Vandale Solutions Back to site

Service Terms: The Call Recovery System

Last updated: 2026-10-16

Provider: Exclusive Recipe Unipessoal Lda, Beco da Areia, nº 25, Birre, 2750-053 Birre, Portugal, company no. 516366718 ("Vandale", "we").
Client: the business purchasing the subscription at checkout ("you"). You represent that you are purchasing for business purposes, not as a consumer, and that the person completing checkout is authorized to bind the business.
Effective: the date you complete checkout. Nothing is charged that day. Every section of these terms applies from that date.
Updated 2026-10-05: the Section 5 guarantee is now a one-time first-month guarantee.
Updated 2026-10-07: added Sections 13 and 14, Annexes B and C, and protective terms in Sections 3, 4, 6, 7, 9 to 12 and Annex A. Prices, guarantees and cancellation terms are unchanged.
Updated 2026-10-09: we now create your phone-platform workspace and invite you as its Admin, and your automations run on our own server, included in the monthly fee, so the only cost outside the fee is your phone platform. Sections 3, 5, 6, 7, 8, 12 and 13 and Annexes A and B say how that works and what happens when the service ends. Prices, guarantees and cancellation terms are unchanged.
Updated 2026-10-16: your first month is now free (Section 5) and nothing is charged at checkout. The go-live guarantee and the first-month guarantee are retired for clients who check out from this date; clients who checked out before keep the terms they accepted.

1. What the service is

We build, host, and manage an AI phone answering service for your business: it answers calls you forward to it, speaks with your callers, captures lead details (name, number, address, job description, urgency), books the job on the calendar you connect (or, if you don't connect one, takes the caller's preferred time for you to confirm), alerts you about urgent calls, and logs every call. We tune it continuously, make configuration changes you request as part of the service, and send you a monthly report of what it caught. Job-value figures in reports are good-faith estimates, not measurements or guarantees; lead counts in reports are measurements from the call log. The service scope is what this page describes. The free month in our marketing ("your first month is free", "try it free for the first month", "cancel before the month ends and you pay us nothing") is the Free Month in Section 5, on the terms there. "Free" and "pay us nothing" mean our fee: your phone platform bills you directly for its usage (Section 3). No other marketing material modifies these terms.

2. What the service is not

The Call Recovery System (the "Service", marketed before 2026-09-20 as "The 24/7 Job Line") is a call-answering and lead-capture service. It is not an emergency dispatch service, a licensed answering service, or a guarantee that any call will be answered, understood, or routed correctly. It handles calls using commercially reasonable efforts, as is. You acknowledge the service is not an emergency or dispatch service, agree not to advertise or rely on it as one, and will maintain your own procedure for life-safety and time-critical communications.

3. Price and billing

  • $749 per month, flat. No setup fee. No per-minute charges from us.
  • Nothing is charged at checkout. We keep your card on file with Stripe. Your first charge is $749on the day after your Free Month ends, which is 30 days after checkout (Section 5), your "First Charge Date". From then on you are billed monthly in advance, on the same day each month, by card or US bank debit (ACH) via Stripe, and the subscription renews each month until cancelled (Section 4).
  • Go-Live Date means the day we confirm to you by email that your line is answering your calls. Your Free Month and your First Charge Date don't depend on it: both are fixed at checkout (Section 5). Your confirmation email gives you your First Charge Date, and we remind you at least 7 days before it.
  • Fees are exclusive of any applicable sales or similar taxes, which we may add where required.
  • You are responsible for any sales, use, or similar taxes on the service, other than taxes on our income. You pay our fees in full without deducting any tax, unless the law requires a deduction; if you believe it does, tell us before you pay so we can give you the forms that normally remove it (we have filed IRS Form W-8BEN-E).
  • Billing questions. If you think a charge is wrong, email info@vandalesolutions.com within 60 days of it. We answer within 5 business days and refund any amount charged in error. Please give us that chance before disputing a charge with your card issuer or bank; this doesn't limit any right you have with them.
  • Your phone platform is the only cost outside our fee. Phone-platform usage (the per-minute cost of your AI phone workspace) is billed directly to you at cost by the platform provider, to the payment method you add in your own workspace, typically $20 to 40 per month for most businesses. We never resell minutes, never mark it up, and never put our own card on your workspace. This applies during your Free Month too.
  • Running your automations (lead emails, urgent-call alerts, your lead log, and any calendar or CRM connection we set up) on our own server is included in the monthly fee. There is no automation account for you to open or pay for.
  • Prices may change with 30 days' written notice; changes never apply mid-billing-cycle.

