Data Processing Addendum

Last Updated: October 24, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Dive Connect, LLC("DiveConnect," "Processor") and the customer using DiveConnect.ai ("Customer," "Controller"). It applies where DiveConnect processes personal data of the Customer's own end-customers ("Customer Personal Data") on the Customer's behalf, and reflects the requirements of applicable data-protection laws, including the EU and UK GDPR and the CCPA/CPRA.

1. Roles of the Parties

For Customer Personal Data, the Customer is the controller (or a processor acting for its own customer) and DiveConnect is the processor (or subprocessor). DiveConnect processes Customer Personal Data only to provide the Service and only on the Customer's documented instructions, including as set out in the Terms of Service and this DPA. For clarity, DiveConnect is an independent controller of account and usage data it collects about the Customer itself, as described in the Privacy Policy. Removing DiveConnect branding from what the Customer's customers see (white-label) does not change these roles.

2. Customer Instructions & Compliance

The Customer is responsible for the accuracy and legality of Customer Personal Data and for having a lawful basis to provide it. The Customer instructs DiveConnect to process Customer Personal Data to operate the Service. DiveConnect will inform the Customer if, in its opinion, an instruction infringes applicable data-protection law.

API keys and webhooks. Where the Customer's plan includes API access and the Customer creates an API key or a webhook endpoint, the Customer instructs DiveConnect to make Customer Personal Data available to whoever holds that key and to send it to that endpoint. Webhook payloads and API responses can include the contact details of the Customer's own customers (for example name, email address and phone number); the Customer chooses the endpoints and the scopes of each key. Once data leaves the Service that way, it is under the Customer's control: the Customer is responsible for securing its keys and signing secrets, for the systems that receive the data, and for any further processing by them. DiveConnect may suspend or revoke a key that appears compromised or abused, as described in the Subscription & Refund Terms.

3. Confidentiality

DiveConnect ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

4. Security

DiveConnect implements and maintains appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II below.

5. Subprocessors

The Customer gives DiveConnect general authorization to engage the subprocessors listed in Annex III (the same list appears in our Privacy Policy). DiveConnect imposes data-protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for its subprocessors' performance. DiveConnect will update Annex III and give the Customer at least 14 days' notice (by email or in the dashboard) before adding or replacing a subprocessor, during which the Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may cancel the affected Service. Third-party platforms the Customer chooses to connect (such as Meta for WhatsApp, Instagram, or Facebook) act under their own terms with the Customer and are not DiveConnect's subprocessors.

6. Data-Subject Requests

Taking into account the nature of the processing, DiveConnect will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights. If DiveConnect receives such a request directly, it will advise the data subject to contact the Customer.

7. Personal-Data Breaches

DiveConnect will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide information reasonably available to it to help the Customer meet its own notification obligations.

8. Assistance & Audits

DiveConnect will assist the Customer, taking into account the nature of processing and the information available, with data-protection impact assessments and prior consultations, and will make available information reasonably necessary to demonstrate compliance with this DPA.

9. International Transfers

Where processing involves transferring Customer Personal Data out of the EEA, UK, or Switzerland to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, which are incorporated by reference and completed by the details in the Annexes.

10. Retention, Return & Deletion

DiveConnect retains Customer Personal Data — including call transcripts, call records, voicemails, and messages — for the term of the Service so the Customer can access its history, and deletes it when the Customer deletes its account or on termination, except to the extent applicable law requires storage (for example, billing and tax records). The Customer may export its data before deleting its account, and may ask DiveConnect to delete specific call recordings or transcripts at any time, including copies held by our voice providers. Copies held by subprocessors are deleted under their retention settings or on our request.

11. Liability & Precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA controls; where the SCCs apply, the SCCs control over both. If the Customer has an Enterprise order form or statement of work that includes a negotiated data processing agreement, that agreement controls over this DPA where they conflict.

Annex I — Description of Processing

• Subject matter & duration: processing of Customer Personal Data for the term of the Service.
• Nature & purpose: hosting, storing, and processing Customer Personal Data to provide the dashboard, storefront, booking, retail/rental, communication, and related features the Customer uses.
• Types of personal data: end-customer contact details (such as name, email, phone number, and messaging handles), booking, purchase, and invoice records; the content of calls, voicemails, and messages handled by the Service (call audio processed in real time, transcripts, recordings held by our voice providers, and message text); call metadata (time, duration, outcome, language); SMS opt-in and opt-out records; and any other data the Customer chooses to enter.
• Categories of data subjects: the Customer's customers, prospects, callers, message senders, and contacts, and the Customer's own staff users.
• Sensitive data: none is intended. The Customer should not use the Service to collect health or medical information by phone or message; dive medical and waiver forms should be collected through the Customer's own forms.

Annex II — Security Measures

• Encryption of data in transit (TLS) and encryption at rest for stored data.
• Role-based access controls and least-privilege access to production systems.
• Authentication managed via Supabase; administrative access restricted and logged.
• Network isolation and managed hosting through Vercel and Supabase.
• Error and performance monitoring (Sentry) to detect and respond to issues.
• Regular backups and documented incident-response practices.

Annex III — Subprocessors

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, the AI gateway that routes some AI requests to OpenAI, Google, and Anthropic, and — only with your consent — Web Analytics.
• Stripe — subscription billing, Stripe Tax, credit-pack and domain payments, and (on your own connected account) payments from your customers via Stripe Connect.
• Resend — sending transactional, account, and campaign email.
• Tucows / OpenSRS — domain registration (registrar of record) and hosted mailboxes on your domain.
• Fixie — a fixed-IP network proxy that carries our requests to the domain registrar, including registrant details.
• Twilio — phone numbers, call connection and routing, the softphone, voicemail, SMS, and recording of staff calls where a shop turns it on (each recording is moved to our storage and deleted from Twilio).
• Retell AI — the AI phone front desk: call audio, speech-to-text, AI voice, call transcripts, and call recordings.
• Soniox — speech recognition: real-time for the phone interpreter and voice translation (incl. caller-language detection), and transcription of recorded staff calls (deleted from Soniox once the transcript is stored).
• DeepL — translation of text and speech for the interpreter, the translated chat, and the inbox.
• Anthropic — Claude models for the AI crew, Lily, message and email drafts, call summaries, and content generation.
• OpenAI — text generation, embeddings for search over your own content, and speech features.
• Google — Gemini image generation (via the Vercel AI gateway).
• ElevenLabs — AI voice generation (text-to-speech) you request.
• Replicate — image processing such as background removal.
• Higgsfield — AI image, avatar, and video generation you request.
• HeyGen — AI talking-avatar video generation you request.
• TypeSafe and OpenRouter — structured AI decision checks, such as call-transcript quality and safety review and message triage (OpenRouter is a fallback route).
• Zernio — the social, WhatsApp, and SMS connector that publishes posts and sends and receives messages on your connected accounts.
• Apify — collecting public web and social pages you point us to (for example, your existing website or profiles).
• Serper — web image search for product and listing images you request.
• Upstash — rate limiting, caching, and a vector index of your own content.
• Fly.io — hosting for our real-time voice and interpreter servers and the AI crew's agent workers.
• Sentry — error and performance monitoring (legitimate interest), and — only with your consent — masked session replays.
• PostHog — product analytics and masked session replay, only with your consent; plus limited server-side service events that carry internal identifiers only.

Contact

Dive Connect, LLC
7901 4th St N Ste 27295, St Petersburg, FL 33702, USA
Data protection: privacy@diveconnect.ai