Legal Center

This Master Services Agreement ("Agreement") is entered into by and between CallSignal ("CallSignal," "we," "our," or "us") and the individual or entity accepting this Agreement ("Customer" or "you").

This Agreement governs Customer's access to and use of CallSignal's software, hosted services, APIs, integrations, artificial intelligence features, communications platform, websites, and related services.

1. Definitions#

For purposes of this Agreement, the following definitions apply.

Affiliate

Any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

AI Services

Artificial intelligence functionality provided by CallSignal, including automated analysis, transcription, summarization, classification, recommendations, scoring, generated responses, and similar features.

Authorized User

Any employee, contractor, representative, or agent authorized by Customer to access the Service.

CallSignal

The hosted communications platform and all related software, APIs, documentation, websites, mobile applications, integrations, artificial intelligence functionality, and related services provided by CallSignal.

Customer Data

Any information, content, recordings, telephone numbers, uploaded documents, contacts, configurations, messages, audio, transcripts, or other data submitted to the Service by Customer or Authorized Users.

Customer Data does not include CallSignal software, analytics generated from aggregated anonymous usage, or Service metadata that does not identify Customer.

Documentation

The published technical or user documentation provided by CallSignal.

Escalation Workflow

A Customer-defined sequence of notification attempts, contacts, communication methods, delays, retry intervals, acknowledgements, and escalation rules.

Feedback

Any suggestions, ideas, enhancement requests, bug reports, recommendations, or comments regarding the Service.

Service

Collectively: CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer, including APIs, web applications, Microsoft Teams applications, Slack applications, integrations, artificial intelligence features, reporting, analytics, and future enhancements.

Subscription

Customer's purchased right to use the Service during the applicable Subscription Term.

Third-Party Provider

Any provider not owned or operated by CallSignal, including telecommunications carriers, SignalWire, Microsoft, cloud infrastructure providers, email providers, SMS providers, analytics providers, payment processors, and similar vendors.

2. Scope of Services#

Subject to this Agreement, CallSignal grants Customer a limited, non-exclusive, non-transferable, revocable right to access and use the Service during the Subscription Term.

Nothing in this Agreement transfers ownership of the Service to Customer. Customer receives only the right to use the Service under this Agreement.

3. Products Covered#

This Agreement applies to all current and future CallSignal offerings including:

CallSignal Escalate

Persistent notification and escalation workflows that attempt to notify designated recipients through configurable communications channels.

CallSignal Audit

Artificial intelligence assisted call analysis, mystery shopping, transcription, scoring, reporting, analytics, and quality monitoring.

CallSignal Verify

Telephone inventory validation, automated number verification, telecommunications auditing, inventory reporting, and related services. Verification results are informational only and do not guarantee ownership, routing, availability, or operational status.

CallSignal Answer

Artificial intelligence powered conversational assistant using Customer-provided documents, knowledge bases, and configuration. Responses are generated from Customer-provided information and AI models.

4. Subscription#

Customer purchases access to the Service through a Subscription. Subscriptions may include:

• Monthly plans
• Annual plans
• Enterprise agreements
• Trial subscriptions
• Promotional subscriptions

Unless otherwise agreed in writing, subscriptions automatically renew for successive terms until cancelled.

5. Customer Accounts#

Customer agrees to:

• provide accurate information;
• maintain current billing information;
• maintain secure passwords;
• promptly notify CallSignal of unauthorized account access.

Customer is responsible for all activities occurring under its accounts.

6. Authorized Users#

Customer is responsible for all actions taken by Authorized Users. Customer shall ensure Authorized Users comply with this Agreement.

7. Customer Responsibilities#

Customer agrees to:

• maintain accurate contact information;
• periodically test notification workflows;
• verify uploaded documents;
• maintain backup communications procedures;
• comply with applicable law;
• maintain required telecommunications registrations.

Customer acknowledges that successful operation depends upon proper Customer configuration.

8. Best Effort Service#

CallSignal is provided on a commercially reasonable best-effort basis. CallSignal does not guarantee:

• delivery;
• routing;
• completion;
• acknowledgement;
• timing;
• availability;
• ordering;
• accuracy;
• uninterrupted service.

Communications may fail for reasons outside CallSignal's control.

9. Telecommunications Limitations#

Customer acknowledges the Service depends upon Third-Party Providers. These include:

• telecommunications carriers;
• internet providers;
• cloud providers;
• SMS providers;
• email providers;
• Microsoft;
• SignalWire;
• VoIP providers.

These providers may block, filter, throttle, delay, or reject traffic, or experience outages. CallSignal has no control over these actions.

10. High Volume Communications#

Carrier networks may impose throughput limitations. Large notification campaigns may experience:

• delays;
• queueing;
• rate limiting;
• message filtering;
• carrier rejection.

CallSignal reserves the right to impose additional platform rate limits to preserve system integrity.

11. A2P 10DLC#

Where applicable, Customer is solely responsible for:

• Brand Registration;
• Campaign Registration;
• Message Classification;
• Required carrier approvals.

Failure to maintain required registrations may result in message blocking or suspension.

12. STIR/SHAKEN#

Customer shall:

• use only telephone numbers it is authorized to use;
• present accurate caller identification;
• avoid misleading caller ID.

Caller ID spoofing is prohibited.

13. No Emergency Use#

THE SERVICE IS NOT DESIGNED OR INTENDED FOR:

• 911 services;
• emergency dispatch;
• medical emergencies;
• fire alarms;
• public safety;
• life-safety systems;
• disaster notification;
• situations where failure could result in death, injury, or property damage.

Customer agrees not to rely upon the Service as its sole communications mechanism for emergency or mission-critical purposes. Customer shall maintain independent redundant communications systems.

14. Artificial Intelligence Services#

Certain products use artificial intelligence. AI-generated content may contain:

• inaccuracies;
• hallucinations;
• incomplete information;
• outdated information.

Customer is solely responsible for reviewing AI-generated content before relying upon it. CallSignal makes no warranty regarding AI output.

15. Call Recording#

Customer represents it has obtained all legally required consents for recording, monitoring, transcription, or analysis of communications. Customer bears sole responsibility for compliance with recording laws.

16. Customer Data#

Customer retains ownership of Customer Data. Customer grants CallSignal a worldwide license to process Customer Data solely to provide, maintain, secure, improve, and support the Service.

17. Privacy#

Processing of personal information is governed by the CallSignal Privacy Policy and applicable Data Processing Addendum.

18. Security#

CallSignal maintains commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Service. No security system is infallible.

19. Intellectual Property#

CallSignal owns all right, title, and interest in:

• software;
• source code;
• APIs;
• documentation;
• trademarks;
• logos;
• AI models developed by CallSignal;
• reports generated from aggregated anonymous data.

No ownership transfers to Customer.

20. Feedback#

Customer grants CallSignal a perpetual, irrevocable, worldwide, royalty-free license to use Feedback without restriction or compensation.

21. Confidentiality#

Each party agrees to protect the other's Confidential Information using reasonable care and not disclose it except as required to perform under this Agreement or by law.