4. Month-to-month, cancel anytime

There is no term commitment. Either of us may end the service for any reason, effective at the end of the current billing month. You can cancel by email to info@vandalesolutions.com or self-serve through your Stripe billing portal. If you cancel before your First Charge Date, you pay us nothing and nothing is ever charged; your line runs to the end of your Free Month unless you ask us to stop sooner. A cancellation counts if you make it in your billing portal before the first charge goes through, or if your email reaches us before 11:59 PM US Pacific on the day before your First Charge Date. If we charge you after a cancellation that counts, we refund that charge in full within 5 business days. After that, we don't refund the month in progress, and you won't be billed again after cancellation. If we terminate without cause mid-month, we refund the unused portion of that month pro rata. Before your Go-Live Date, either of us may end the agreement at once by email (you can also use your billing portal). Nothing further is charged, and if your line never went live, we refund everything you paid us within 5 business days.

We may suspend or terminate the service immediately if you fail to pay, use the service unlawfully, or remove (or instruct us to remove) required call disclosures (see Section 7). We may also suspend all or part of the service, without ending it, if we reasonably believe that is needed to stop harm to your callers, to you, to us, or to the platforms the service runs on (for example a security incident, a breach of Section 13, or a provider suspending your line). We email you before we suspend, or the same day if the reason is urgent, saying why and what fixes it, and we restore the service within 1 business day after the reason is fixed, including payment of any overdue invoice.

When the service ends, for any reason, amounts already due stay due, refunds already due under Section 4 stay due, and Sections 6, 8, 9, 10, 11, 12, 14 and Annexes A to C continue to apply.

5. Your Free Month

Your Free Month is the 30 days starting on the day you complete checkout. It runs whether or not your line is live yet, so the sooner you do your part (Section 7), the more of it your line spends answering calls. We charge nothing for the service during it.

Cancel before your First Charge Date (Section 3) and you pay us nothing. No reason needed.

One Free Month per business, on your first subscription only. If you come back after cancelling, billing starts at checkout.

The Free Month covers our fee only. Your phone platform bills you directly for its usage from the start (Section 3); that isn't ours to waive or refund.

If you cancel during the Free Month, your receptionist is switched off when the service ends (Section 6), so change your call forwarding before then.

If you don't cancel, we charge $749 on your First Charge Date and monthly after that under Section 3.

