How We Process Your Customers' Data

This Data Processing Agreement ("DPA") forms part of the RuleInside Terms of Service between Ruleinside LLC (trading as RuleInside), Wyoming filing ID 2023-001209068, 30 N Gould St, Ste 32376, Sheridan, WY 82801, United States ("RuleInside", "Processor") and the customer ("Merchant", "Controller"). It is accepted when the Terms of Service are accepted; no separate signature is required.

It governs RuleInside's processing of personal data relating to the Merchant's own customers and callers ("Shopper Data").

It does not govern the Merchant's own account data (name, email, billing identity, login). For that data RuleInside is an independent controller and the Privacy Policy applies.

1. Subject matter, duration, nature and purpose

2. Processing on documented instructions

2.1 RuleInside processes Shopper Data only on the Merchant's documented instructions, including as to transfers to a third country. The Terms of Service, this DPA, and the Merchant's configuration of the service in the RuleInside portal together constitute those instructions.

2.2 If RuleInside becomes subject to a legal requirement to process Shopper Data otherwise, it will inform the Merchant before processing, unless that law prohibits the notification on important grounds of public interest.

2.3 RuleInside will inform the Merchant if, in its opinion, an instruction infringes applicable data protection law, and may suspend the affected processing until the instruction is withdrawn or amended.

2.4 RuleInside does not use Shopper Data to train, fine-tune or improve any model, and does not sell or share it for advertising.

3. Confidentiality

3.1 RuleInside ensures that persons authorised to process Shopper Data are bound by confidentiality obligations, whether contractual or statutory, that survive the end of their engagement.

3.2 Access is limited to those who need it to provide or support the service, and administrative access is recorded in an append-only audit log.

4. Security

RuleInside implements the technical and organisational measures in Annex II, having regard to the state of the art, the costs of implementation, the nature and purposes of processing, and the risk to data subjects. RuleInside may update those measures provided the level of protection is not reduced.

5. Sub-processors

5.1 The Merchant grants general written authorisation for RuleInside to engage sub-processors. Those engaged at the date of this DPA are listed in Annex III and published at ruleinside.com/sub-processors.

5.2 RuleInside gives the Merchant at least 14 days' notice before appointing a new or replacement sub-processor, by updating that page and notifying the Merchant's registered contact address.

5.3 The Merchant may object on reasonable grounds relating to data protection within that period. The parties will work in good faith to resolve the objection. If they cannot, the Merchant may terminate the affected part of the service without penalty and receive a refund of fees pre-paid for the terminated portion.

5.4 RuleInside imposes on each sub-processor, by written contract, data protection obligations substantially equivalent to those in this DPA, and remains fully liable to the Merchant for their performance.

5.5 Some processors in the chain are engaged by ElevenLabs, not by RuleInside - telephony, the language models that generate agent replies, and WhatsApp delivery for a Client whose messaging runs through ElevenLabs. RuleInside's obligation as to those parties flows through its contract with ElevenLabs. They are named in Annex III so that the chain is visible.

5.6 Where a Merchant connects its own WhatsApp Business Account to RuleInside, the Merchant accepts WhatsApp's business terms itself and WhatsApp processes the messages as the Merchant's processor. RuleInside exchanges messages with WhatsApp on the Merchant's instruction and without ElevenLabs in the path. RuleInside is not responsible for WhatsApp's own processing under the Merchant's agreement with WhatsApp.

5.7 Requests from public authorities. If RuleInside receives a legally binding request from a public authority for Personal Data processed under this Agreement, RuleInside shall: (a) review the request for legal validity before disclosing anything; (b) challenge the request where RuleInside considers it unlawful, and seek interim measures where available; (c) disclose only the minimum data necessary to comply; (d) record the request, the response, the legal reasoning and the parties involved; and (e) notify the Client unless legally prohibited from doing so, in which case RuleInside shall use reasonable efforts to obtain a waiver of that prohibition. RuleInside shall not grant any public authority direct or unfettered access to Personal Data.

