Data Processing Addendum

High Level Claw (gohighclaw.app)
Effective date: 2026-09-18
Last updated: 2026-09-23
Processor: Open Claw Assistance LLC, a Wyoming limited liability company, 30 N Gould St #21315, Sheridan, WY 82801, USA

This Data Processing Addendum ("DPA") is part of the Terms of Service between Open Claw Assistance LLC ("Processor", "we", "us") and the Customer ("Controller", "you"). It applies whenever we process Personal Data on your behalf in the course of providing the Service. It takes effect automatically when you accept the Terms of Service; no signature is needed. Customers who require a countersigned copy for their records may request one at support@openclawassistance.com. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Definitions

• "Data Protection Laws" means all laws that apply to the processing of Personal Data under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other United States state privacy laws, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection, in each case as amended.
• "Personal Data" means information relating to an identified or identifiable natural person that we process on your behalf. Under the CCPA it has the meaning of "personal information".
• "Contact Data" means Personal Data about your Contacts, as defined in the Terms of Service.
• "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority", and "Personal Data Breach" have the meanings given in the GDPR. "Business", "Service Provider", "Sell", and "Share" have the meanings given in the CCPA.
• "Subprocessor" means a third party we engage to process Personal Data on your behalf.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles and scope

2.1 You are the Controller (or Business) of Contact Data and any other Personal Data you upload to, or collect through, the Service. We are your Processor (or Service Provider) for that data.

2.2 We are an independent Controller for account, billing, security, and usage data about you and your Authorized Users, as the Privacy Policy describes. This DPA does not apply to that data.

2.3 Subject matter and duration. We process Personal Data to provide the Service for the term of the Terms of Service and the deletion period in Section 10.

2.4 Nature and purpose. Hosting, storing, transmitting, transcribing, analyzing with AI models, generating content from, and displaying Personal Data to operate your CRM, Inbox, phone line, texting, email, calendar, contracts, payments, websites, automations, and reporting, as you configure them.

2.5 Categories of Data Subjects. Your leads, prospects, customers, callers, texters, email recipients, contract signers, website visitors, booking parties, and the individual representatives of businesses you deal with.

2.6 Categories of Personal Data. Names, phone numbers, email addresses, postal addresses, company and role, communication content (texts, emails, call recordings and transcripts, voicemails, form submissions), appointment details, documents and signatures, invoice and payment status (not card numbers), notes, tags, pipeline stage, consent and opt-out records, IP addresses and device data from public pages, and any other information you choose to store.

2.7 Sensitive data. The Service is not designed for special categories of data (health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, sexual orientation), government identification numbers, payment card numbers, or data subject to HIPAA, GLBA, FERPA, or COPPA. You must not submit such data unless we have agreed in writing to the required safeguards. Call recordings and transcripts may incidentally capture such data from what a caller says; you are responsible for configuring recording and retention accordingly.

3. Your obligations

You will: (a) have a lawful basis, and the consents that Data Protection Laws and telecommunications laws require, for every processing activity you direct through the Service; (b) give Data Subjects the notices they are entitled to, including the privacy notice on your Tenant Sites and the messaging terms in the SMS Messaging Terms and Consent; (c) give us only documented instructions that comply with Data Protection Laws; (d) respond to Data Subject requests; and (e) configure the Service's retention, recording, consent, and access settings appropriately for your business.

4. Our obligations

We will:

4.1 Process only on your documented instructions. Your instructions are the Terms of Service, this DPA, your configuration of the Service, and the actions you and your Authorized Users take in it. We will tell you if we believe an instruction violates Data Protection Laws, unless the law prohibits us from doing so. We will process Personal Data outside your instructions only when required by law, in which case we will inform you of the legal requirement before processing unless the law prohibits that.

4.2 CCPA service provider commitments. We will not: sell or share Personal Data; retain, use, or disclose it for any purpose other than the business purposes specified in the Terms of Service and this DPA, or outside the direct business relationship between us; or combine it with Personal Data we receive from others, except as the CCPA permits for a service provider. We certify that we understand and will comply with these restrictions. We will notify you if we can no longer meet our obligations under the CCPA, and you may take reasonable steps to stop and remediate unauthorized use.

4.3 Confidentiality. Personnel authorized to process Personal Data are bound by written confidentiality obligations and receive security and privacy training. Access is limited to what their role requires.