6. Who owns what

  • You own your business phone number(s) and your call recordings. Your workspace on the AI phone platform is yours too: it is in your name, you are its Admin, it bills your own card, and you can remove us from it at any time. Any phone number bought inside it stays in it, under the platform's terms.
  • We own the routing, alerting, reporting and automation systems we host, including the shared automation workflow on our server that runs your automations alongside other clients' (the "Shared Workflow"), and all our know-how, prompts and processes. The agent configuration in your workspace, including prompts we authored, remains our intellectual property; once you have paid at least one monthly fee, you keep a perpetual, non-exclusive license to continue using it in your own business, including after the service ends. We may reuse our prompts, know-how and processes for other clients.
  • Your Data. As between us, you own the business information you give us and the call recordings, transcripts and lead details the service produces for you ("Your Data"). You let us use Your Data only to provide the service, as Section 8 and Annex A describe.
  • Our Materials. "Our Materials" means the prompts, conversation designs, agent configurations, automation workflows, code, report templates and know-how we author or use to deliver the service, including improvements we make while serving you, but not Your Data. The license in the bullet above covers the agent configuration left in your workspace, for use in your own business only. It doesn't cover the Shared Workflow or our other tools, which stay with us. It doesn't let you resell, sublicense, publish or give Our Materials to anyone else (other than a contractor working on your own line), or use them to build or offer a competing service.
  • Feedback. If you suggest improvements, we may use them freely without owing you anything. That gives us no right to Your Data or your confidential information.
  • Anonymous statistics. We may measure how the service performs (for example, how many calls arrive after hours, or how many leads a line produces) and combine those figures across clients into statistics that identify no business, caller or person. We build them from call logs, never include call content or caller details in them, and use them to run, improve and describe the service.
  • Publicity. We won't name you, or use your logo, reviews or any call recording, in our marketing without your OK in writing (an email is enough). You can withdraw it for future use at any time.
  • If the service ends, for any reason:
    • (a) You keep your phone-platform workspace, any number in it, and every recording and transcript it holds. If you have paid at least one monthly fee, you also keep the receptionist we built in it, under the license above, and it keeps answering your calls for as long as you keep the workspace paid. If the service ends before your first paid month, we remove the receptionist's configuration (Our Materials) from your workspace on the last day, and, if your line is live, we email you 3 days before so you can change your call forwarding first (unless we end the service immediately under Section 4).
    • (b) On the last day of the service we switch off your automations in the Shared Workflow. From then on, lead emails, urgent-call alerts, your lead log, any calendar or CRM connection we run, the monthly report and our tuning all stop. Every call still shows in your workspace, so you can check your calls there.
    • (c) The same day, we remove the alert and booking tools and the link to our server from your receptionist, and change its wording so it doesn't promise callers an alert that will no longer be sent. We email you what we changed.
    • (d) Within 7 days after the service ends we remove ourselves from your workspace and delete any key to it we hold, unless you have already removed us.
    • (e) We don't hand over the Shared Workflow: it runs other clients too and is part of Our Materials. If you want your automations rebuilt for your own use, we can quote a single-client copy as a separate paid job, in writing, before you decide. We don't owe it and you don't have to buy it.
    • (f) We return your callers' data we hold on request and delete it under Annex A7.

    When we confirm a cancellation, we email you this list with the date your automations stop.

7. Your responsibilities

  • Provide accurate business information (services, price ranges, hours, service area, emergency contact) and tell us when it changes; the agent can only say what we've configured.
  • Set up and maintain call forwarding on your line (we walk you through it).
  • Keep your phone-platform workspace paid, with a working payment method, and in good standing; a suspended workspace stops your line and doesn't extend your Free Month.
  • Alert contacts: you confirm that each person you name to receive lead or urgent-call alerts has agreed to receive them, at any hour, by email at the address you give us and, for urgent calls, by an automated phone call in an AI voice to the number you give us; that you have pointed them to our Privacy Policy; and that you will tell us at once if they withdraw or change their details. Alerts are informational messages about calls to your own line, sent on your instructions.
  • Call recording: calls handled by the service are recorded and transcribed. The agent's greeting discloses this to callers, and you agree not to remove, and not to instruct us to remove, that disclosure. You are responsible for ensuring your use of the service and of call recordings complies with the laws of your state (some states, including Florida and California, require all-party consent).
  • Anything the agent tells callers about your prices is based on ranges you approve; binding quotes remain yours to give.
  • Your providers. Your phone platform, your phone carrier and phone number, and any calendar or CRM tool you ask us to connect are services you contract for directly, under their own terms ("Your Providers"). We create your phone-platform workspace, but when you accept our invite you accept the platform's terms and become its Admin and payer. You keep Your Providers in good standing and follow their terms. They are not our subcontractors, and we are not responsible for their availability, errors, price changes, or decisions to change, suspend or close your accounts. Our own server, which runs your automations, is not one of Your Providers: it is ours, and these terms cover it.
  • Access. We create your workspace on the phone platform from our own login and invite you as its Admin. Once you have accepted and added your payment method, we step down to the Developer role, which lets us build and tune your receptionist but not change billing or remove you. You confirm you are entitled to give us access to Your Providers, and you authorize us to work in them, and to connect your workspace to our server, to build, run and tune your line. We use that access only for that. You can remove us at any time. If you do, we can't run or tune your line and your automations stop; we email you to ask whether you meant to cancel. If you don't restore our access or reply within 7 days, we treat it as your cancellation under Section 4. When the service ends we stop using our access and remove ourselves as Section 6 says.
  • Notices and consents. Beyond the recorded-line greeting we configure, you are responsible for any notice or consent the law requires from your callers or staff for the service to answer, record, transcribe and log calls on your behalf, and for having a lawful reason to use the leads it captures.