6. Data subject rights

6.1 Taking into account the nature of the processing, RuleInside assists the Merchant by appropriate technical and organisational measures, insofar as possible, in fulfilling the Merchant's obligation to respond to requests under Chapter III GDPR.

6.2 The service provides subject access export and erasure, each scoped to a single data subject and covering both RuleInside's database and the conversation records held by ElevenLabs. The erasure also covers the copies of the Merchant's daily campaign reports kept in RuleInside's own mailbox, which RuleInside deletes by hand (Annex II); it does not reach Resend's copies of those reports, which Resend keeps for 30 days.

6.3 If RuleInside receives a request directly from a data subject relating to Shopper Data, it will not respond substantively and will refer the request to the Merchant without undue delay, save that it may confirm the request relates to the Merchant, or direct the individual to the Merchant, and save as provided in section 6.5, and save that a Shopper's unsubscribe from, or reply to, a cart reminder is acted on at once.

6.4 Records retained after an erasure are identified in Annex II. Consent and opt-out records (except the record of cart reminder ticks, which is deleted with its cart) are retained under Article 17(3)(b) GDPR, because deleting them would destroy the evidence that the person opted out. The do-not-email entries an erasure adds (Annex II) are kept so that no cart reminder is sent to the address after the erasure, and are used for nothing else.

6.5 Objection to recording. Where a Shopper tells the agent during a call that they do not want the call to be recorded, as identified by the service's automated analysis of the call, the Merchant instructs RuleInside to delete, and RuleInside deletes, the recording and transcript of that call, together with its summary, the answers collected from it, its sentiment and any forward of it not yet sent, both in RuleInside's database and in the conversation records held by ElevenLabs. RuleInside acts on the objection without referring it to the Merchant. RuleInside's own copies are deleted within minutes of the call reaching the service; the ElevenLabs conversation is deleted once the call has been counted for billing, normally within two days. RuleInside keeps the record that the call took place (date, duration, agent and outcome), the contact details the Shopper gave, any request the Shopper made during the call that the Merchant needs in order to act on it (for example a refund request with its stated reason, or an opt-out), and the conversation identifier, so that the call is never stored again; the portal shows the call as deleted at the caller's request. The deleted content cannot be recovered. A copy the Merchant receives or keeps outside the service, for example through its own webhook, is the Merchant's responsibility.

7. Breach, impact assessments and prior consultation

7.1 RuleInside notifies the Merchant without undue delay after becoming aware of a personal data breach affecting Shopper Data, and in any event in time to allow the Merchant to meet its 72-hour obligation under Article 33. The notification includes the nature of the breach, the categories and approximate numbers affected, the likely consequences, and the measures taken.

7.2 The accountable contact is info (at) ruleinside.com.

7.3 RuleInside provides reasonable assistance with data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to it.

8. Deletion or return

8.1 On termination or expiry, the Merchant may export Shopper Data through the service for 30 days.

8.2 At the end of that period RuleInside permanently deletes all Shopper Data, including the associated conversation records held by ElevenLabs, unless retention is required by law. This is a deletion, not a deactivation. Two things held by Resend for cart reminders are not reached by this deletion: an address on the suppression list of the reminder account because a reminder bounced stays there and keeps applying to every Merchant's reminders (Annex II), and Resend keeps its copies of reminder emails, Shopper replies and their forwards for 30 days. The copies of the Merchant's daily campaign reports kept in RuleInside's own mailbox are deleted within two months of each report (Annex II); Resend keeps its copies of those reports for 30 days.

8.3 At the Merchant's written election within the 30-day window, RuleInside will instead return the data in a structured, commonly used, machine-readable format and then delete it.

8.4 Deletion is confirmed in writing on request.

8.5 During the term, categories of Shopper Data expire automatically on the shorter periods in Annex II, except the copies of daily campaign reports in RuleInside's own mailbox, which RuleInside deletes by hand within the period Annex II states. Section 8 governs the end of the relationship; Annex II governs the life of the data within it.

9. Information and audits

9.1 RuleInside makes available to the Merchant all information necessary to demonstrate compliance with Article 28, including this DPA, Annex II and the sub-processor list.

