Acknowledgement

By entering into an agreement with Radiant Calls, business clients acknowledge and agree to the following:

Radiant Calls engages the vendors listed above as sub-processors to deliver the Radiant Calls service
Each vendor processes data under a DPA that requires them to protect personal data to the standards described in this document
Caller personal data will be transferred to and processed by these vendors in the United States in accordance with applicable data transfer mechanisms (SCCs, EU-US Data Privacy Framework)
Radiant Calls remains the data controller and each vendor acts as a data processor
Business clients are responsible for their own compliance obligations as data controllers in respect of their customers' data
Clients may request a copy of any vendor DPA listed above for their own compliance records

5. Changes to Vendor Agreements

Radiant Calls will update this document when vendor DPAs change materially or when new vendors are added. Clients will be notified of material changes. This document should be reviewed annually as part of Radiant Calls's data protection compliance review.

6. Contact

Radiant Calls
Email: keshav@radiantcalls.com