8. Data

Call recordings and full transcripts live in your phone-platform workspace under its retention settings (90 days by default, your choice). After each call, the platform sends that call's details (caller name, number, address, job details, call summary and transcript) to the Shared Workflow on our server, which uses them to send your alerts, log the lead and run any connection we set up for you. The Shared Workflow keeps no record of runs that succeed; when a run fails, its record (which can include those details and the transcript) is kept for up to 14 days so we can fix it, then deleted automatically. Captured lead details (caller name, number, address, job details and call summary, with a link to the recording) are stored in our lead database to power your alerts, lead log and monthly report. Each client's data is kept separate in the Shared Workflow and the lead database. We access and process this data solely to operate, tune and report on the service, acting as your processor / service provider under the Data Processing Terms in Annex A below and as described in our Privacy Policy. We don't sell your data or your callers' data, ever. On request when the service ends we'll export your lead log to you.

9. No warranties

EXCEPT FOR THE PROMISES THESE TERMS MAKE EXPRESSLY (INCLUDING THE FREE MONTH IN SECTION 5), THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL IMPLIED AND STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION, AND ANY WARRANTY FROM COURSE OF DEALING OR USAGE OF TRADE. ESTIMATES IN REPORTS (INCLUDING JOB VALUES) ARE INFORMATIONAL ONLY.

AI output. The service uses AI to speak with callers and to produce transcripts, summaries, urgency flags and lead details. AI can mishear or misunderstand (for example, a wrong digit in a phone number or a misheard address), so we don't promise these are accurate or complete. The recording in your phone-platform account is the record; check it before relying on a detail that matters.

No promise of results. We don't promise that the service will produce any number of calls, leads, bookings, jobs or revenue. Missed-call math, examples and estimates in our marketing, on calls and in reports are illustrations, not promises. If the service doesn't produce the results you hoped for, that is not a breach of these terms, and your remedy is to cancel (Section 4); if you cancel before your First Charge Date, you pay us nothing (Section 5).

Your Providers. We give no warranty for Your Providers (Section 7) or for the AI models, voices and carriers they use.

10. Limits of liability

TO THE MAXIMUM EXTENT THE LAW ALLOWS: OUR TOTAL LIABILITY FOR ANYTHING ARISING FROM THE SERVICE IS CAPPED AT THE GREATER OF THE FEES YOU PAID US IN THE THREE (3) MONTHS BEFORE THE CLAIM AND US$749. NEITHER PARTY IS LIABLE FOR INDIRECT OR CONSEQUENTIAL DAMAGES, INCLUDING LOST JOBS, LOST REVENUE, OR DAMAGES ARISING FROM A MISSED, DROPPED, MISUNDERSTOOD, OR MISHANDLED CALL, OR FROM DOWNTIME OF THE UNDERLYING PHONE, AI, OR HOSTING PLATFORMS WE BUILD ON. This cap does not apply to your payment obligations, your indemnification obligations, or either party's fraud, gross negligence, or willful misconduct. Nothing in these terms limits liability that cannot lawfully be limited.