9.2 RuleInside will respond to a written data protection questionnaire once in any twelve-month period, within 30 days.

9.3 Where the Merchant reasonably requires an audit, it may be conducted by the Merchant or an independent auditor it appoints who is not a competitor of RuleInside, on at least 30 days' written notice, during business hours, no more than once in any twelve-month period, subject to confidentiality, and at the Merchant's cost, except where the audit reveals material non-compliance, in which case RuleInside bears the reasonable cost. Additional audits may be conducted where required by a supervisory authority or following a personal data breach.

10. International transfers

10.1 Processing happens in two regions.

• The database is in the European Union (Ireland). It holds contact records, call metadata, the transcript copy, consent records, event history and the checkout carts kept for cart reminders.
• The voice pipeline is processed in the United States. Call audio and the primary transcript are handled there.
• Email goes through Resend, which stores its data in the United States, including cart reminder emails and Shoppers' replies to them.
• RuleInside's own mailbox is hosted by Google (Google Workspace), which may store the copy of each daily campaign report it holds in any country where Google or its sub-processors keep facilities.

10.2 RuleInside is a United States entity, so its access constitutes a transfer. Transfers rely on the Standard Contractual Clauses (Module Two, controller-to-processor) approved by Commission Implementing Decision (EU) 2021/914, and for UK transfers on the UK International Data Transfer Addendum (version B1.0), both incorporated into this DPA by reference and deemed executed on its taking effect.

10.3 Where a sub-processor holds a certification under the EU-U.S. Data Privacy Framework, that certification may be relied on in addition. ElevenLabs, who process the call audio, are certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Framework and the UK Extension.

10.4 EU-only processing of call audio is not available. A Merchant requiring it should raise this before entering into the agreement.

11. Special-category data

11.1 The service is not designed to process data within Article 9 GDPR, and the Merchant must not configure it to solicit such data.

11.2 RuleInside does not create a voiceprint or any other biometric identifier from caller audio. It stores recordings and transcripts of what was said; it does not derive a template that identifies a person by their voice.

11.3 Because a voice conversation, or a Shopper's reply to a cart reminder, is open-ended, a Shopper may volunteer special-category data unprompted, in words or in an attachment. Such data is subject to the same provisions as all other Shopper Data; an attachment to a reply is held only by Resend, for 30 days (Annex II, 'Retained past erasure').

12. Precedence

Where this DPA conflicts with the Terms of Service, this DPA prevails as to the processing of Shopper Data.

Annex I: Description of processing

As set out in section 1.

Annex II: Technical and organisational measures

Tenant isolation

Every query filters by store identifier. The service role bypasses row-level security, so the per-query filter, not row-level security, is the operative tenant boundary; row-level deny-all is defence in depth. One exception, for cart reminders: the email provider's suppression list on RuleInside's reminder account is shared by every Merchant for bounces (see "Fail-closed outbound"). Each entry holds the address, why it was added and the email that caused it; no Merchant can read the list. Reports and replies from the email provider are matched to their Merchant by an identifier RuleInside issued (the email or the reminder step), and everything after that is scoped to that Merchant.

Secrets management

All credentials are held in a managed secrets vault and fetched per use. Merchant API keys are stored hashed, never in plaintext.

Personal-data gating

Every path returning personal data requires a server-verified signed identity token. Caller ID is treated as spoofable: the inbound personalisation path forces the identity token empty and returns no personal data, so a spoofed number reaches a guest experience.

Audit logging

The administrative audit log is append-only; update, delete and truncate are revoked from the service role, so the identity performing an action cannot rewrite the record of it. Consent events are protected the same way.

Encryption

Data is encrypted in transit and at rest.

