Skip to content
Frontwren

Legal

Data Processing Addendum

Last updated: October 29, 2026

This Data Processing Addendum ("DPA") is part of the Frontwren Terms of Service. It describes how Goldren Studio LLC processes personal information on behalf of customers, and includes the service provider and processor terms required by US state privacy laws such as the CCPA/CPRA and similar laws in other states.

1. Definitions and roles

"Customer Personal Data" means personal information in Customer Data that Goldren Studio LLC ("Processor") processes on behalf of Customer under the Terms. "Privacy Laws" means US federal and state laws that apply to that processing, including the California Consumer Privacy Act as amended (CCPA) and comprehensive privacy laws in other states.

For Customer Personal Data, Customer is the "business" or "controller", and Goldren Studio LLC is the "service provider", "contractor" or "processor". This DPA applies automatically; no signature is required. If you need a countersigned copy, email legal@frontwren.com.

2. Details of processing

  • Subject matter and purpose: providing the AI receptionist Service: answering and routing calls, conversations, booking, messaging, notifications, call records, analytics for Customer, and related support and security.
  • Duration: the term of the Terms, plus the deletion period below.
  • Data subjects: Customer's callers, customers, leads and contacts, and Customer's team members.
  • Types of data: names, phone numbers, email and postal addresses, call audio, transcripts, summaries, message contents, appointment details, consent and opt-out records, and any other information callers share. Voice data of the account owner if Your Own Voice is used.
  • Sensitive data: Customer will not configure the Service to collect sensitive personal information (such as health, financial account or government ID information) except as permitted by the Terms.

3. Processor obligations

Goldren Studio LLC will:

  • process Customer Personal Data only on Customer's documented instructions (the Terms, this DPA and Customer's configuration of the Service) and for the specific business purposes of providing the Service;
  • not sell or share Customer Personal Data, as those terms are defined in the CCPA, and not use it for cross-context behavioral advertising;
  • not retain, use or disclose Customer Personal Data outside the direct business relationship with Customer, or for any purpose other than providing the Service, except as permitted by Privacy Laws;
  • not combine Customer Personal Data with personal information received from other sources, except as permitted by Privacy Laws;
  • not use Customer Personal Data to train AI models made available to other customers;
  • comply with applicable Privacy Laws and provide the same level of privacy protection they require;
  • ensure that people authorized to process Customer Personal Data are bound by confidentiality;
  • notify Customer if it determines it can no longer meet its obligations under Privacy Laws.

Customer may take reasonable and appropriate steps to ensure that Processor uses Customer Personal Data consistent with Customer's obligations under Privacy Laws, and to stop and remediate unauthorized use.

4. Subprocessors

Customer authorizes Processor to engage the subprocessors listed on our Security page: Twilio, ElevenLabs, Anthropic, Stripe, Resend, Vercel and Neon, plus Google and Microsoft APIs when Customer connects its own accounts.

Processor will bind each subprocessor by written contract to data protection terms at least as protective as this DPA, and remains responsible for its subprocessors. Processor will give notice of new subprocessors by updating the list and, for material changes, by email at least 15 days in advance. Customer may object on reasonable data protection grounds by emailing legal@frontwren.com; if we can't resolve the objection, Customer may terminate the affected Service.

5. Security

Processor maintains reasonable administrative, technical and physical safeguards appropriate to the nature of the data, including:

  • encryption in transit (TLS) and at rest, with additional application-level AES-256-GCM encryption for credentials and tokens;
  • logical separation of each customer's data and authorization checks on every request;
  • role-based access, two-factor authentication and least-privilege access for personnel;
  • audit logging of sensitive actions;
  • signature verification on provider webhooks and rate limiting of abuse-prone endpoints;
  • logging practices that avoid recording message contents, transcripts and full phone numbers.

6. Security incidents

Processor will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a security incident affecting Customer Personal Data. The notice will describe the incident, the data affected, the steps taken and a contact point, and Processor will provide reasonable help so Customer can meet its own notification duties.

7. Assistance and consumer requests

Taking into account the nature of the processing, Processor will help Customer respond to consumer requests to access, correct or delete personal information, and with data protection assessments, through Service features or on request. If Processor receives a request directly from a consumer about Customer Personal Data, it will refer the consumer to Customer and won't respond except as instructed or required by law.

8. Information and audits

On reasonable written request, no more than once per year, Processor will make available information necessary to demonstrate compliance with this DPA, such as security documentation or the results of an independent assessment. Any on-site audit requires reasonable advance notice, must be at Customer's expense, and is subject to confidentiality.

9. Deletion and return

During the term, Customer can delete data and set retention periods in the Service. After termination, Customer may request an export within 30 days. Processor will then delete Customer Personal Data within 90 days, except where retention is required by law (for example, consent and opt-out records, and billing records), in which case it will remain protected by this DPA.

10. Customer obligations

Customer is responsible for providing any notices and obtaining any consents required for the processing, including call recording notices and consent for outbound and marketing communications, for the accuracy of Customer Personal Data it provides, and for the lawfulness of its instructions. Customer will not instruct us to process sensitive data such as payment card numbers, Social Security numbers or protected health information (unless a Business Associate Agreement is signed).

11. General

If this DPA conflicts with the Terms, this DPA controls with respect to Customer Personal Data. Liability under this DPA is subject to the exclusions and limitations of liability, and to the dispute resolution and arbitration provisions, in the Terms of Service. Questions: legal@frontwren.com, or Goldren Studio LLC, 1209 N Orange St, Wilmington, DE 19801, USA.