The cap is the total for all claims together; more than one claim doesn't raise it. It also covers claims under Annex A, except where the law (including Annex C) doesn't allow that. Refunds under Section 4 are not damages: they don't count toward the cap, and this Section never reduces them. Our prices reflect these limits, and they apply even if a remedy fails of its essential purpose.

11. Indemnification

You will defend and indemnify us against third-party claims arising from (a) your business information, price ranges, or instructions; (b) the recording or use of call recordings under the laws of your state, provided the greeting disclosure we configure was not removed; (c) your use of the service or of the leads it captures; (d) your breach of Section 13; or (e) any dispute between you and one of Your Providers. We will tell you promptly about any claim, let you control the defense and settlement with counsel reasonably acceptable to us, and cooperate at your cost. You won't settle a claim in a way that admits fault for us or binds us to do anything without our written OK. We may take part with our own counsel at our own cost.

12. The boring rest

  • Name & non-affiliation: "Call Recovery System" is a plain description of what the Service does. We do not claim it as a trademark and claim no exclusive right in those words. The Service is provided solely by Exclusive Recipe Unipessoal Lda, company no. 516366718, trading as Vandale Solutions, and is not affiliated with, endorsed by, sponsored by, or connected to any other business using similar wording.
  • Governing law & venue: these terms are governed by the laws of the State of Delaware, excluding its conflict-of-laws rules. Any dispute will be resolved exclusively in the state or federal courts located in Delaware, and both parties waive jury trial. Before starting a court case, the party with the complaint emails the other with the details, and both try in good faith for 30 days to settle it. Either party may still go to court at once for urgent relief, for example to protect confidential information or to stop misuse of Our Materials.
  • Notices: notices must go to info@vandalesolutions.com (to us) or your billing email on file (to you), effective when sent, unless the sender gets a bounce or other non-delivery message, in which case it must be sent again to another contact the other party has given. Instructions given to the AI agent on a call are not notice.
  • Force majeure: neither party is liable for delay or failure to perform caused by events beyond reasonable control (including outages of third-party platforms, hosting, or telecom carriers), except payment obligations and refunds due under Section 4, which force majeure never delays or reduces. The affected party tells the other promptly and resumes as soon as it reasonably can.
  • Assignment: either of us may assign this agreement without the other's consent to an affiliate, or to the buyer of all or substantially all of its business, by telling the other in writing; otherwise neither of us may assign it without the other's written consent, which won't be unreasonably withheld.
  • Confidentiality: see Section 14.
  • Subprocessors: sub-processors for your callers' personal data are those listed in Annex A. Your phone platform is your own vendor: we create your workspace there, but you hold it, pay for it and control it under your own agreement with the platform, so it is not our sub-processor (Annex A4). We separately use payment and hosting providers for our own business data as described in our Privacy Policy.
  • Amendments: we'll email you any change to these terms 30 days ahead; if you don't cancel before it takes effect, the updated terms apply.
  • These terms are the whole agreement, replace prior discussions, and may only be amended as described above; no other document (marketing, welcome materials, or emails) modifies them; the advertised free month is the one in Section 5. If a clause is found unenforceable, the rest stands.
  • Independent parties: we are independent contractors. Neither of us is the other's agent, partner or employee, and neither can bind the other. The receptionist answers in your business's name because you instruct us to configure it that way; that doesn't make us your agent.
  • No waiver: not enforcing a term once doesn't waive it.
  • Electronic acceptance and language: ticking the box and completing checkout is your signature on these terms, and our electronic records of it are evidence of the agreement. These terms are written in English, which controls over any translation.
  • Order of precedence: on personal data, Annex A (and Annex C where it applies) wins over the rest of these terms. Otherwise these terms win over any other document, including emails, the welcome pack, reports and marketing.