4.4 Security. We implement the technical and organizational measures in Annex 1 and will not materially reduce them during the term.

4.5 Assistance. Taking into account the nature of the processing, we will assist you, through the features of the Service and, where needed, additional reasonable assistance, in responding to Data Subject requests, in meeting your obligations regarding security, breach notification, data protection impact assessments, and prior consultation with a Supervisory Authority.

4.6 Data Subject requests. If a Data Subject contacts us directly about Personal Data we process for you, we will direct them to you and, where they identify you, forward the request to you within 5 business days. We will not respond on your behalf unless you instruct us to or the law requires.

4.7 Audits. Upon written request no more than once per year (or after a Personal Data Breach affecting your data), we will make available the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation, a summary of our most recent security assessment, and written answers to a reasonable security questionnaire. If that information is not sufficient to demonstrate compliance, you or an independent auditor bound by confidentiality may conduct an audit at your expense, on at least 30 days' notice, during business hours, without disrupting our operations, and subject to our reasonable security requirements. We will make available the audit reports of Subprocessors to the extent they are made available to us.

5. Subprocessors

5.1 General authorization. You authorize us to engage the Subprocessors listed in Annex 2 and any replacement or additional Subprocessor under this Section.

5.2 Notice of changes. We will publish the current list in the Service and notify Account owners by email or in-app notice at least 15 days before a new Subprocessor begins processing Contact Data. Emergency replacements needed to keep the Service secure or available may be made on shorter notice with prompt notification.

5.3 Objection. If you have a reasonable, data-protection-based objection to a new Subprocessor, tell us within 15 days of the notice. We will work with you in good faith to find a solution. If none is available, you may terminate the affected Organization or your Account and receive a prorated refund of prepaid subscription fees for the unused period.

5.4 Flow-down and liability. We impose data protection obligations on each Subprocessor that are substantially the same as those in this DPA, by written contract. We remain liable to you for the performance of each Subprocessor's obligations.

5.5 Your own providers. Providers you connect with Customer Keys or your own accounts (for example your Anthropic, OpenAI, Google Gemini, KIE, HeyGen, ElevenLabs, Twilio, Resend, or Zernio accounts, and your Google Workspace and Stripe accounts) are your processors, engaged by you under your own contracts. They are not our Subprocessors, and we are not responsible for their processing. The BYOK and Third-Party Services Terms explain this.

6. International transfers

6.1 We process Personal Data in the United States and in the locations of our Subprocessors listed in Annex 2.

6.2 To the extent you transfer Personal Data subject to the GDPR, UK GDPR, or Swiss law to us, the parties agree that the transfer is governed by the SCCs (Module Two, controller to processor), which are incorporated by reference, with these selections: Clause 7 (docking) applies; Clause 9(a) Option 2 (general authorization) with the notice period in Section 5.2; Clause 11 optional language does not apply; Clause 13 and Annex I.C: the Supervisory Authority of the EU member state where you are established; Clause 17: the law of Ireland; Clause 18: the courts of Ireland; Annex I is completed by Sections 2.3 to 2.6 and the parties' details in the Terms of Service; Annex II is Annex 1 of this DPA; Annex III is Annex 2 of this DPA. For UK transfers, the UK Addendum applies with Table 1 completed by the parties' details, Tables 2 and 3 by the selections above, and either party may end the Addendum as set out in Section 19 of the Addendum. For Swiss transfers, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Federal Data Protection and Information Commissioner.

6.3 Where a Subprocessor is certified under the EU-US, UK, or Swiss-US Data Privacy Framework, we may rely on that certification for onward transfers. We will inform you if we become aware that we or a Subprocessor can no longer comply with the applicable transfer mechanism.

7. Personal Data Breach

7.1 We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data we process for you. Notice goes to the Account owner's email and the security contact you set in Settings.

7.2 The notice will describe, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed to address it; and a contact point. We may provide information in phases as it becomes available.

7.3 We will cooperate with you and take reasonable steps to contain, investigate, and mitigate the breach. Our notice is not an admission of fault or liability.

7.4 You are responsible for notifying Supervisory Authorities, Data Subjects, and others as Data Protection Laws require, except where we are required to notify directly.

8. Telecommunications and registry disclosures

You acknowledge that operating Telecom Services requires us to share certain Personal Data with our carrier, wireless carriers, and The Campaign Registry: your business registration information, message content and metadata, call detail records, and, when a complaint or audit occurs, the consent records and message history relevant to the complaint. These disclosures are part of your instructions.

