Last updated: October 13, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the Customer and Sindarin Ventures, Inc ("Sindarin," "we," "us," or "our") that references or otherwise incorporates this DPA (the "Agreement"), including our Terms of Service. This DPA applies to the extent Sindarin Processes Customer Personal Data as a Processor on behalf of Customer in connection with the Services. This DPA may be updated by Sindarin from time to time to the extent permitted by applicable law.
In the event of any conflict between this DPA and any other terms of the Agreement with respect to data processing matters, this DPA shall prevail. This DPA is incorporated by reference into the Agreement and is subject to the terms and conditions of the Agreement, including the limitations of liability set forth therein.
Capitalized terms not defined in this DPA shall have the meanings ascribed to them in the Agreement or, if not defined therein, under Applicable Data Protection Laws.
The terms "Business Purpose," "Sell," "Selling," "Share," and "Shared" shall have the meanings given to them under the CCPA or Applicable Data Protection Laws in the U.S., as applicable.
2.1 This DPA applies to the extent Sindarin Processes Customer Personal Data as a Processor on behalf of Customer, where Customer is acting as a Controller or as a Processor for a Third-Party Controller. Details regarding the subject matter, nature, and purposes of the Processing, including the categories of Customer Personal Data and categories of Data Subjects, are set out in Section 3.
2.2 As between the Parties, Customer is responsible for compliance with the requirements of Applicable Data Protection Laws applicable to Controllers. In particular, Customer acknowledges and agrees that it will provide notice to Data Subjects about the Processing of Personal Data by Sindarin as described in this DPA, and obtain Data Subjects' consent to such Processing as necessary to comply with Applicable Data Protection Laws. In Processing Customer Personal Data hereunder, Sindarin shall comply with the relevant obligations under Applicable Data Protection Laws applicable to Processors.
2.3 Where Customer is a Processor on behalf of a Third-Party Controller, Customer: (i) is the single point of contact for Sindarin; (ii) must obtain all necessary authorizations from such Third-Party Controller in connection with this DPA; (iii) will ensure that the Third-Party Controller provides notice and obtains any consents necessary for Processing by Sindarin as set forth in this DPA; and (iv) as between the Parties, undertakes to issue all instructions and exercise all rights on behalf of such Third-Party Controller.
Sindarin Processes Customer Personal Data solely for the purpose of providing the Services as described in the Agreement. This section also serves as Annex I for the purposes of the SCCs incorporated under Section 11.
Customer Personal Data is retained in accordance with the Customer's configuration of the Services or, where no specific configuration is set, in accordance with Sindarin's standard retention practices. Retention may differ where required by applicable law.
Customer is responsible for:
Where Customer is a Processor on behalf of a Third-Party Controller, Customer shall ensure the upstream Controller fulfills the obligations described in this section.
Sindarin shall not Process Customer Personal Data other than: (i) on Customer's documented instructions; or (ii) as expressly required by applicable law. Customer's documented instructions for the Processing of Customer Personal Data are: (a) Processing in accordance with the Agreement, including this DPA; (b) Processing initiated by Customer's authorized users through their use and configuration of the Services; and (c) Processing to comply with other reasonable documented instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
Sindarin shall not be required to comply with any instruction that would cause it to violate applicable law. If Sindarin becomes subject to a legal obligation that requires it to Process Customer Personal Data in contravention of Customer's instructions, Sindarin will inform Customer of such obligation to the extent legally permitted.
Sindarin shall use commercially reasonable efforts to ensure, in relation to the protection of Customer Personal Data: (i) the reliability of any employee, agent, or contractor who may have access to Customer Personal Data; and (ii) that access to Customer Personal Data is strictly limited to those individuals who need to access the relevant data in carrying out their responsibilities under the Agreement.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks presented by the Processing, Sindarin shall implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk. These measures include, as relevant and applicable:
While Sindarin strives to protect Customer Personal Data, no method of transmission over the Internet or method of electronic storage is completely secure, and Sindarin cannot guarantee absolute security.
This section also serves as Annex II (Technical and Organizational Measures) for the purposes of the SCCs incorporated under Section 11.
7.1 General Authorization. Customer hereby grants Sindarin a general authorization to engage Sub-processors in accordance with this section.
7.2 Sub-processor Obligations. Sindarin will enter into a written agreement with each Sub-processor imposing relevant privacy and data security obligations in respect of Customer Personal Data.