13. Acceptable use

You will not, and will not ask us to:

  • (a) use your line for outbound calls or texts, telemarketing, or automatic callbacks; the service answers inbound calls only, and the only calls or messages it sends are the alerts to your own alert contacts (Section 7);
  • (b) instruct the receptionist to say it is a human, to give callers false or misleading information, or to drop the recorded-line greeting (Section 7);
  • (c) have the receptionist ask callers for payment card or bank details, Social Security or other government ID numbers, passwords, or health information (asking whether anyone is in danger, so it can tell them to call 911, is fine);
  • (d) turn on, or ask us to turn on, any feature that identifies or verifies callers by their voice (voiceprints or other voice biometrics);
  • (e) use the service for emergency dispatch or life-safety communications (Section 2);
  • (f) use the service, or the leads and recordings it produces, in breach of any law, including recording, privacy, telemarketing, anti-discrimination and consumer-protection laws;
  • (g) copy, reverse engineer, resell or give others access to Our Materials, except as Section 6 allows; or
  • (h) interfere with, overload, or try to get around the security of the service or the platforms it runs on.

If you ask us to configure something that breaks this Section, we may decline and tell you why.

14. Confidentiality

"Confidential Information" means non-public information one of us shares with the other in connection with the service that a reasonable business would understand to be confidential, such as your prices, margins, customer lists and call data, and Our Materials. It doesn't include information that (a) is or becomes public through no fault of the receiver; (b) the receiver already had, or later gets from someone free to share it, without a duty of confidence; or (c) the receiver develops independently without using the other's information.

The receiver uses the other's Confidential Information only for the service, shares it only with people and providers who need it for that purpose and are bound to keep it confidential (including our sub-processors in Annex A), and protects it with at least reasonable care. It may disclose it where the law or a court requires, after telling the other first where the law allows, so the other can seek protection.

These duties last for the term of the service and 3 years after it ends, and for as long as any trade secret remains one. Your callers' personal data is also governed by Annex A, which wins on anything it covers. When the service ends, each of us deletes or returns the other's Confidential Information on request, except copies the law requires us to keep or that sit in routine backups until overwritten; those stay confidential.

Annex A: Data Processing Terms

This Annex forms part of these Service Terms and applies whenever Vandale Solutions (Exclusive Recipe Unipessoal Lda, "we", acting as processor) processes personal data of your callers on your behalf (you being the controller).

A1. What we process, and why. Caller details captured by your AI receptionist: name, phone number, address, job details, call summaries and sentiment, the call transcript as it passes through our server, and links to call recordings held in your phone-platform workspace. We process these solely to provide the service: capturing leads, alerting you, operating and tuning your receptionist, and producing your monthly report. Whose data: your callers and anyone they name on a call; we also use your alert contacts' email addresses and phone numbers, only to send your alerts. Nature: collection through your receptionist, transmission from your workspace to our server, storage, organization, retrieval, sending to you by email or automated call, and deletion, continuously while the service runs. Not intended: special categories of personal data, criminal-conviction data, government ID numbers, payment card or bank details, or children's data. The receptionist is not set up to ask for them (Section 13), though a caller may volunteer them. Duration: the term of the service, then deletion under A7.

A2. Your instructions only. We process this data only to deliver the service as described in these Service Terms and your written instructions, never for our own purposes, and we do not sell it, share it for advertising, or use it to train AI models. For clients subject to the CCPA/CPRA: we act as your "service provider" and certify the restrictions in Cal. Civ. Code §1798.140(ag). If EU or Portuguese law requires us to process the data otherwise, we will inform you of that requirement before processing, unless that law prohibits it. If we believe an instruction from you breaks the GDPR or other data-protection law, we tell you at once and may hold off following it until you confirm or change it. You also instruct us to produce the anonymous statistics described in Section 6; once produced, they contain no personal data. Under the CCPA and similar US state laws, we also: won't sell or share your callers' personal information or use it for targeted advertising; won't retain, use or disclose it outside our direct business relationship with you; won't combine it with personal information we get from anyone else or collect ourselves, except as those laws allow; will tell you if we can no longer meet these obligations; and agree that you may take reasonable steps to stop and fix any unauthorized use.