22. Warranties#

CallSignal warrants that it will provide the Service in a professional and commercially reasonable manner. Except as expressly stated, the Service is provided "AS IS" and "AS AVAILABLE." CallSignal disclaims all implied warranties, including merchantability, fitness for a particular purpose, non-infringement, and uninterrupted operation.

23. Limitation of Liability#

To the fullest extent permitted by law, neither party shall be liable for indirect, incidental, special, exemplary, punitive, or consequential damages, including lost profits, lost revenue, lost business opportunities, loss of goodwill, or loss of data, even if advised of the possibility of such damages.

CallSignal's aggregate liability arising out of or relating to this Agreement shall not exceed the total fees paid by Customer to CallSignal during the twelve (12) months immediately preceding the event giving rise to the claim. These limitations apply regardless of the legal theory asserted.

24. Indemnification#

Customer shall defend, indemnify, and hold harmless CallSignal, its affiliates, officers, employees, and agents from any third-party claims arising from:

• Customer's misuse of the Service;
• violation of law;
• failure to obtain required consents;
• Customer Data;
• infringement resulting from Customer-provided materials.

CallSignal shall defend and indemnify Customer against third-party claims alleging that the Service, as provided by CallSignal and used in accordance with this Agreement, infringes a valid intellectual property right, subject to customary exclusions (including Customer modifications, combinations with non-CallSignal products, or Customer Data).

25. Suspension#

CallSignal may suspend access immediately if reasonably necessary to:

• protect the platform;
• prevent fraud;
• investigate abuse;
• comply with law;
• respond to security threats;
• address non-payment;
• protect third parties.

Where practical, CallSignal will provide notice of suspension.

26. Termination#

Either party may terminate this Agreement as provided in an applicable Order Form or by applicable law. CallSignal may terminate immediately for material breach, illegal activity, repeated abuse, or non-payment.

Upon termination:

• Customer's access ends;
• licenses terminate;
• payment obligations accrued prior to termination survive;
• Customer may request return or deletion of Customer Data subject to the DPA and retention obligations.

27. Export Compliance and Sanctions#

Customer agrees not to use the Service in violation of applicable export control, sanctions, or trade laws, including those administered by the United States. Customer represents that it is not located in, organized under the laws of, or owned or controlled by persons in jurisdictions subject to comprehensive sanctions, and is not identified on applicable denied-party or restricted-party lists.

28. Force Majeure#

Neither party will be liable for delays or failures caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, widespread internet failures, telecommunications outages, cloud infrastructure failures, governmental actions, epidemics, pandemics, or failures of third-party providers.

29. Governing Law#

This Agreement shall be governed by the laws of the State of New Jersey, without regard to its conflict of law principles.

30. Dispute Resolution#

Any dispute arising out of or relating to this Agreement shall first be addressed through good-faith negotiations between the parties.

If not resolved, the dispute shall be settled by binding arbitration administered under the rules of the American Arbitration Association. The arbitration shall take place in Bucks County, Pennsylvania, unless the parties agree otherwise.

Each party waives the right to a jury trial and to participate in a class action to the fullest extent permitted by law.

31. Changes to this Agreement#

CallSignal may update this Agreement from time to time. Material changes will become effective upon publication or as otherwise communicated. Continued use of the Service after the effective date constitutes acceptance of the revised Agreement.

32. Entire Agreement#

This Agreement, together with any applicable Order Forms, Privacy Policy, Data Processing Addendum, Security Addendum, Acceptable Use Policy, and Service Level Agreement, constitutes the entire agreement between the parties regarding the Service and supersedes all prior or contemporaneous agreements on the same subject matter.

These Terms of Service ("Terms") govern your access to and use of the CallSignal Service. By creating an account, installing an application, connecting an integration, purchasing a subscription, or otherwise using the Service, you agree to these Terms.

These Terms incorporate by reference the following documents:

• Master Services Agreement
• Privacy Policy
• Data Processing Addendum (where applicable)
• Acceptable Use Policy
• Security Addendum
• Service Level Agreement (if purchased)
• Any applicable Order Form

If you do not agree to these Terms, you may not use the Service.

1. About CallSignal#

CallSignal provides cloud-based communications software designed to help organizations monitor, verify, answer, audit, and escalate communications. Services include CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer.

Certain features may be delivered through integrations including Microsoft Teams, Slack, web browsers, APIs, and mobile devices.

2. Eligibility#

You must be at least eighteen (18) years old and legally capable of entering into a binding agreement. If you use the Service on behalf of an organization, you represent that you have authority to bind that organization.

3. Account Registration#

You agree to:

• provide accurate registration information;
• maintain current contact information;
• keep passwords confidential;
• use commercially reasonable efforts to prevent unauthorized access.

You are responsible for all activity under your account.

4. Authorized Users#

You may authorize employees, contractors, or agents to use the Service. You remain responsible for their actions and compliance with these Terms.

5. Subscription Plans#

The Service may be offered under:

• Free plans
• Trial plans
• Monthly subscriptions
• Annual subscriptions
• Enterprise agreements

Available features vary by subscription level. CallSignal may modify subscription offerings from time to time.

6. Billing#

Customer agrees to pay all applicable fees. Unless otherwise stated:

• subscriptions renew automatically;
• fees are billed in advance;
• taxes are Customer's responsibility.

Failure to pay may result in suspension or termination.

7. Trials#

Trial subscriptions may be limited by:

• duration;
• features;
• users;
• communications volume.

CallSignal may terminate a trial at any time. Data from a trial may be deleted after expiration unless converted to a paid subscription.

8. Acceptable Use#

Customer shall not:

• violate any law;
• send spam;
• send unlawful robocalls;
• transmit malware;
• harass individuals;
• impersonate another person;
• interfere with platform security;
• reverse engineer the Service;
• attempt unauthorized access;
• overload the platform;
• use the Service for fraudulent activity.

Additional restrictions are contained in the Acceptable Use Policy.

9. Communications Compliance#

Customer is solely responsible for compliance with all applicable communications laws, including:

• TCPA
• CAN-SPAM
• STIR/SHAKEN
• A2P 10DLC
• state telemarketing laws
• international regulations where applicable

Customer represents that all required permissions and consents have been obtained.

10. CallSignal Escalate#

CallSignal Escalate attempts to notify designated recipients using Customer-configured escalation workflows. Although the Service may attempt multiple contacts across multiple channels, successful delivery or acknowledgement is not guaranteed.

Customers are responsible for:

• configuring workflows;
• testing workflows;
• maintaining alternate notification procedures;
• ensuring recipient information remains current.

11. CallSignal Audit#

CallSignal Audit may:

• record calls;
• transcribe conversations;
• evaluate interactions;
• generate quality scores;
• summarize conversations;
• identify trends.

Customer is solely responsible for obtaining any legally required notice or consent before recording or analyzing communications. AI-generated analysis should be reviewed before making employment, legal, disciplinary, or business decisions.

12. CallSignal Verify#

CallSignal Verify performs automated verification of telecommunications assets. Verification results are estimates based upon available information and automated testing. Results should not be considered legal proof of:

• ownership;
• service status;
• routing;
• regulatory compliance;
• operational readiness.

