Data Processing Agreement - Feedback Studios

Between Feedback Studios LLC, 5006 Southwest 154th Court, Miami, Florida 33185, United States (“Feedback Studios”, “we”), and the client named in the proposal or service agreement that refers to this agreement (“the Client”, “you”).

1. What this covers

This agreement applies when you sign a proposal or service agreement with us that refers to it. “The Services” are the services in that proposal or service agreement. This agreement covers the personal information of your website visitors, leads, customers and callers that we collect, receive, store or send for you while providing the Services.

If this agreement conflicts with that proposal or service agreement, this agreement prevails for personal information. A signed business associate agreement prevails over both for protected health information.

2. Who decides

You decide why this information is processed. We process it only on your behalf and on your documented instructions, which are the Services and anything you ask in writing. We are your service provider and contractor under California law. We are your processor under Washington’s My Health My Data Act and similar laws, and your third-party agent under Florida’s Information Protection Act.

3. What we process and why

People	Information	Purpose
Visitors to your sites	A random visitor ID. The ad, link or site that brought them. Landing pages. Clicks on your phone and WhatsApp links. The entries of the lead forms you list, passed to us by your website’s server after it receives them.	Knowing which ads and pages bring you leads.
Leads	Name, email, phone, company, message. Consent choices. The source of the lead.	Delivering leads to you, and the follow-up you ask for.
Callers to tracked numbers	Calling number, time, length, outcome. Recordings and transcripts where you turned recording on.	Routing calls, text-back, attribution from the number called, and the call’s summary, tags and quality score from its transcript.
Your customers, when you mark a lead booked or won	The status and value you enter.	Reporting and sending conversions to your ad accounts.

A “clinic property” is a site, form or number of a client that provides health care. On a clinic property we collect only name, email and phone from forms, and keep the landing page only as the site’s home page unless you list neutral pages. On such a property we keep no campaign text, record no calls, and store no free text about anyone’s health.

4. What we promise

Only your purposes. We use the information only to provide the Services to you. We do not sell it, share it for our own advertising, combine it with other clients’ data, or use it for any purpose of our own. We keep your data apart from other clients’ data, and our staff read it only to provide the Services.
Only the ad accounts you choose. Conversions go only to the ad accounts and datasets you allow-list, and only with the consent the law requires. They carry phone numbers only when you ask for it in writing for a site and each lead ticked its own box allowing it. They go only to your own ad accounts and never with anyone’s opt-in to texts. They carry no IP address or browser details. They never come from visitors who used Global Privacy Control.
People bound to confidentiality. Only our staff who need it for the Services can reach your data. They do so under confidentiality duties, with role-based access, and two-factor sign-in for anyone with administrative access.
Security. Encryption in transit and of stored secrets, access control, an audit trail, encrypted backups, and the measures in Annex B.
Our providers. We use the providers in Annex A. We tell you 30 days before adding one; you may object, and if we can’t resolve it you may end the affected Service. Each provider is bound to protections no weaker than these.
Your people’s requests. Someone may ask you to see, correct or delete their information. We give you the help you need to answer within 10 days of your request to us.
Breaches. We tell you without undue delay, and no later than 10 days after we determine that a breach of your data occurred. Our notice says what happened, whose data, and what we are doing.
Messages in your name. Texts and WhatsApp messages we send for you use your brand, your approved campaign and your templates. Opt-outs are honored at once and kept on your suppression list.
When we stop. Within 30 days after the Services end we delete your data or return it, as you choose. We keep only the records that prove consent and opt-outs, and what a legal claim or investigation requires us to keep, until it ends. We keep the consent and opt-out records for 5 years after the last message sent under them or after their revocation, whichever is later. We keep an opt-out until the person opts in again, and at least 5 years. Once the rest is deleted, those records keep the number or email in a scrambled form.
Proof. Once a year, on 30 days’ notice, we answer your written questions about how we meet this agreement and show you the records that prove it.
If we can’t comply. We tell you if we believe an instruction breaks the law, or if we can no longer meet this agreement. You may then stop the affected processing.