A3. Confidentiality. Access is limited to personnel bound by confidentiality obligations.

A4. Sub-processors. You authorize our sub-processors: Hostinger operations, UAB (Švitrigailos str. 34, Vilnius, Lithuania, EU; VPS hosting) and Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google Workspace email, used to send your lead and urgent-call alert emails; transfers outside the EEA covered by Google's Cloud Data Processing Addendum, Standard Contractual Clauses and the EU-U.S. Data Privacy Framework). Our automation server and lead database are software we run ourselves on that Hostinger server, not separate providers. We email you at least 15 days before a new or replacement sub-processor starts processing your callers' data, naming it, its location and what it does; in an emergency, such as a provider failing, we tell you as soon as we can. You may object by email within those 15 days on reasonable data-protection grounds. We then work with you in good faith on a fix; if we can't agree, you may end the service at once by email, and we refund the unused part of the current month pro rata. We impose data-protection obligations no less protective than this Annex on every sub-processor and remain fully liable to you for their performance. Your phone platform is your vendor under your own workspace and agreement with it, not our sub-processor: we create the workspace and work in it on your behalf (Section 7), but you hold it, pay for it and can remove us. The same goes for any calendar or CRM tool of yours we connect: we send your lead details there on your instruction.

A5. Security. We maintain the technical and organizational measures in Annex B, appropriate to the risk. We may improve them over time but never reduce overall protection. They include encrypted transport, access-controlled EU-hosted infrastructure, separation of each client's data, row-level access restrictions, and no storage of call audio on our systems (we store links to recordings held in your workspace). Call transcripts aren't stored on our systems either, except inside the record of a failed automation run, which is deleted automatically within 14 days (Section 8). You are responsible for securing your own accounts, devices, and the inboxes that receive your alerts.

A6. Assistance. We will reasonably assist you with data-subject requests (access, deletion, objection) and with your own compliance obligations (Arts. 32 to 36 GDPR), given the nature of the processing. If we become aware of a personal data breach affecting your callers' data, we notify you without undue delay and in any case within 72 hours, by email to your billing email and any data contact you gave us. We tell you what we know (what happened, which data, roughly how many people, likely consequences, what we've done, and what we recommend you do), and we update you as we learn more. We take reasonable steps to contain it and help you investigate. As controller, you decide on and make any notice to authorities or individuals; if a notice will name us, you let us see it first where the law allows. Our notice is not an admission of fault. Failed attempts that don't compromise data, such as blocked log-ins or port scans, aren't breaches. If a caller or an authority contacts us directly about your callers' data, we pass it to you within 5 business days and don't answer it ourselves unless you ask us to or the law requires.

A7. Deletion. On termination, we delete the personal data of your callers from our systems within 30 days (barring legal retention duties), and on request provide an export first, per Section 8. That includes your lead records, your settings and alert contacts in the Shared Workflow, and any failed-run records it still holds (these are deleted within 14 days in any case). Data in your own phone-platform workspace stays there, under your control. Copies in routine backups are overwritten in the normal cycle within 7 days and stay protected until then. Anything the law makes us keep stays confidential, is used only for that legal reason, and is deleted when the duty ends. On request, we confirm deletion in writing.

A8. Verification. Once per year, on reasonable notice, we will answer your written questions and provide available documentation (e.g. sub-processor security attestations) sufficient to demonstrate compliance with this Annex, in place of on-site audit for a service of this size. If that documentation is reasonably insufficient to demonstrate compliance, we will allow and contribute to an audit on reasonable notice, during business hours, at your cost. An audit needs a written plan 2 weeks ahead, takes place during business hours without disrupting our operations, and never gives access to other clients' data. Any third-party auditor must be independent, not our competitor, and bound by confidentiality. Audit reports are confidential to both of us and are used only to check compliance with this Annex.