13. CallSignal Answer#

CallSignal Answer generates responses using Customer-provided documentation and configuration. Customer is responsible for:

• ensuring uploaded content is accurate;
• removing outdated information;
• reviewing AI-generated responses.

CallSignal does not independently verify Customer-provided information.

14. Artificial Intelligence#

Some features use artificial intelligence. AI output may contain:

• factual errors;
• omissions;
• hallucinations;
• outdated information.

Customer remains responsible for reviewing all AI-generated content. AI output should not be relied upon as legal, medical, financial, employment, or regulatory advice.

15. Third-Party Services#

The Service depends upon Third-Party Providers including:

• telecommunications carriers;
• Microsoft;
• SignalWire;
• cloud providers;
• SMS providers;
• payment processors;
• email providers.

CallSignal is not responsible for the acts or omissions of Third-Party Providers.

16. Carrier Limitations#

Customer acknowledges that telecommunications carriers may:

• block communications;
• filter communications;
• throttle traffic;
• reject messages;
• delay delivery.

These actions are outside CallSignal's control.

17. High Volume Communications#

Large messaging or calling campaigns may be delayed due to:

• carrier policies;
• platform protections;
• fraud prevention;
• network congestion;
• regulatory requirements.

CallSignal may apply rate limits to preserve platform integrity.

18. Best Effort Service#

The Service is provided on a commercially reasonable best-effort basis. CallSignal does not guarantee:

• delivery;
• completion;
• routing;
• timing;
• availability;
• acknowledgements;
• uninterrupted operation.

19. No Emergency Use#

THE SERVICE IS NOT A SUBSTITUTE FOR:

• 911;
• emergency dispatch;
• fire alarms;
• medical alert systems;
• public safety systems;
• disaster notification systems;
• life-safety communications.

Do not rely upon the Service where failure could result in injury, death, or significant property damage. Customers must maintain independent redundant communication systems.

20. Customer Data#

Customer retains ownership of Customer Data. Customer grants CallSignal permission to process Customer Data as necessary to provide the Service. CallSignal does not acquire ownership of Customer content.

21. Privacy#

Collection and processing of personal information are governed by the Privacy Policy. Enterprise Customers may also be subject to a Data Processing Addendum.

22. Security#

CallSignal maintains commercially reasonable administrative, technical, and organizational safeguards. No security measure can guarantee complete protection against every threat.

23. Intellectual Property#

The Service, including software, APIs, documentation, trademarks, branding, AI models developed by CallSignal, and related intellectual property, remain the exclusive property of CallSignal and its licensors. No ownership rights are transferred through use of the Service.

24. Feedback#

If Customer provides suggestions or feedback, Customer grants CallSignal a perpetual, irrevocable, worldwide, royalty-free license to use that feedback without restriction or compensation.

25. Suspension#

CallSignal may suspend access immediately if reasonably necessary to:

• protect the Service;
• investigate abuse;
• comply with law;
• respond to security incidents;
• prevent fraud;
• address non-payment.

Where practical, notice will be provided.

26. Termination#

Customer may discontinue use of the Service at any time. CallSignal may terminate or suspend accounts for:

• material breach;
• fraud;
• abuse;
• unlawful activity;
• repeated policy violations;
• non-payment.

Upon termination:

• access ends;
• licenses terminate;
• Customer remains responsible for outstanding fees.

27. Disclaimers#

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE."

To the maximum extent permitted by law, CallSignal disclaims all implied warranties including:

• merchantability;
• fitness for a particular purpose;
• non-infringement;
• uninterrupted service;
• error-free operation.

28. Limitation of Liability#

To the fullest extent permitted by law, CallSignal shall not be liable for:

• indirect damages;
• consequential damages;
• lost profits;
• lost revenue;
• business interruption;
• loss of goodwill;
• loss of data.

CallSignal's aggregate liability shall not exceed the fees paid by Customer during the twelve (12) months preceding the event giving rise to the claim.

29. Export Compliance#

Customer agrees to comply with all applicable export control and sanctions laws. Customer may not use the Service in violation of United States export regulations.

30. Force Majeure#

Neither party is responsible for delays or failures caused by events beyond reasonable control, including:

• natural disasters;
• labor disputes;
• internet outages;
• cloud outages;
• carrier failures;
• government actions;
• war;
• terrorism;
• pandemics.

31. Governing Law#

These Terms are governed by the laws of the State of New Jersey, excluding conflict of law principles.

32. Arbitration#

Any dispute arising under these Terms shall be resolved by binding arbitration administered by the American Arbitration Association in New Jersey, except where applicable law prohibits mandatory arbitration. Each party waives the right to a jury trial and to participate in class actions to the fullest extent permitted by law.

33. Changes to These Terms#

CallSignal may revise these Terms from time to time. Material changes become effective upon publication or as otherwise communicated. Continued use of the Service after the effective date constitutes acceptance of the revised Terms.

34. Contact Information#

Questions regarding these Terms may be directed to:

• CallSignal
• Email: legal@getcallsignal.com
• Privacy inquiries: privacy@getcallsignal.com
• Support: support@getcallsignal.com
• Website: https://www.getcallsignal.com

35. Entire Agreement#

These Terms, together with the Master Services Agreement, Privacy Policy, Acceptable Use Policy, Data Processing Addendum (where applicable), Security Addendum, Service Level Agreement (if applicable), and any Order Form, constitute the complete agreement governing Customer's use of the Service.

This Privacy Policy explains how CallSignal collects, uses, stores, shares, and protects personal information when providing CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, CallSignal Answer, and related services (collectively, the "Service").

This Privacy Policy applies to the Service and its applications, APIs, and integrations. It does not apply solely to the website.

This Privacy Policy is intended to satisfy the privacy disclosure requirements for the Slack Marketplace, the Microsoft Teams Marketplace, and similar application marketplaces.

1. Who We Are#

CallSignal provides cloud-based communication automation, AI-powered call analysis, AI-powered virtual reception services, telecommunications verification, and notification escalation software. Products include CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer. Throughout this Privacy Policy these products are collectively referred to as the "Service."

2. Information We Collect#

Depending upon how the Service is used, we may collect the following categories of information.

Account Information

• Name
• Company name
• Business email address
• Business phone number
• Job title
• Billing information
• User role
• Authentication information

Communication Information

Customer-provided:

• Telephone numbers
• Email addresses
• Escalation contacts
• Distribution lists
• Routing rules
• Notification schedules

Call Information

Depending on the products used, we may process:

• Caller ID
• Called number
• Call timestamps
• Call duration
• Call recordings
• Call transcripts
• AI summaries
• AI classifications
• AI-generated recommendations
• Delivery attempts
• Notification acknowledgements

Customer Content

Customer may upload:

• Documents
• PDFs
• Knowledge bases
• Company policies
• Scripts
• FAQs
• Contact databases
• Audio recordings
• Configuration data

Customer retains ownership of Customer Content.

