Data Processing Agreement

This Data Processing Agreement ("DPA") is between the business that uses Steward ("you", the controller) and Steward ("we", the processor). It is part of our Terms of Service.

You accept this DPA electronically when you accept the Terms, by ticking the box when you sign up or by clicking "Accept" in the dashboard. Article 28(9) GDPR allows this agreement to be made in electronic form, so no signature is needed. We keep a record of when and which version you accepted.

We process personal data only to provide Steward to you: answering and summarising phone calls, taking and managing bookings, sending booking SMS and emails, sorting and answering email, and the connections you turn on. Annex 1 lists the data, the people it is about, and how long we keep it.

We process personal data only on your documented instructions. Your instructions are these Terms, this DPA, and the settings and connections you choose in Steward. Turning on a connection, such as Zapier, a webhook, Slack, email notifications or Shopify, is your instruction to send the data that connection shows to that service.

If we believe an instruction breaks the GDPR or other data protection law, we will tell you, and we may refuse to follow it. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.

Everyone at Steward who can access personal data is bound by confidentiality. Our staff access a customer account only when needed for support or to fix a problem, with a recorded reason, for a limited time, and every access is logged.

We protect personal data with the technical and organisational measures in Annex 2, as required by Article 32 GDPR. We may improve these measures over time, but we will not lower the overall level of protection.

You give us general permission to use the sub-processors listed in Annex 3. We bind every sub-processor to data protection terms that are at least as protective as this DPA, and we remain responsible to you for their work.

We will tell you by email or in the dashboard at least 30 days before we add or replace a sub-processor. If you have a reasonable data protection objection, tell us within that time. If we cannot solve it, you may close your account before the change takes effect.

Services you connect yourself, such as Zapier, Shopify, Google, Microsoft or Slack, are not our sub-processors. You choose them and have your own agreement with them.

Some sub-processors are based in the USA. We transfer personal data there only with a legal safeguard under Chapter V GDPR: the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses.

Taking into account what we can reasonably do, we help you:

- Answer requests from people who want to see, correct, delete, restrict or move their data. If such a request comes to us, we forward it to you and do not answer it ourselves.
- Keep personal data secure, handle personal data breaches, carry out data protection impact assessments, and consult the Swedish Authority for Privacy Protection (IMY) where needed.

If we become aware of a personal data breach that affects your data, we will tell you without undue delay, and we aim to do so within 48 hours. We will tell you what happened, what data and people are affected, the likely consequences, and what we are doing about it. Reporting the breach to IMY and to the affected people is your decision and responsibility as the controller. We will help you with the information you need.

When you close your account, we delete your personal data within 30 days, unless the law requires us to keep it. Before that, you can ask us for a copy of your data. Backups are overwritten in their normal cycle.

We will give you the information you reasonably need to show that we follow this DPA. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do it, once a year with at least 30 days' notice. You pay for your own audit costs, and the audit must not disrupt our service or reveal other customers' data.

Liability under this DPA follows the limitation of liability in the Terms, to the extent the law allows. If this DPA and the Terms conflict on data protection, this DPA wins. This DPA applies for as long as we process personal data for you.

People the data is about: people who call your receptionist, your customers and people who book with you, people who email you, and your team members.

Personal data:
- Calls - phone number, the call transcript and summary, and what the caller tells the receptionist, such as name and preferred time. Audio is processed live and is not stored.
- Bookings - name, phone number, email if given, the service and time booked, and waitlist entries.
- Email (Steward Mail) - sender name and address, the content of emails in the inbox you connect, and replies and drafts.
- Store data (if you connect Shopify) - order details, such as order number, items, status and the customer's name and contact details, read when someone asks about their order.

Sensitive data: Steward is not built for health information, data about crimes or other special categories of personal data. Do not use it to collect such data beyond what is strictly needed to book an appointment. Exports to automation tools never include full transcripts, and some connections are not available for healthcare businesses.

How long we keep it:
- Caller data (number, transcript, summary) - deleted 14 days after the call. Only anonymous statistics remain.
- Email data - deleted 90 days after it was received.
- Bookings - kept until you delete them or close your account.
- Everything - deleted within 30 days after you close your account.

- Encryption in transit (TLS) and encryption of stored data.
- Secrets and connection keys stored encrypted.
- Access control: each business only sees its own data, enforced in the database.
- Staff access only for support, with a recorded reason, a 30-minute time limit and a log.
- Automatic deletion of caller data after 14 days and email data after 90 days.
- Data sent to other services is limited to approved fields, and connections that keep failing are switched off automatically.
- Logs kept for 90 days to investigate problems and abuse.

| Provider | What it does | Location |
|---|---|---|
| Supabase | Database and login | EU (Frankfurt) |
| Railway | Hosting of the application (logs are stored in the USA for 90 days) | EU/USA (SCCs applied) |
| 46elks | Phone calls and SMS | EU (Sweden) |
| OpenRouter | AI language processing, routed to the AI model providers it works with | USA (SCCs applied) |
| ElevenLabs | Voice synthesis | USA (SCCs applied) |
| Deepgram | Speech-to-text | USA (SCCs applied) |
| Resend | Sending email | USA (SCCs applied) |
| Stripe | Payments (your billing only) | USA/EU (SCCs applied) |

You need to tell your customers how your business handles their data. You can copy this text into your own privacy notice and change it to fit:

"When you call or email us, or book with us, we use Steward, an AI service, to answer, take bookings and handle messages. You are always told when you talk to our AI assistant. Steward handles your data on our behalf: your phone number, what you tell us, and your booking. Calls are transcribed, and the transcript is deleted after 14 days. We use your data to help you and to manage your booking (GDPR Article 6(1)(b) and (f)). You can ask us to see, correct or delete your data at any time."