A9. Location and transfers. We process your callers' data in the EU (Portugal and EU-hosted infrastructure), and through the sub-processors in A4 under the safeguards stated there. Caller data originates in the US and is stored in the EU; that inbound flow is not a restricted transfer. Where we send data back to you in the US (alerts, reports, exports), we and you agree to the EU Standard Contractual Clauses, Module Four (processor to controller), approved by Commission Implementing Decision (EU) 2021/914, completed as set out in Annex C and incorporated into these terms by reference. If those Clauses conflict with these terms, the Clauses win for that transfer. If the EU replaces them, we may update Annex C to the replacement by email notice.

A10. AI and voice. We don't use your callers' data to train, fine-tune or improve any AI model, ours or anyone else's, and we forbid our sub-processors from doing so. When we create your phone-platform workspace, and before you take it over, we switch off any option that lets the platform use your call data to train its models, set call retention to the period you choose (90 days by default, Section 8), and never turn on speaker identification, voiceprints or other voice-biometric features. The Shared Workflow sends your callers' data to no AI service. If you later change those settings in your own workspace, as its Admin, that is your choice and your responsibility.

A11. Your part as controller. You are responsible for having a lawful basis for the processing, for giving callers any notice the law requires beyond the recorded-line greeting we configure (Section 7), and for the lawfulness of your instructions. You won't instruct us to collect the data that A1 lists as not intended.

A12. Liability and precedence. Claims under this Annex are subject to the limits in Section 10, except where the law (including callers' rights under Annex C) doesn't allow that. On personal data, this Annex wins over the rest of these terms; Annex C wins over this Annex for the transfers it covers.

A13. Duration. This Annex applies for as long as we hold your callers' data, including after the service ends.

Annex B: Security measures

  • Access: access to systems holding caller data is limited to the company's operator, bound by confidentiality, using individual accounts.
  • Client separation: every call is matched to its client by the receptionist that took it before anything is sent; each client's settings, alert contacts and lead records are keyed to that client; and routing is tested before each client goes live. Clients have no access to our automation server.
  • Encryption: TLS for all web, API and email transport; Google Workspace encrypts data at rest.
  • Data minimization: the lead database stores lead fields, call summaries and recording links only, never call audio or transcripts, with row-level security. The Shared Workflow saves no record of successful runs; records of failed runs are deleted automatically after 14 days.
  • Network: the server firewall blocks all incoming traffic except web (ports 80 and 443) and remote administration (port 22).
  • Patching: automatic security updates are enabled on the server.
  • Monitoring: workflow error alerts and an uptime watchdog on the automation server. Error alerts name the failed step and run, not the caller's details.
  • Backups: daily database backups, kept 7 days, in the EU.
  • Secrets: never stored in code repositories; automated secret scanning blocks commits that contain them.
  • Incident response: handled under A6.
  • Personnel: confidentiality obligations; access removed the same day someone leaves.
  • Sub-processors: written data-processing terms with Hostinger and Google are in place.

Annex C: Standard Contractual Clauses, Module Four

  • Module Four only. Clause 7 (docking clause): not used. Clause 11(a): the optional language is not used.
  • Clause 17: the Clauses are governed by the law of Portugal. Clause 18: disputes go to the courts of Lisbon, Portugal.
  • Clauses 14 and 15 apply only if we combine personal data received from you with personal data collected by us in the EU. We don't.
  • Annex I.A. Data exporter: Exclusive Recipe Unipessoal Lda (trading as Vandale Solutions), NIPC 516366718, Beco da Areia, nº 25, Birre, 2750-053 Birre, Portugal, info@vandalesolutions.com; role: processor; activities: providing the Call Recovery System; signature: acceptance of these Service Terms. Data importer: the Client identified at checkout, contact: its billing email; role: controller; signature: acceptance of these Service Terms at checkout.
  • Annex I.B. Data subjects, categories, nature, purpose and retention: as in A1 and A7. Sensitive data: none intended. Frequency: continuous while the service runs.
  • Annex I.C (competent supervisory authority): not applicable to Module Four.

Questions

info@vandalesolutions.com