Technical Information

We automatically collect technical information including:

• IP address
• Browser type
• Device information
• Operating system
• Authentication logs
• Session identifiers
• Error logs
• API activity
• Audit logs

Usage Information

We collect information about how the Service is used, including:

• Features used
• Login history
• Administrative changes
• Notification history
• Configuration activity
• Integration usage

3. How We Use Information#

We use personal information to:

• Provide the Service
• Deliver notifications
• Route communications
• Generate reports
• Authenticate users
• Provide customer support
• Secure accounts
• Prevent fraud
• Improve Service functionality
• Maintain system reliability
• Comply with legal obligations

We do not use Customer Content to advertise to individuals.

4. Artificial Intelligence Processing#

Certain CallSignal products use artificial intelligence. These include CallSignal Audit and CallSignal Answer. AI may be used to:

• Transcribe audio
• Summarize conversations
• Classify communications
• Generate suggested responses
• Score calls
• Produce analytics

Customer remains responsible for reviewing AI-generated output before relying upon it.

5. Information We Do Not Sell#

• CallSignal does not sell personal data.
• We do not sell personal information to advertisers.
• We do not rent personal information.
• We do not monetize Customer Content.
• We do not share personal information for cross-context behavioral advertising.

6. How Information Is Shared#

We only share information when necessary to operate the Service. Examples include:

Service Providers

Including:

• Telecommunications providers
• Voice providers
• Cloud infrastructure providers
• Email delivery providers
• Payment processors
• Monitoring services
• Security providers

These providers process information solely to provide services on our behalf.

Legal Requirements

We may disclose information if required by law, including:

• Court orders
• Subpoenas
• Regulatory investigations
• Protection of legal rights
• Fraud investigations

Business Transactions

If CallSignal is involved in a merger, acquisition, financing, or sale of assets, Customer information may be transferred as part of the transaction, subject to applicable law.

7. Third-Party Providers#

The Service relies upon third-party providers including telecommunications carriers, cloud providers, and software providers. Examples include providers of:

• Voice services
• SMS delivery
• Email delivery
• Cloud hosting
• Authentication
• Monitoring
• Payment processing

These providers maintain their own privacy practices.

8. Microsoft Teams#

CallSignal Escalate integrates with Microsoft Teams. When authorized by Customer, the Service may access Microsoft Teams information necessary to:

• send notifications
• receive commands
• authenticate users
• display application information

CallSignal only accesses information authorized by the Customer or Microsoft permissions granted during installation.

9. Slack#

Where enabled, CallSignal may integrate with Slack to:

• send alerts
• receive commands
• authenticate users
• display workflow information

Only information necessary for these functions is processed.

10. Data Retention#

Customer information is retained only as long as necessary to:

• provide the Service
• satisfy contractual obligations
• comply with legal obligations
• resolve disputes
• enforce agreements

Unless otherwise required by law, Customer Data requested for deletion following account termination will generally be deleted within 30 days. Certain audit logs, billing records, and security logs may be retained longer where required by law or legitimate business purposes.

11. Security#

CallSignal maintains commercially reasonable administrative, physical, and technical safeguards. These include:

• Encryption in transit using TLS
• Authentication controls
• Role-based access controls
• Logging
• Audit trails
• Monitoring
• Backup procedures
• Security reviews

No system is completely secure.

12. International Data Transfers#

Customer information may be processed in the United States or other jurisdictions where CallSignal or its service providers operate. Where required, CallSignal implements appropriate safeguards for international transfers.

13. GDPR (European Economic Area and United Kingdom)#

For customers subject to GDPR:

Controller and Processor

Generally, Customer acts as the Data Controller and CallSignal acts as the Data Processor.

Legal Basis

We process information based upon:

• Contract performance
• Legitimate interests
• Legal obligations
• Consent where required

Data Subject Rights

Individuals may request:

• Access
• Correction
• Deletion
• Restriction
• Data portability
• Objection to processing

Where CallSignal acts as Processor, requests should generally be directed to the Customer. CallSignal will reasonably assist Customers in responding to valid requests.

14. California Privacy Rights (CCPA / CPRA)#

California residents may have rights to:

• Know what personal information is collected
• Request deletion
• Request correction
• Request access
• Limit certain processing where applicable

CallSignal does not sell personal information. We do not discriminate against individuals exercising privacy rights. Privacy requests may be submitted to privacy@getcallsignal.com.

15. Children's Privacy#

The Service is intended for businesses. It is not directed toward children under 18 years of age. We do not knowingly collect personal information from children.

16. Customer Responsibilities#

Customers remain responsible for:

• obtaining required consents
• maintaining lawful contact information
• complying with communications laws
• determining appropriate retention periods
• complying with privacy laws applicable to their business

17. Cookies#

Our websites and applications may use cookies and similar technologies to:

• authenticate users
• maintain sessions
• remember preferences
• improve functionality
• measure performance

Customers may manage cookies through browser settings, although disabling cookies may affect Service functionality.

18. Changes to this Privacy Policy#

We may update this Privacy Policy from time to time. Material changes become effective upon publication or as otherwise communicated. Continued use of the Service constitutes acceptance of the revised Privacy Policy.

19. Contact Information#

Privacy questions may be directed to:

• Privacy Officer — privacy@getcallsignal.com
• General Legal — legal@getcallsignal.com
• Support — support@getcallsignal.com
• Website — https://www.getcallsignal.com

20. Application Marketplace Compliance#

This Privacy Policy applies to CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer.

CallSignal Escalate is a notification and escalation platform that converts operational alerts into configurable notification workflows using telephone calls, messaging, and other communication channels until acknowledged.

This Privacy Policy applies to the Service itself and satisfies the requirement of the Slack Marketplace, the Microsoft Teams Marketplace, and similar application marketplaces that applications disclose how personal information is collected, used, and protected. A publicly accessible version of this Privacy Policy is maintained at https://www.getcallsignal.com/privacy.

This Data Processing Addendum ("DPA") forms part of the CallSignal Master Services Agreement ("MSA"), Terms of Service, and any applicable Order Form (collectively, the "Agreement") entered into between CallSignal ("Processor") and the Customer ("Controller").

This DPA applies only to the extent CallSignal processes Personal Data on behalf of the Customer.

1. Purpose#

This DPA governs the processing of Personal Data by CallSignal while providing CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer.

This DPA is intended to satisfy applicable data protection requirements including, where applicable:

• General Data Protection Regulation (GDPR)
• UK GDPR
• California Consumer Privacy Act (CCPA)
• California Privacy Rights Act (CPRA)
• Other applicable privacy laws governing Processor relationships

2. Definitions#

Unless otherwise defined in the Agreement, the following definitions apply.

Controller

The entity determining the purposes and means of processing Personal Data.

Processor

CallSignal, acting solely on behalf of Customer.

Personal Data

Information relating to an identified or identifiable natural person.

Processing

Any operation performed on Personal Data including collection, storage, organization, transmission, retrieval, analysis, deletion, and destruction.

Data Subject

An identified or identifiable individual.

Subprocessor

Any third party engaged by CallSignal to process Personal Data while providing the Service.