Fail-closed outbound

Calls pass four independent gates: opt-out, do-not-call, consent and calling window. WhatsApp messages pass the first three; marketing messages sent automatically also wait for the calling window, a message held for a missing time zone expires after 7 days, a code the Shopper requested is sent at once only within 24 hours of the request, and a marketing message the Merchant sends by hand to one person is sent at once. The one message confirming a Shopper's STOP or START is sent without the gates. Any error on any gate means the recipient is not contacted. A cart reminder email is sent only while the Shopper's tick for that cart stands, the Shopper has not replied to a reminder about that cart (a reply stops the reminders for every cart held for the address at that moment), the address is on no do-not-email entry of that Merchant (an unsubscribe, a bounce, a spam report about the Merchant's reminder, or an erasure carried out for the Merchant), the email provider does not refuse it, and the contact record RuleInside holds for the Merchant shows no opt-out from calls, WhatsApp messages or emails; an error on any of these checks means no email is sent. Reminders for every Merchant are sent from one RuleInside Resend account. Its suppression list is shared for bounces only: an address that bounced on any Merchant's reminder (the address does not exist) is not sent reminders for any Merchant. A spam report is kept as the reporting Merchant's own do-not-email entry and removed from the shared list, normally within minutes; until the removal lands, and if the email provider refuses it, other Merchants' reminders to that address are refused too; no Merchant records an entry from another Merchant's event. A Merchant whose Shoppers report its reminders as spam too often (at least 2 reports and more than 0.3% of its sends in 7 days) has its reminders paused, so one Merchant cannot harm the others' delivery.

Consent integrity

Ingestion never grants a contact's consent to be contacted; that consent is written by exactly one module. The one other consent, a Shopper's tick of a cart reminder box, which allows reminders about that one cart only, is recorded only from the Shopper's own checkout, on the cart's record and in an append-only log, and never becomes consent for any other contact.

Retention, as it runs

Automatic expiry sweeps run every 5 minutes: verbatim message text 180 days; conversations, sentiment and contact events 365 days; delivery logs 30 days; request-idempotency records 24 hours. Conversation records at ElevenLabs are deleted at 365 days, except where the Merchant brought its own ElevenLabs workspace, where they follow that workspace's settings as instructed by the Merchant; call audio at ElevenLabs is held for 90 days. A call whose Shopper objected to being recorded is deleted sooner, under section 6.5. A checkout held for cart reminders, with its tick record, reminder steps, email records and reply-forward records, and the record of an order placed at a store with cart reminders on, is deleted 30 days after its last activity (a change, a tick or untick, or an order). A copy of a daily campaign report kept in RuleInside's own mailbox is deleted by hand within two months of the report being sent (Google, which hosts that mailbox, can restore a deleted email for up to 55 days afterwards, then erases it for good); Resend keeps its copy for 30 days.

Retained past erasure

Consent and opt-out records (except the record of cart reminder ticks, which is deleted with its cart) survive an erasure request under Article 17(3)(b), because deleting them would destroy the proof that the person opted out. For a call deleted under section 6.5, the record that the call took place (date, duration, agent and outcome), the contact details the Shopper gave, any request the Shopper made during the call that the Merchant needs in order to act on it (for example a refund request with its stated reason, or an opt-out) and the conversation identifier are kept; the conversation identifier is what ensures the call is never stored again. An erasure adds a coded form of each email address in the request or on the contact records it matches, and of any address on a checkout found by the Shopper's phone number, to the Merchant's do-not-email list, kept until the Merchant's data is deleted, so that no cart reminder reaches that address again. This applies to every erasure, whether or not the Shopper ever ticked a cart reminder box. The code is made from the address rather than being the address; it can be checked by someone who already knows the address, and is treated as personal data. An erasure does not reach Resend: a Shopper address on Resend's suppression list because a reminder bounced stays there, and Resend keeps its copies of reminder emails, replies and forwards for 30 days. Nor does an erasure reach Resend's copies of daily campaign reports, kept for 30 days; the copies in RuleInside's own mailbox are deleted by hand.

Annex III: Sub-processors

Engaged directly by RuleInside

Where the Merchant connects its own WhatsApp Business Account, WhatsApp is not a sub-processor of RuleInside: it processes the messages as the Merchant's own processor (section 5.6).

Engaged by ElevenLabs, disclosed for chain visibility (section 5.5)

The current list is maintained at ruleinside.com/sub-processors.