Data Processing Addendum

Effective date: August 4, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and Umayth LLC (“Processor”) and applies where Umayth processes personal data on the Controller’s behalf.

1. Roles

For personal data of the Controller’s end users (callers, message-senders) processed through the Service, the Controller is the data controller and Umayth is the data processor. Umayth processes such data only on documented instructions from the Controller and as needed to provide the Service.

2. Subject Matter and Purpose

Processing covers call audio, recordings, transcripts, messages, contact details, and appointment data, for the purpose of providing the AI receptionist Service.

3. Umayth’s Obligations

Umayth will: (a) process personal data only per the Controller’s instructions and the Terms; (b) ensure persons authorized to process the data are bound by confidentiality; (c) implement appropriate technical and organizational security measures; (d) assist the Controller, as reasonably possible, with data-subject requests and security/breach obligations; (e) notify the Controller without undue delay after becoming aware of a personal-data breach; and (f) on termination, delete or return personal data at the Controller’s choice, subject to legal retention.

4. Subprocessors

The Controller authorizes Umayth to use subprocessors (for example, cloud hosting, telephony carriers, AI model providers, and Stripe for payments) to deliver the Service. Umayth will impose data-protection obligations on subprocessors and remains responsible for their performance. A current subprocessor list is available on request at hello@umayth.net.

5. International Transfers

Where personal data is transferred across borders, the parties will rely on a lawful transfer mechanism (such as Standard Contractual Clauses) as applicable.

6. Controller’s Responsibilities

The Controller is responsible for the lawfulness of the data it routes through the Service, for obtaining all necessary consents (including call-recording and messaging consents), and for providing required notices to its end users.

7. Audits

On reasonable request and notice, Umayth will make available information necessary to demonstrate compliance with this DPA.

8. Term

This DPA lasts as long as Umayth processes personal data on the Controller’s behalf.

Contact: Umayth LLC · 3090 W 64th Ave #2548, Denver, CO 80221 · hello@umayth.net