3. Scope of Processing#

CallSignal processes Personal Data solely for purposes of providing the Service described in the Agreement. Typical categories of processing include:

• Authentication
• Notification delivery
• Call routing
• Call recording
• AI transcription
• AI summarization
• AI analysis
• Escalation workflows
• Support services
• Security monitoring
• Billing
• Reporting

4. Categories of Personal Data#

Depending upon Customer configuration, Personal Data may include:

Identity Information

• Name
• Company
• Job title
• Username

Contact Information

• Email address
• Telephone number
• Business address

Communications Data

• Caller ID
• Called number
• Call recordings
• Call transcripts
• AI-generated summaries
• Notification history
• Delivery attempts
• Escalation acknowledgements

Technical Information

• IP addresses
• Device identifiers
• Browser information
• Authentication logs
• Audit logs

Customer Uploaded Content

Customer-controlled documents may contain Personal Data including employee directories, customer information, operating procedures, knowledge bases, and support documentation. Customer determines the content uploaded.

5. Categories of Data Subjects#

Depending upon Customer's use of the Service, Data Subjects may include:

• Employees
• Contractors
• Customers
• Vendors
• Business partners
• Call participants
• Emergency contacts designated by Customer
• Website visitors
• Authorized Users

6. Duration of Processing#

CallSignal processes Personal Data:

• during the Subscription Term;
• while providing support;
• during any agreed transition period;
• for limited periods required by law following termination.

7. Customer Instructions#

CallSignal will process Personal Data only:

• under Customer instructions;
• as necessary to provide the Service;
• as required by law.

If CallSignal believes an instruction violates applicable law, CallSignal may suspend processing until the issue is resolved.

8. Confidentiality#

CallSignal shall ensure that personnel authorized to process Personal Data:

• are subject to confidentiality obligations;
• receive appropriate security awareness training;
• are granted access only where necessary.

9. Security Measures#

CallSignal maintains commercially reasonable security measures including:

Administrative Controls

• Security policies
• Employee training
• Background screening where appropriate
• Incident response procedures
• Change management

Technical Controls

• TLS encryption in transit
• Encryption of stored sensitive information where appropriate
• Multi-factor authentication for administrative access
• Role-based access controls
• Audit logging
• Intrusion monitoring
• Backup procedures
• Malware protection
• Vulnerability management

Physical Controls

Where applicable through hosting providers:

• Controlled facility access
• Environmental protections
• Redundant power
• Fire suppression
• Physical monitoring

10. Personal Data Breach#

If CallSignal becomes aware of a confirmed Personal Data Breach affecting Customer Personal Data, CallSignal will:

• investigate the incident;
• take reasonable steps to contain the incident;
• mitigate known impacts;
• notify Customer without unreasonable delay.

Where feasible, notification will generally occur within 72 hours after confirmation of a reportable breach, although specific timing depends upon the circumstances and applicable law.

Notification may include a description of the incident, categories of information involved, known impacts, remediation actions, and recommended Customer actions.

11. Assistance with Data Subject Requests#

Where Customer receives requests involving Access, Correction, Deletion, Restriction, Portability, or Objection, CallSignal will provide commercially reasonable assistance where technically feasible. Customer remains responsible for responding to Data Subject requests.

12. Assistance with Compliance#

Upon reasonable request, CallSignal will provide commercially reasonable assistance regarding:

• DPIAs
• Security questionnaires
• Regulatory inquiries
• Risk assessments
• Data protection obligations

Such assistance may be subject to reasonable professional service fees.

13. Subprocessors#

Customer authorizes CallSignal to engage Subprocessors necessary to operate the Service. Current Subprocessors are identified in the CallSignal Subprocessor List. CallSignal remains responsible for the performance of its Subprocessors to the extent required by applicable law.

14. New Subprocessors#

CallSignal may add or replace Subprocessors from time to time. Material additions will be reflected in the published Subprocessor List. Enterprise Customers may object to a new Subprocessor on reasonable documented data protection grounds within thirty (30) days after publication. If the parties cannot reasonably resolve the objection, Customer may terminate the affected portion of the Service without further liability for future charges associated solely with that affected portion.

15. International Transfers#

Customer acknowledges that Personal Data may be processed in jurisdictions outside the originating country. Where required, CallSignal will implement appropriate transfer mechanisms including:

• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum (where applicable)
• Other lawful transfer mechanisms recognized under applicable law

16. Data Retention#

Customer controls retention of Customer Data. Unless otherwise agreed:

• Active Customer data remains available during the Subscription Term.
• Following termination, Customer may request export of Customer Data for up to 30 days, unless prohibited by law or technical limitations.
• After the export period, Customer Data is scheduled for deletion from production systems in accordance with CallSignal's retention processes.

Certain information may be retained for longer periods where necessary to comply with law, resolve disputes, detect fraud, enforce agreements, or maintain security logs. Backup media may retain encrypted copies until overwritten through normal backup rotation schedules.

17. Data Deletion Requests#

Customer may request deletion of Personal Data. CallSignal will honor valid deletion requests unless retention is required by law, legal process, regulatory obligations, fraud prevention, or security investigations.

18. Return of Customer Data#

Upon written request following termination, CallSignal will make commercially reasonable efforts to provide Customer Data in a commonly used electronic format before deletion. CallSignal is not responsible for maintaining indefinite archives following account termination.

19. Audit Rights#

Enterprise Customers may request reasonable information demonstrating CallSignal's compliance with this DPA. Such requests:

• must occur no more than once annually unless required by law;
• must not unreasonably interfere with operations;
• must be subject to appropriate confidentiality obligations.

Where on-site audits are requested, reasonable advance notice is required and Customer is responsible for its own audit costs unless otherwise agreed.

20. California Privacy (CCPA / CPRA)#

To the extent CCPA or CPRA applies, CallSignal acts as a Service Provider or Contractor, as those terms are defined under applicable California law. CallSignal shall:

• process Personal Information only for the purposes specified in the Agreement;
• not sell Personal Information;
• not share Personal Information for cross-context behavioral advertising;
• not retain, use, or disclose Personal Information outside the business purposes described in the Agreement except as permitted by law.

21. GDPR Obligations#

Where GDPR applies, CallSignal shall:

• process Personal Data only on documented instructions;
• ensure personnel confidentiality;
• implement appropriate security measures under Article 32;
• assist with Articles 32 through 36 obligations where applicable;
• make available information reasonably necessary to demonstrate compliance;
• notify Customer of legally binding disclosure requests unless prohibited by law.

22. Artificial Intelligence Processing#

Certain CallSignal services use artificial intelligence to process Customer Content. Examples include transcription, summarization, classification, conversational responses, and quality scoring. Customer determines whether AI features are enabled. Customer remains responsible for reviewing AI-generated content before relying upon it. CallSignal does not use Customer Content to train publicly available foundation AI models without Customer's express written authorization.

23. Government Requests#

Unless prohibited by law, CallSignal will make commercially reasonable efforts to notify Customer before disclosing Customer Personal Data in response to governmental requests.

24. Survival#

The obligations contained in this DPA survive termination of the Agreement for so long as CallSignal continues processing Customer Personal Data.

25. Order of Precedence#

If there is a conflict between this DPA and the Agreement regarding Personal Data processing, this DPA governs solely with respect to that processing.

