Data Processing Agreement

This agreement applies whenever Neurasoft Limited (company number 16575467) processes personal data on your behalf through Nova Agents. It forms part of the Terms of Service. You are the controller; we are the processor. It is written to meet Article 28 of the UK GDPR.

1. What is processed, and why

  • Subject matter: providing AI voice assistants that answer and place telephone calls on your behalf.
  • Duration: for as long as your account is open, plus any retention period you have chosen.
  • Nature and purpose: receiving and placing calls, converting speech to text, generating replies and summaries, storing transcripts, and booking appointments. Calls are never recorded.
  • Types of personal data: callers' telephone numbers, the content of their conversations, and whatever they volunteer during a call — typically a name, and possibly appointment or enquiry details.
  • Categories of data subject: anyone who calls one of your numbers or is called by one of your assistants.

Callers may say anything, including special category data — a medical symptom, for example. Nova is not designed to solicit it, and you should configure your assistants and your retention settings with that in mind.

2. Our obligations

  • We process personal data only on your documented instructions. Your use of the product is your instruction; anything else needs to be in writing. If we believe an instruction breaks data protection law we will tell you.
  • Everyone with access is bound by confidentiality obligations.
  • We will not use your call content to train AI models, ours or anyone else's, and we will not sell it.

3. Security

We maintain appropriate technical and organisational measures, including: encryption in transit; encryption at rest for credentials and secrets using AES-256-GCM; passwords stored only as bcrypt hashes; optional two-factor authentication; signature verification on every inbound webhook; rate limiting on authentication; role-based access control; and per-organisation isolation of all data access.

4. Sub-processors

You give general authorisation for the sub-processors below. We remain liable for their performance.

  • Voice AI processing — Turning speech into text, generating the assistant's replies, and speaking them during the call.
  • Twilio — Telephony: receiving and placing calls, and sending appointment confirmation texts.
  • Telnyx (only if you enable it) — Telephony, as an alternative to Twilio.
  • Plivo (only if you enable it) — Telephony, as an alternative to Twilio.
  • Stripe — Payments, subscriptions and invoicing.
  • Resend — Transactional email: password resets, alerts and the daily digest.
  • Render — Application hosting and the Nova database.
  • Google (Calendar API) (only if you enable it) — Mirroring appointments into your own Google Calendar.
  • Cal.com (only if you enable it) — Mirroring appointments into your own Cal.com account.

The one we don't name here. The supplier performing the voice AI processing is identified above by function rather than by name, for commercial reasons. You are entitled to know who it is: write to support@neurasoft.ltd and we will tell you, along with where it is located.

We will give you notice before adding or replacing any sub-processor, and you may object on reasonable data-protection grounds — if we cannot resolve your objection, you may terminate the affected service.

5. International transfers

Some sub-processors are outside the UK. Where personal data is transferred, we rely on a UK adequacy decision or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.

6. Helping you meet your own obligations

  • Data subject requests. The product gives you direct access to erase or export the data we hold for you. Where a request reaches us instead, we will forward it to you rather than answer it, and will help you respond.
  • Breach notification. We will tell you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting your data, with the detail you need to notify the ICO.
  • Assessments. We will give you reasonable help with data protection impact assessments and prior consultations.

7. Deletion and return

The product gives you deletion controls directly: erase a single call, erase everything about one caller, delete messages and appointments individually, switch call history off entirely, and set a retention period that is applied automatically. Deleting your whole account is done for you on request, and on termination we delete your data after a short grace period, except where we must keep records to comply with the law. Backups are overwritten on their ordinary cycle.

8. Audit

We will make available the information needed to demonstrate compliance with this agreement and will contribute to audits, on reasonable notice, no more than once a year unless required by a regulator or following a breach.

9. Your obligations

You warrant that you have a lawful basis for the processing you ask us to perform, that you have given callers the information they are entitled to — including that calls are answered by an AI — and that your instructions comply with data protection law.

10. General

Where this agreement conflicts with the Terms of Service on the subject of personal data, this agreement prevails. It is governed by the law of England and Wales. Questions go to support@neurasoft.ltd.

Last updated 21 August 2026.