Data Processing Addendum
This addendum forms part of the agreement between Decibel and each customer, and applies where Decibel processes personal data on the customer's behalf.
Last updated 1 October 2026
1. Roles
For data the customer brings to or creates in the service (imported contacts, notes, call recordings, call outcomes), the customer is the controller and Decibel is the processor. For the Decibel contact database itself, Decibel is an independent controller, and the customer becomes an independent controller of any contact it reveals and uses.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Providing the Decibel database, dialler and pipeline |
| Duration | The term of the agreement plus the deletion period in section 9 |
| Nature and purpose | Storing, organising, transmitting and recording data so the customer can run outbound calling |
| Data subjects | The customer’s users, and the business contacts the customer calls or imports |
| Types of data | Names, job titles, employers, phone numbers, email addresses, call metadata, call recordings, notes |
3. Our obligations
- Process personal data only on the customer’s documented instructions, including the agreement and the customer’s use of the service.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply the security measures in section 5.
- Help the customer respond to data subject requests and meet its obligations on security, breach notification and impact assessments.
- Tell the customer if we believe an instruction breaks data protection law.
4. Customer obligations
The customer is responsible for having a lawful basis for its outreach, for the content of its calls, for choosing an appropriate call recording notice setting, and for complying with the calling rules of each country it dials.
5. Security
- Encryption in transit (TLS) and at rest.
- Workspace isolation enforced at the database level with row-level security.
- Role-based access within each workspace.
- Access to production systems limited to staff who need it.
- Primary data hosted in the UK (London).
6. Sub-processors
The customer gives general authorisation for the sub-processors below. We will give at least 30 days’ notice of additions or replacements, and the customer may object on reasonable grounds.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All customer data | UK (London, eu-west-2) |
| Twilio | Voice calls, phone numbers, call recording | Phone numbers, call audio, call metadata | [To be confirmed] |
| Stripe | Subscription billing and payments | Billing contact, payment details | [To be confirmed] |
| Vercel | Application hosting | Requests in transit, logs | [To be confirmed] |
| Resend | Transactional email | Email addresses, email content | [To be confirmed] |
| PostHog | Product analytics | Usage events, user identifiers | EU |
7. International transfers
Where a sub-processor processes personal data outside the UK or EEA, the transfer is covered by adequacy regulations, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses as applicable.
8. Personal data breaches
We will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting customer data, with the information the customer needs to meet its own obligations.
9. Deletion and return
Customers can export their data at any time. When a workspace is deleted, its data is purged after 30 days. Call recordings are deleted on the schedule for the customer’s plan (1 year on Pro). Call metadata is retained for 3 years.
10. Audits
On reasonable written request, no more than once a year, we will provide information needed to demonstrate compliance with this addendum.
11. Contact
Questions about this addendum: oliver@usedecibel.com. See also the privacy policy and compliance page.