26. Contact Information#

Privacy inquiries regarding this DPA should be directed to:

• Privacy Officer — privacy@getcallsignal.com
• Legal inquiries — legal@getcallsignal.com
• Website — https://www.getcallsignal.com

This Security Addendum ("Security Addendum") forms part of the CallSignal Master Services Agreement ("MSA"), Terms of Service, Data Processing Addendum ("DPA"), and any applicable Order Form (collectively, the "Agreement").

This document describes the administrative, technical, organizational, and physical safeguards implemented by CallSignal to protect Customer Data and the availability of the Service.

Nothing in this Security Addendum constitutes a guarantee that a security incident will never occur. Security is a shared responsibility between CallSignal and the Customer.

1. Purpose#

CallSignal is committed to maintaining commercially reasonable safeguards to protect:

• Customer Data
• Personal Data
• Account credentials
• Call recordings
• AI-generated content
• Uploaded documents
• System configuration
• Audit logs
• Administrative access

This Security Addendum describes those safeguards.

2. Shared Responsibility Model#

CallSignal Responsibilities

CallSignal is responsible for securing:

• Application infrastructure
• Cloud infrastructure under its control
• APIs
• Authentication systems
• Administrative interfaces
• Platform software
• Monitoring systems
• Logging systems
• Security updates
• Incident response

Customer Responsibilities

Customer is responsible for:

• User account management
• Strong passwords
• Multi-factor authentication where available
• Proper workflow configuration
• Telephone number ownership
• Consent management
• Data accuracy
• Device security
• Endpoint protection
• User training
• Appropriate access permissions

Improper Customer configuration may reduce the effectiveness or security of the Service.

3. Security Program#

CallSignal maintains a risk-based information security program designed to:

• Protect confidentiality
• Maintain integrity
• Preserve availability
• Detect security incidents
• Respond to threats
• Recover from outages
• Continuously improve security controls

Security controls are periodically reviewed and updated based upon evolving risks.

4. Administrative Security Controls#

CallSignal maintains administrative safeguards including:

• Information security policies
• Acceptable use policies
• Change management procedures
• Security awareness training
• Access review procedures
• Vendor risk management
• Incident response procedures
• Business continuity planning
• Disaster recovery planning
• Secure software development practices

5. Personnel Security#

Personnel with access to production systems are granted access based upon business need. Where appropriate:

• Background screening may be conducted in accordance with applicable law.
• Personnel receive security awareness training.
• Confidentiality obligations are required.
• Access is removed promptly following termination of employment or a role change.

6. Identity and Access Management#

Access to production systems is controlled using the principle of least privilege. Security controls include:

• Unique user accounts
• Role-based access control (RBAC)
• Administrative approval for elevated privileges
• Strong password requirements
• Multi-factor authentication (MFA) for administrative access
• Periodic access reviews
• Logging of administrative actions

Shared administrative accounts are prohibited except where technically required and protected by additional controls.

7. Authentication#

CallSignal supports secure authentication mechanisms appropriate to the Service. Administrative access requires enhanced authentication controls. Authentication events are logged for security monitoring and auditing.

8. Encryption#

Encryption in Transit

Communications with the Service are protected using Transport Layer Security (TLS) where supported. Examples include web applications, APIs, administrative portals, and authentication requests.

Encryption at Rest

Sensitive information stored by CallSignal is encrypted at rest where commercially reasonable and technically appropriate. Encryption keys are managed using industry-standard practices.

9. Network Security#

CallSignal employs multiple layers of network security including:

• Firewalls
• Network segmentation where appropriate
• Rate limiting
• DDoS protections provided by infrastructure providers
• Monitoring
• Intrusion detection capabilities where available
• Secure administrative access

10. Infrastructure Security#

Production infrastructure includes commercially reasonable safeguards such as:

• System hardening
• Patch management
• Operating system updates
• Vulnerability remediation
• Service monitoring
• Capacity monitoring
• Backup systems

Infrastructure may be hosted by third-party cloud providers.

11. Secure Development#

CallSignal follows secure development practices including:

• Source code management
• Code review
• Dependency management
• Security testing where appropriate
• Vulnerability remediation
• Change approval procedures
• Version control

Security is incorporated throughout the software development lifecycle.

12. Vulnerability Management#

CallSignal maintains a vulnerability management process that includes:

• Security monitoring
• Vendor advisories
• Dependency updates
• Risk assessment
• Prioritized remediation

Critical vulnerabilities are addressed based upon severity, exploitability, and operational impact.

13. Logging and Monitoring#

CallSignal maintains security logs including, where applicable:

• Authentication events
• Administrative actions
• Configuration changes
• API activity
• Failed authentication attempts
• Privilege changes
• Service errors
• Security alerts

Logs are monitored to detect unusual or unauthorized activity.

14. Audit Logging#

Administrative actions affecting Customer environments are logged where technically feasible. Examples include:

• User creation
• User deletion
• Permission changes
• Workflow changes
• API credential changes
• Authentication events
• Integration changes
• Notification policy changes

Audit logs assist with investigations and compliance reporting.

15. Customer Data Protection#

Customer Data is logically segregated between Customer accounts. CallSignal personnel access Customer Data only when necessary to:

• provide support;
• investigate incidents;
• comply with legal obligations;
• maintain the Service.

Access is limited to authorized personnel.

16. AI Security#

Certain products use artificial intelligence. Customer Content submitted for AI processing is handled according to the Agreement and Privacy Policy. Unless expressly authorized in writing by the Customer, CallSignal does not use Customer Content to train publicly available foundation AI models. Customers remain responsible for validating AI-generated responses before relying on them.

17. Incident Response#

CallSignal maintains an incident response process designed to:

• Detect security incidents
• Assess severity
• Contain threats
• Preserve evidence where appropriate
• Restore operations
• Communicate with affected Customers
• Improve future response procedures

Incident response procedures are periodically reviewed.

18. Security Incident Notification#

Where CallSignal determines that a reportable security incident has affected Customer Data, CallSignal will notify affected Customers without unreasonable delay. Where feasible, notification will generally occur within 72 hours after confirmation of a reportable incident. Notifications may include:

• Description of the incident
• Types of information affected
• Known impact
• Containment actions
• Recommended Customer actions
• Available remediation information

19. Business Continuity#

CallSignal maintains commercially reasonable business continuity procedures intended to reduce disruption during significant operational events. Business continuity planning may include:

• Redundant infrastructure where available
• Backup systems
• Disaster recovery planning
• Operational documentation
• Recovery procedures

Recovery times may vary depending on the nature of the event.

20. Backup and Recovery#

Customer information may be backed up for operational recovery purposes. Backups are intended for disaster recovery and not as a substitute for Customer-controlled archival processes. Customers remain responsible for maintaining copies of information they consider business critical.

21. Physical Security#

Physical security controls are primarily provided by third-party cloud infrastructure providers. Such controls commonly include:

• Controlled facility access
• Environmental monitoring
• Fire suppression
• Redundant power
• Physical surveillance
• Visitor controls

22. Vendor Security#

CallSignal evaluates third-party service providers based upon operational and security considerations appropriate to the services provided. Examples include providers supporting cloud infrastructure, telecommunications, authentication, payment processing, monitoring, and email delivery. Third-party providers remain responsible for their own security practices.

