Legal · Data Processing
Data Processing Agreement.
How Meetzy processes personal data on behalf of its customers under GDPR Article 28. We sign a data processing agreement with each customer on these terms.
At a glance
Processor
Meetzy is the Data Processor. You are the Controller.
Hosted in Spain
Platform and database on AWS in Spain. Some sub-processors process data outside the EU (see below).
AES-256
Encryption at rest. TLS 1.2 or higher in transit.
30 days
Notice period for any sub-processor change, with right to object.
01
Scope and roles.
This agreement applies whenever Meetzy processes personal data on behalf of a customer who is a Data Controller under GDPR. Meetzy acts strictly as a Data Processor and only processes data on documented instructions from the Controller.
02
Sub-processors.
We rely on the following sub-processors. The location column shows where each one processes data.
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage and backups | Spain (EU) |
| ElevenLabs | Voice conversation engine: speech recognition, AI model orchestration, voice synthesis and call recording | United States |
| Twilio | Telephony, call routing, SMS and WhatsApp | United States |
| Google (Gemini) | AI models for live conversations and post-call analysis | Global |
| Anthropic | AI models for post-call analysis (summaries, outcomes, evaluations) and the Meetzy chat assistant | United States |
| OpenAI | Speech-to-text for specific voice features, such as voicemail detection | United States |
| Vercel | Hosting of the Meetzy chat application and routing of requests to AI model providers | United States |
| Google (Firebase) | User sign-in for the Meetzy platform | Global |
| Sentry | Error monitoring | Germany (EU) |
| Stripe | Billing | Per vendor |
| Resend | Transactional email | Per vendor |
| HubSpot / Salesforce / Zoho / Zendesk / Jira / Genesys and other connected tools | CRM, ticketing and contact-center sync (only when enabled by the Controller) | Per vendor |
03
Data categories processed.
- — Identifiers (phone numbers, names and email addresses of the people called or calling)
- — Audio recordings of calls
- — Transcriptions
- — Conversation metadata (timestamps, durations, outcomes)
- — Data the Controller provides for its calls, such as contact lists or customer records
- — Results of the actions the agent performs during a call, such as bookings or CRM lookups
- — CRM-synced data (only if the Controller enables a CRM integration)
- — Account details of the Controller's users of the Meetzy platform
04
Security measures (Article 32).
- — Encryption at rest (AES-256) and in transit (TLS 1.2 or higher)
- — Hosting on AWS in Spain, with the database in a private network not reachable from the internet
- — Isolation between customer accounts and role-based access (owner, admin, member)
- — Database replicated across two availability zones, with automated daily backups kept for 7 days
- — Web application firewall in front of our public APIs
- — Notification to the Controller without undue delay after becoming aware of a personal data breach
05
Data subject rights.
Meetzy assists Controllers in fulfilling access, deletion, rectification, and portability requests without undue delay, so that they can meet their legal deadlines.
06
Retention.
Call recordings and transcriptions are kept for as long as the service is active, unless the Controller sets a shorter retention period. The Controller can ask us to delete specific data at any time.
07
Term and termination.
This DPA terminates with the underlying service agreement. Upon termination, Meetzy returns or deletes all personal data within 30 days, at the Controller's choice.
08
Sub-processor change notification.
We provide 30 days' advance notice by email before adding or replacing a sub-processor. Controllers may object during the notice period.
09
Liability.
Liability under this DPA is governed by the underlying service agreement and applicable data protection law. Statutory liability under Article 82 GDPR is unaffected.
10
Telephony numbers.
Phone numbers used for outbound calls, including the number ranges required by Spanish regulation for commercial calls and for customer care calls, are provisioned through Twilio as sub-processor. The Controller decides the purpose of its calls and is responsible for classifying them and using the number range that corresponds to each type, as set out in the underlying service agreement and our Terms of Service.