9. AI processing

Prompts derived from Personal Data are sent to AI model providers to produce Output. For platform-funded tasks, those providers are the Subprocessors marked in Annex 2, engaged under commercial API terms that prohibit training on API data and limit retention to what is needed for abuse monitoring. For tasks running on Customer Keys, the provider is your processor under Section 5.5. We do not use Personal Data to train models. We pseudonymize or minimize Personal Data in prompts where the feature allows.

10. Return and deletion

10.1 During the term you can export Personal Data at any time from the Service in standard formats (CSV and JSON for records, original formats for files and recordings).

10.2 Within 30 days after termination of the Terms of Service, or after you delete an Organization, we will delete all Personal Data from production systems, and within 90 days from backups, unless retention is required by law or by Section 10.3. Deletion is performed by the Service's verified deletion process and a certificate is available on request.

10.3 We retain consent, opt-out, and STOP records for 5 years after the last message, 10DLC registration records for 4 years after campaign closure, and billing records for 7 years, because telecommunications and tax law require them. These records are minimized to the fields the requirement needs and remain protected under Annex 1.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Laws or the SCCs do not permit limitation. If this DPA conflicts with the Terms of Service, this DPA controls for the processing of Personal Data. If the SCCs conflict with this DPA, the SCCs control.

12. Changes

We may update this DPA to reflect changes in Data Protection Laws, Subprocessors, or the Service, with 30 days' notice of material changes. Changes required by law take effect when the law requires.

Annex 1: Technical and organizational security measures

Architecture and isolation

• Multi-tenant application with every customer record carrying an organization id; every database query is scoped to the organization; contract tests verify isolation on each release.
• Per-organization phone numbers, messaging profiles, and carrier billing groups; voice worker routes calls by organization with a per-organization kill switch.
• Public pages, webhooks, and APIs are separated from authenticated routes; all webhooks verify provider signatures; rate limits on every public route.
• Server-side request forgery guards on onboarding scans and automation webhook steps: private address ranges blocked, allowlists where applicable.

Encryption

• TLS 1.2 or higher for all traffic in transit, including between the application and Subprocessors.
• Encryption at rest for databases, object storage, and backups, provided by the hosting Subprocessors (AES-256 or equivalent).
• Customer Keys and OAuth tokens encrypted at the application layer with AES-256-GCM using keys held only in platform environment secrets, never in the database or source code; deleted when the connection is removed.
• Call recordings stored in encrypted object storage with expiring signed URLs.

Access control

• Role-based access in the Service (owner, admin, staff, agency) with organization membership checks on every request.
• Staff access to production is limited to named personnel, protected by multi-factor authentication and hardware-backed sign-in where available, and logged. No standing access to customer content; access is for support with the customer's request or for security investigation, and is recorded.
• Platform secrets in environment configuration only; secret scanning in the repository; rotation on personnel change or suspected exposure.

Logging, monitoring, and integrity

• Per-organization append-only audit chain with hash linking and a scheduled tamper check.
• Receipts for every AI action, Credits spend, and telecom charge.
• Centralized error monitoring, health checks, uptime probes, and escalation alerts.
• Security and audit logs retained 13 months; application logs 30 days.

Software development

• All changes pass automated tests, lint, type checks, and a production build before deploy; contract tests cover tenancy, billing, and compliance rules.
• Dependency updates and vulnerability scanning; accessibility gate (WCAG 2.2 AA).
• No production data in development environments; keyless demo mode for testing.

Availability and resilience

• Managed, replicated database with point-in-time recovery; rolling backups purged within 90 days.
• Durable job execution with retries, timeouts, and idempotency keys; failed jobs recorded and escalated.
• Incident response procedure with defined roles, customer notification within the periods in Section 7, and post-incident review.

Data lifecycle

• Configurable retention for call recordings; documented retention schedule in the Privacy Policy.
• Self-service export and deletion; verified deletion process with certificate on request.

People and policy

• Confidentiality agreements and privacy and security training for personnel.
• Subprocessor due diligence and written data protection terms before engagement.
• Annual review of this Annex.

Annex 2: Subprocessors

Current as of 2026-09-18. The live list is published in the Service at Settings > Legal > Subprocessors.