Data Processing Addendum (DPA) — WhiteBoxForge

Last updated: June 26, 2026 · Version 1.1

This DPA is incorporated into the Terms of Service between WhiteBoxForge ("Processor," "we") and the Client ("Controller," "you"). "WhiteBoxForge" means HarbingerScope LLC, a Texas limited liability company doing business as "WhiteBoxForge," 7727 Vacek Meadows Loop, Richmond, Texas 77469.

1. Roles

You are the Controller of personal data processed through the Service (including your callers' data). WhiteBoxForge is the Processor, acting on your documented instructions (your account configuration and these terms). For limited, anonymized analytics used to operate and improve the Service, WhiteBoxForge acts as an independent controller.

2. Scope & instructions

We process personal data only to provide the Service and as you instruct. We will not process it for our own unrelated purposes, will not sell it, and will not use it to train AI models.

3. Confidentiality

Personnel and contractors with access to personal data are bound by confidentiality obligations.

4. Security

We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and least-privilege access.

5. Sub-processors

You authorize the sub-processors listed at /legal/subprocessors. We will give at least 14 days' advance notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds. We remain responsible for our sub-processors' performance.

6. Data-subject requests

We will assist you, taking into account the nature of processing, in responding to requests from data subjects (access, deletion, correction, etc.).

7. Personal-data breach

We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting your data, with the information reasonably available to help you meet your obligations.

8. Return & deletion

On termination, we will delete or return personal data within 90 days, except where retention is required by law.

9. Audits

On reasonable prior notice and no more than once per year (or after a breach), we will make available information necessary to demonstrate compliance, including third-party audit reports (e.g., SOC 2) where available.

10. United States only

The Service is provided in the United States and we do not transfer personal data processed on your behalf outside the United States. (No EU/UK Standard Contractual Clauses apply.)

11. CCPA

To the extent the CCPA/CPRA applies, WhiteBoxForge acts as a service provider: it will not sell or share personal information, will not retain/use/disclose it except to perform the Service, and certifies it understands these restrictions.

12. Liability & governing law

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the laws of the State of Texas.

Annex I — Details of Processing

Subject matter & purpose: providing the AI receptionist Service (answering/placing calls, conversing with callers, capturing caller details, scheduling appointments, generating and sending call summaries and booking notifications, and — where enabled — SMS). Duration: the term of the Terms plus any legally required retention. Categories of data subjects: the Client's callers and customers; the Client's personnel/administrators. Categories of personal data: identifiers (name, phone, email, address); call audio, transcripts, and summaries; appointment/booking details; communication content; calendar availability metadata; and usage/technical data. The Client must not submit special categories of data or PHI.

Annex II — Technical & Organizational Measures

Encryption in transit (TLS) and at rest; role-based, least-privilege access; authentication controls; network and application security; logging and monitoring; secure development practices; sub-processor due diligence; data-minimization and retention controls; and documented incident-response procedures.

Annex III — Sub-processors

As listed at /legal/subprocessors (incorporated by reference), identifying each sub-processor, its purpose, and processing location.

Contact: HarbingerScope LLC d/b/a WhiteBoxForge · 7727 Vacek Meadows Loop, Richmond, Texas 77469 · [email protected].