23. Penetration Testing#

CallSignal may conduct internal or third-party security assessments, vulnerability reviews, or penetration testing at its discretion. Results are considered confidential. Enterprise Customers may request summary information regarding completed assessments subject to confidentiality obligations.

24. Security Questionnaires#

Enterprise Customers may submit reasonable security questionnaires. Extensive questionnaires, repeated assessments, or custom compliance documentation may require a separate professional services agreement.

25. Customer Security Obligations#

Customers should:

• Enable MFA where available
• Use strong passwords
• Promptly disable former employee accounts
• Review user permissions regularly
• Protect API credentials
• Secure uploaded content
• Maintain endpoint security
• Train users regarding phishing and social engineering

Failure to follow these practices may increase security risk.

26. Compliance#

CallSignal designs its security program using generally accepted security principles appropriate for a modern cloud SaaS platform. Unless specifically stated in a signed agreement, references to security practices should not be interpreted as certifications of compliance with any particular standard (including SOC 2, ISO 27001, HIPAA, PCI DSS, or similar frameworks). Where certifications or independent audits are obtained, CallSignal may make appropriate reports or summaries available to eligible Customers under confidentiality obligations.

27. Changes to Security Controls#

CallSignal may modify security controls from time to time provided that such modifications do not materially reduce the overall security posture of the Service. Security controls evolve as technology, threats, and industry practices change.

28. Contact Information#

Security questions or reports of potential vulnerabilities should be directed to:

• Security Team — security@getcallsignal.com
• Legal inquiries — legal@getcallsignal.com
• Privacy inquiries — privacy@getcallsignal.com
• Website — https://www.getcallsignal.com

29. Order of Precedence#

If this Security Addendum conflicts with the Master Services Agreement or Terms of Service solely with respect to security practices, this Security Addendum controls. All other provisions of the Agreement remain in effect.

This Acceptable Use Policy ("AUP") is incorporated into the CallSignal Master Services Agreement, Terms of Service, and any applicable Order Form (collectively, the "Agreement").

This AUP describes acceptable and prohibited uses of CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, CallSignal Answer, APIs, Microsoft Teams applications, Slack applications, web applications, integrations, and artificial intelligence features.

Violations of this AUP may result in suspension or termination of the Service.

1. Purpose#

CallSignal is designed to help organizations automate communications, notification workflows, AI-powered call handling, telecommunications verification, and quality monitoring. To protect Customers, telecommunications providers, and the integrity of the Service, all users must comply with this Policy.

2. General Requirements#

Customers must:

• comply with all applicable laws and regulations;
• use the Service only for legitimate business purposes;
• maintain accurate account information;
• protect authentication credentials;
• cooperate with reasonable abuse investigations;
• promptly report suspected security incidents affecting their accounts.

3. Compliance with Communications Laws#

Customer is solely responsible for compliance with all applicable communications laws, including but not limited to:

• Telephone Consumer Protection Act (TCPA)
• Telemarketing Sales Rule (TSR)
• CAN-SPAM Act
• STIR/SHAKEN requirements
• A2P 10DLC requirements
• State telemarketing laws
• Call recording laws
• International telecommunications regulations where applicable

Use of the Service does not relieve Customer of these obligations.

4. Consent Requirements#

Customer represents and warrants that it has obtained all legally required permissions, authorizations, notices, and consents before using the Service to:

• place calls;
• send SMS messages;
• leave voicemail messages;
• record calls;
• analyze conversations;
• transcribe communications;
• process personal information.

Customer is solely responsible for maintaining records demonstrating consent where required by law.

5. Lawful Use#

Customers may not use the Service to engage in unlawful activity including:

• fraud;
• identity theft;
• impersonation;
• harassment;
• threats;
• extortion;
• unlawful surveillance;
• illegal gambling;
• money laundering;
• deceptive business practices;
• distribution of malware;
• unauthorized access to computer systems.

6. Fraud Prevention#

The following activities are prohibited:

• Caller ID spoofing intended to deceive
• Artificial traffic generation
• Traffic pumping
• PBX hacking
• International revenue share fraud
• Toll fraud
• Robocalling in violation of applicable law
• Subscription fraud
• Fake account creation
• Identity misrepresentation

CallSignal may immediately suspend accounts engaged in suspected fraudulent activity.

7. Spam#

Customers may not use the Service to transmit unsolicited communications that violate applicable law. Examples include:

• Bulk unsolicited SMS
• Bulk unsolicited voice messages
• Unsolicited marketing calls
• Automated spam campaigns
• High-volume nuisance communications

8. Emergency Services#

The Service may not be used as:

• a 911 system;
• a medical alert system;
• a fire alarm system;
• a disaster notification system where life safety depends upon successful delivery;
• an emergency dispatch system.

Customers must maintain independent redundant communication methods.

9. High-Risk Activities#

The Service must not be relied upon where failure could reasonably result in death, personal injury, environmental damage, significant property damage, or interruption of emergency services. Examples include:

• Nuclear facilities
• Air traffic control
• Emergency dispatch
• Critical hospital life-support systems
• Military weapons systems

10. AI Usage#

Customers may use AI features only for lawful purposes. Customers may not knowingly use AI functionality to:

• generate fraudulent content;
• impersonate individuals;
• create deceptive communications;
• facilitate phishing attacks;
• generate malicious software;
• violate intellectual property rights;
• produce unlawful content.

Customer remains responsible for reviewing AI-generated output.

11. Uploaded Content#

Customer must have the legal right to upload all content submitted to the Service. Customer may not upload content that:

• infringes copyrights;
• violates trademarks;
• violates trade secrets;
• violates privacy rights;
• contains malicious software;
• contains illegal material.

Customer remains solely responsible for uploaded content.

12. Intellectual Property#

Customers shall not:

• reverse engineer the Service;
• decompile software;
• copy proprietary code;
• remove copyright notices;
• scrape proprietary content;
• create derivative works except as expressly permitted.

13. Security#

Customers shall not:

• attempt unauthorized access;
• bypass authentication;
• interfere with Service operation;
• scan the platform without authorization;
• exploit vulnerabilities;
• perform denial-of-service attacks;
• interfere with monitoring systems.

14. APIs#

API usage must comply with published documentation. Customers may not:

• exceed documented rate limits;
• intentionally overload APIs;
• circumvent authentication;
• abuse API credentials;
• share API keys publicly.

CallSignal may revoke compromised API credentials without prior notice.

15. Automated Activity#

Automated access must not:

• degrade Service performance;
• interfere with other Customers;
• bypass rate limits;
• generate abusive traffic.

16. Telecommunications Numbers#

Customers represent they have authority to use all telephone numbers configured within the Service. Customers may not knowingly use:

• stolen numbers;
• unauthorized caller IDs;
• deceptive caller identification;
• numbers assigned to another party without authorization.

17. Call Recording#

Customer is solely responsible for obtaining legally required notice and consent before recording, monitoring, transcribing, or analyzing communications. CallSignal does not determine whether recording is lawful in Customer's jurisdiction.