7.3 Changes to Sub-processors. Sindarin will notify Customer at least thirty (30) days prior to appointing any new or replacement Sub-processor by updating this DPA or providing email notification. Customer may, on reasonable grounds relating to data privacy or data security, object to the addition or replacement of a Sub-processor by providing written notice detailing the grounds of such objection within fourteen (14) days of notification. In such case, Customer and Sindarin will work together in good faith to address Customer's objection. To the extent the Parties are unable to reasonably resolve the objection within thirty (30) days, either Party may terminate the Services requiring the use of such Sub-processor upon written notice.
7.4 Liability. Sindarin shall be liable for its own acts and omissions in connection with its obligations under this section, including the selection of Sub-processors and the imposition of contractual data protection obligations. Sindarin shall not be liable for the independent acts or omissions of Sub-processors to the extent such acts or omissions are beyond Sindarin's reasonable control, provided that Sindarin has complied with its obligations under this section.
Customer's data is processed only by the Sub-processor(s) applicable to their deployment configuration; not all listed Sub-processors receive data from every Customer. Self-hosted datastores on Sindarin-controlled infrastructure are not Sub-processors.
Conversation data is processed by these providers to generate AI responses.
| Provider | Location |
|---|---|
| OpenAI (incl. Realtime API) | USA |
| Anthropic (Claude) | USA |
| Together AI | USA |
| Google Cloud Platform (Vertex AI / Gemini) | USA |
| Fireworks AI | USA |
| Groq | USA |
| SambaNova | USA |
| Cerebras | USA |
| DeepInfra | USA |
| Friendli | USA |
| Crusoe | USA |
| Parasail | USA |
| SpaceXAI (xAI / Grok) | USA |
| Meta (Meta Model API / Muse) | USA |
Audio data is processed by these providers for text-to-speech and speech-to-text.
| Provider | Location |
|---|---|
| ElevenLabs | USA / EU |
| Deepgram | USA |
| LMNT | USA |
| Cartesia | USA |
| Rime | USA |
| Provider | Location |
|---|---|
| Twilio | USA |
| Telnyx | USA |
| Provider | Location |
|---|---|
| Google Cloud Platform (Cloud Storage, Vertex AI) | USA |
| Microsoft Azure | USA |
| Latitude.sh | USA |
| Cloudflare | USA |
Customer user accounts and authentication.
| Provider | Location |
|---|---|
| Auth0 | USA |
| Provider | Location |
|---|---|
| Stripe | USA |
| Provider | Location |
|---|---|
| Datadog | USA |
| Provider | Location |
|---|---|
| Segment (Twilio) | USA |
Used to send notifications, such as call summaries and alerts, to Customer's users.
| Provider | Location |
|---|---|
| Customer.io | USA |
| Resend | USA |
Used by Sindarin personnel to build, evaluate, debug and support the service.
| Provider | Location |
|---|---|
| Cursor (Anysphere) | USA |
| GitHub | USA |
| Google Workspace | USA |
| Slack | USA |
8.1 Upon Customer's written request, and taking into account the nature of the Processing and the information reasonably available to Sindarin, Sindarin shall provide commercially reasonable assistance to Customer in fulfilling requests for the exercise of Data Subject Rights in relation to Customer Personal Data Processed hereunder.
8.2 If Sindarin receives a request from a Data Subject under any Applicable Data Protection Laws in respect of Customer Personal Data, Sindarin may respond to direct the individual to the Customer and shall not otherwise respond to such request except on the documented instructions of Customer or as required by applicable law.
8.3 Assistance beyond Sindarin's standard capabilities shall be at Customer's expense.
To the extent required under Applicable Data Protection Laws, Sindarin shall provide commercially reasonable assistance to Customer in conducting data protection impact assessments and prior consultations with supervisory authorities or other competent data privacy authorities, to the extent relevant to the Processing of Customer Personal Data by Sindarin under the Agreement and to the extent Customer does not otherwise have access to the relevant information. Such assistance shall be at Customer's expense.
10.1 Sindarin shall notify Customer without undue delay upon confirming a Security Incident, providing Customer with reasonable information relating to such Security Incident, including information required to be provided by Sindarin to Customer under Applicable Data Protection Laws.
10.2 Sindarin shall, upon Customer's reasonable request, provide commercially reasonable assistance and cooperation in connection with Customer's investigation and mitigation of each such Security Incident.
10.3 Sindarin shall not notify any Data Subject or third party of a Security Incident without Customer's prior authorization, unless required to do so by applicable law.
