Data Processing Addendum

Template agreement. OplyAI LLC, Cushing, Oklahoma. Last updated October 29, 2026.

Roles: Client = business/controller; OplyAI = service provider/processor (CCPA/CPRA "service provider").

Data: caller name, phone, email, address, job details, call audio, transcripts, booking details. No sensitive/health data unless a BAA is signed. Client account data: business contact name, email, phone, business details, hours, services, and billing records.

Purpose: only to provide the Services. OplyAI will not sell or share personal information, or use it to train general AI models.

Security: TLS in transit, access limited to OplyAI personnel who need it, per-client credentials, revocable OAuth tokens.

Subprocessors: listed at oplyai.com/subprocessors; 14 days' notice of new ones; Client may object and terminate.

Retention: recordings 90 days; transcripts/call logs 12 months; booking records while the account is active + 30 days; deleted or returned on termination within 30 days; calendar/email OAuth tokens until disconnected or revoked, or when service ends; billing records 7 years, as tax law requires.

Breach notice: without undue delay, within 72 hours of confirmation.

Requests: OplyAI helps Client respond to consumer access/deletion requests within 10 business days. Client may request deletion of its data, or a specific caller's data, by emailing hello@oplyai.com; OplyAI deletes it within 30 days, except records the law requires us to keep.

Governing law: Oklahoma, matching the Terms of Service and the MSA.