5. What you promise

Your notices. Your privacy policy discloses our tracker and the ad platforms you use, using the paragraph we provide or better. Where calls to your tracked numbers are recorded, it also discloses that you record them with your service providers, us and ours in Annex A. It does so because the short notice callers hear does not say who records. Your pages show our footer notice. Your lead forms pass their entries to us from your website’s server (our WordPress plugin’s forward or your form tool’s webhook). Where your site can do neither, your forms show our form notice, which names Feedback Studios, directly above the submit button. You understand that a notice is not consent under California’s and Florida’s wiretap laws. On a property that receives California visitors you choose in writing between the opt-in prompt and accepting that risk.
Your consent boxes. Texts and WhatsApp messages go only to people who ticked your box, with the text we provide, and confirmed with YES. You never give us a list of numbers or addresses to message without that consent. You never make an offer, a quote or a booking depend on ticking a box, and you never edit a consent text or a notice; we change them for you.
Your registration. The business details you give for your A2P 10DLC brand and campaign are true.
Your staff. You tell your staff that calls to your tracked numbers with recording on are recorded, transcribed and analyzed with AI. You tell them that you and your service providers (us, and ours in Annex A) do this to handle each call and check its quality. You also tell them that callers hear a short notice first, in the number’s language.
Health care. You tell us in Annex C whether you bill any health insurer or health plan, on paper or electronically. You also tell us there whether your ads or offers reach people in Washington, Nevada or Connecticut, and whether you are a Florida-licensed health care practitioner. If you bill any health insurer or health plan, or leave that question unanswered, none of your identifiable leads or calls come to us: they go straight to your own systems, and we report on counts; that changes only with a business associate agreement signed first.
Patient lists. You do not give us patient lists for audiences, campaigns or messages unless each patient signed a written release allowing that use. If you are a covered entity, each patient must also have signed a HIPAA authorization naming that use.
Your content. You are responsible for the offers and claims you approve in ads and messages.
Washington, Nevada and Connecticut. If your health services reach those states, you publish the consumer health data policy their laws require and link it from your home page. We tell you what our processing adds to it.

6. Responsibility

Each of us is responsible for our own breaches of this agreement and of the laws that apply to us. Each of us defends and indemnifies the other against claims by third parties, class actions and regulators included, to the extent they arise from: for Feedback Studios, the behavior of its tracker and its send layer, the consent texts and notices it drafts, and its breach of section 4; for you, your forms, offers and content, any change you make to our texts or notices, your choice under section 5.1, and your breach of section 5. Each party’s total liability under this agreement, these duties to defend and indemnify included, is limited to the fees you paid us in the 12 months before the event that gave rise to the liability. This limit does not apply to fraud, gross negligence or willful misconduct, or to liability the law does not allow to be limited. Each of us keeps insurance that covers these claims, or tells the other in writing that it does not.

7. General

This agreement lasts as long as the Services, and sections 4.9, 5 and 6 survive it. Florida law governs; the courts of Miami-Dade County, Florida decide disputes. This agreement is published in English and Spanish; if the two differ, the English version prevails.

Annex A: our providers

Provider	What it does with your data	Where
IONOS	Hosts Feedback OS, which transcribes recorded calls, and our email.	United States; Feedback OS and its databases in the Kansas City area
Twilio	Tracked numbers, calls, recordings, texts.	United States
Meta	WhatsApp messages in your name, through Meta’s WhatsApp Business Platform. Conversions to your Meta datasets, when you enable them.	United States
Google	Conversions to your Google Ads account, when you enable them. Calendar availability if you book through us.	United States
Anthropic	AI that helps our staff draft messages, audits and plans. The summary, tags and quality score of each recorded call to your tracked numbers, from its transcript. Nothing from a clinic property.	United States

Backups are encrypted and kept on equipment Feedback Studios owns.

Annex B: security measures

Encryption in transit (TLS) for every connection.
Provider tokens and mailbox passwords encrypted at rest in a secret store bound to their record.
Two-factor sign-in required for anyone with administrative permissions.
Role-based access with department scopes.
An append-only audit log of permission, settings and data-export actions.
Append-only consent and touch records, the consent records keeping IP address and browser details encrypted as proof.
Nightly encrypted backups with a monthly restore test, deleted data leaving them within 30 days.
No IP address or browser stored with visit records, and none logged by the web server for the tracker.
Client data kept apart from our own contacts.

Annex C: the Client’s declarations

You answer these questions when you sign the proposal or service agreement that refers to this agreement.

Do you bill any health insurer or health plan, on paper or electronically, yourself or through anyone (a billing company or a clearinghouse included)? If yes, or if left blank, none of your identifiable leads or calls come to us (section 5.5).
Do your ads or offers reach people in Washington, Nevada or Connecticut?
Are you, or your practitioners, licensed health care practitioners in Florida?
Are you a “business” under the California Consumer Privacy Act?
Should calls to your tracked numbers be recorded? A recorded call is also transcribed and analyzed with AI for its summary, tags and quality score, and its transcript kept with the lead, never used for attribution. The caller first hears a short notice in the number’s language, which you choose per number. (Never for clinics.)
Which forms on your sites are lead forms? (We capture only those.)
Does any form ask for a password, a card or an account login, or sit behind a login? If so, which?
Which US states do your ads or offers reach?
Is any page or ad of yours directed to children under 13? (COPPA, 16 CFR Part 312)
If your sites receive visitors from California: do you choose the opt-in prompt, or do you accept the risk of a notice alone? (section 5.1)