11.1 Customer hereby authorizes Sindarin to perform Data Transfers: (i) to any country deemed to have an adequate level of data protection by the European Commission, including on the basis of the EU-US Data Privacy Framework, or by other competent authorities (including those of the UK and Switzerland), as applicable to the Data Transfer; (ii) pursuant to the SCCs referred to in this section, as applicable; or (iii) on the basis of other adequate safeguards as permitted by Applicable Data Protection Laws.
11.2 In respect of the SCCs incorporated herein: (i) the Parties agree such SCCs shall be deemed executed upon this DPA taking effect; (ii) the Parties conclude the relevant module applicable to Controller-to-Processor transfers, or, to the extent Customer is a Processor of a Third-Party Controller, the Processor-to-Processor module; (iii) Sindarin shall be deemed the "data importer" and Customer shall be deemed the "data exporter"; and (iv) Section 3 (Description of Processing) and Section 6 (Security Measures) of this DPA shall serve as Annex I and Annex II of the respective SCCs, and the list of Sub-processors in Section 7 shall serve as Annex III.
11.3 The Parties agree the EEA SCCs shall be further completed as follows: (i) the optional docking clause in Clause 7 does not apply; (ii) Option 2 of Clause 9(a) is implemented and the time period therein is thirty (30) days as specified in Section 7.3 above; (iii) the optional redress clause in Clause 11(a) is struck; (iv) Option 1 in Clause 17 is implemented and the governing law is the law of the State of Texas, USA; and (v) the courts in Clause 18(b) are the courts of the State of Texas, USA.
11.4 With respect to Personal Data transferred from Switzerland for which Swiss law (and not the law in the EEA) governs the Data Transfer, the EEA SCCs will be deemed to be modified as follows to the extent required by the Swiss Federal Act on Data Protection ("FADP"): (i) references to the GDPR are understood as references to the FADP insofar as the Data Transfer is subject exclusively to the FADP and not to the GDPR; and (ii) the term "member state" shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EEA SCCs.
11.5 For transfers of Personal Data subject to UK data protection law, the UK Addendum to the EEA SCCs shall apply. The Parties agree: (i) in Table 2, the first option is selected and the "Approved EU SCCs" are the EEA SCCs as completed in Section 11.3 of this DPA; and (ii) in Table 4, "Importer" is selected.
11.6 Customer Personal Data is currently hosted in the United States.
12.1 Upon reasonable written request and no more than once per year, Sindarin shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA, which may include responses to reasonable compliance questionnaires and summaries of Sindarin's security practices. The Parties agree that the provision of such information shall satisfy any audit rights Customer may have under Applicable Data Protection Laws.
12.2 All information provided by Sindarin under this section shall be deemed the confidential information of Sindarin and used by Customer solely for the purposes of meeting its obligations under Applicable Data Protection Laws.
To the extent Applicable Data Protection Laws in the U.S. apply in relation to Sindarin's Processing of Customer Personal Data hereunder:
14.1 This DPA shall automatically terminate upon the termination of the Agreement.
14.2 Upon termination or expiration of the Agreement, Customer may submit a written request for deletion of Customer Personal Data. Following receipt of such request, Sindarin shall delete the applicable Customer Personal Data within ninety (90) days. If no such request is received, Customer Personal Data will be deleted in accordance with Sindarin's standard data retention practices.
14.3 Notwithstanding the foregoing, Sindarin may retain Customer Personal Data to the extent:
14.4 Any Customer Personal Data retained pursuant to Section 14.3 shall remain subject to the confidentiality obligations set forth in the Agreement for so long as it is retained.
15.1 This DPA is effective as of Customer's acceptance of the Agreement and shall remain in effect for the duration of Sindarin's Processing of Customer Personal Data under the Agreement.
15.2 Liability under this DPA is subject to the limitations of liability set forth in the Agreement.
15.3 This DPA shall be governed by and construed in accordance with the laws of the State of Texas, USA, without regard to its conflict of laws principles.
15.4 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
15.5 This DPA, together with the Agreement, constitutes the entire agreement between the Parties with respect to the Processing of Customer Personal Data and supersedes all prior or contemporaneous agreements relating to such subject matter.
If you have questions about this Data Processing Addendum or our data processing practices, please contact us:
For our Terms of Service, please visit api.sindarin.tech/tos. For our Privacy Policy, please visit api.sindarin.tech/privacy.