18. Microsoft Teams#

When using Microsoft Teams integrations, Customers shall comply with Microsoft Terms of Use, Microsoft Teams policies, and applicable licensing requirements. CallSignal is not responsible for Microsoft's platform availability or policy changes.

19. Slack#

Customers using Slack integrations must comply with Slack's applicable terms and policies.

20. Third-Party Services#

Customers remain responsible for complying with the terms of third-party providers connected to the Service, including providers of telecommunications, email delivery, SMS delivery, payment processing, cloud hosting, and identity management.

21. Monitoring#

CallSignal may monitor platform activity to:

• protect platform security;
• detect abuse;
• investigate fraud;
• comply with legal obligations;
• enforce this Policy.

Monitoring is performed in accordance with the Privacy Policy and applicable law.

22. Abuse Investigations#

Customers agree to cooperate with reasonable investigations involving spam complaints, fraud reports, abuse reports, carrier complaints, security incidents, and regulatory inquiries. Failure to cooperate may result in suspension.

23. Suspension#

CallSignal may suspend access immediately if reasonably necessary to:

• prevent abuse;
• investigate fraud;
• respond to legal process;
• protect other Customers;
• preserve Service integrity;
• mitigate security risks;
• address non-payment.

Notice will be provided where reasonably practicable.

24. Repeat Violations#

Repeated or material violations of this Policy may result in:

• permanent suspension;
• account termination;
• reporting to telecommunications providers;
• reporting to regulatory authorities where required by law.

25. Reporting Abuse#

Suspected abuse of the Service may be reported to abuse@getcallsignal.com. Reports should include, where possible, account identification, dates and times, supporting documentation, and a description of the suspected violation.

26. Changes to this Policy#

CallSignal may revise this Policy from time to time. Material changes become effective upon publication or as otherwise communicated. Continued use of the Service constitutes acceptance of the revised Policy.

27. Contact Information#

Questions regarding this Policy may be directed to:

• Legal — legal@getcallsignal.com
• Security — security@getcallsignal.com
• Compliance — compliance@getcallsignal.com
• Support — support@getcallsignal.com
• Website — https://www.getcallsignal.com

28. Reservation of Rights#

Nothing in this Policy limits CallSignal's right to:

• investigate suspected violations;
• suspend or terminate Service;
• comply with legal obligations;
• protect Customers;
• protect telecommunications providers;
• protect the integrity, security, and availability of the Service.

Important: This Service Level Agreement ("SLA") applies only to Customers who have purchased a subscription that expressly includes SLA coverage in an Order Form or other written agreement with CallSignal. Free plans, trial plans, and standard self-service subscriptions are not covered by this SLA unless specifically stated otherwise.

This SLA is incorporated into the CallSignal Master Services Agreement ("MSA"), Terms of Service, and any applicable Order Form (collectively, the "Agreement").

1. Purpose#

This SLA describes:

• Service Availability commitments
• Support response objectives
• Incident severity definitions
• Maintenance windows
• Service Credits
• Customer responsibilities
• Exclusions
• Escalation procedures

Nothing in this SLA guarantees uninterrupted telecommunications delivery or overrides the limitations contained in the Master Services Agreement.

2. Definitions#

Service

The hosted CallSignal platform including CallSignal Escalate, CallSignal Audit, CallSignal Verify, CallSignal Answer, the web application, APIs, the administrative portal, Microsoft Teams integrations, and Slack integrations. Third-party carrier networks are not part of the Service.

Service Availability

The percentage of time during a calendar month that the core hosted platform is operational and capable of processing authenticated customer requests. Availability does not measure successful telephone call completion, SMS delivery, email delivery, carrier routing, or internet connectivity outside of CallSignal's control.

Scheduled Maintenance

Maintenance announced in advance that may temporarily affect Service availability.

Emergency Maintenance

Maintenance necessary to address security vulnerabilities, Service instability, data integrity risks, critical infrastructure failures, or active security threats. Emergency maintenance may occur without advance notice when reasonably necessary.

3. Service Availability Commitment#

CallSignal targets 99.9% Monthly Service Availability. Availability is measured monthly and excludes the events listed in Section 13 (Exclusions).

Monthly Availability Calculation

Availability is calculated as: (Total Minutes – Unavailable Minutes) ÷ Total Minutes × 100. Unavailable Minutes include periods during which the core hosted Service is unavailable due to issues under CallSignal's reasonable control.

4. Scheduled Maintenance#

Routine maintenance may occur during designated maintenance windows. Whenever reasonably practical, scheduled maintenance notices will be provided at least 72 hours in advance. Routine maintenance generally occurs during periods of lower expected customer activity. Scheduled maintenance does not count toward downtime calculations.

5. Emergency Maintenance#

Emergency maintenance may occur without advance notice when reasonably necessary to:

• Protect Customer Data
• Address active exploitation
• Restore Service stability
• Mitigate significant security risks
• Prevent widespread service interruption

Emergency maintenance is excluded from uptime calculations where reasonably necessary to protect the platform.

6. Incident Severity Levels#

Severity 1 (Critical)

Examples include a complete platform outage, authentication unavailable, widespread production failure, complete API outage, major data corruption, or an active security incident affecting production. Target initial response: within 1 hour. Support available on a 24×7 basis for Severity 1 incidents for eligible Enterprise Customers.

Severity 2 (High)

Examples include a major feature unavailable, significant workflow failures, Microsoft Teams integration unavailable, Slack integration unavailable, notification engine degradation, or significant reporting failures. Target initial response: within 4 business hours.

Severity 3 (Medium)

Examples include limited feature malfunction, performance degradation, minor API issues, reporting inconsistencies, or administrative interface issues. Target initial response: within 1 business day.

Severity 4 (Low)

Examples include general questions, documentation requests, cosmetic defects, enhancement requests, or configuration assistance. Target initial response: within 2 business days.

7. Support Hours#

Unless otherwise stated in an Enterprise agreement, Standard Support is available Monday through Friday, 8:00 AM – 6:00 PM Eastern Time, excluding U.S. federal holidays. Enterprise support options may include expanded coverage as specified in the applicable Order Form.

8. Support Channels#

Support requests may be submitted through the Customer Portal, email, the administrative console, or other approved support channels. Support contact: support@getcallsignal.com.

9. Service Credits#

If Monthly Service Availability falls below the commitment in Section 3, eligible Customers may request Service Credits. Service Credits:

• apply only to future invoices;
• are not refundable;
• are Customer's exclusive monetary remedy for qualifying downtime under this SLA.

10. Requesting Service Credits#

Requests must:

• be submitted within 30 days following the affected month;
• include dates and times;
• include supporting information reasonably requested by CallSignal.

Requests should be sent to billing@getcallsignal.com.

11. Notification Services#

CallSignal Escalate attempts to deliver notifications using Customer-configured workflows. The following are not guaranteed:

• Telephone call completion
• Voicemail delivery
• SMS delivery
• Email delivery
• Push notification delivery
• Human acknowledgement
• Carrier acceptance
• Internet connectivity
• Recipient availability

Because notification delivery depends upon multiple independent third-party systems, CallSignal does not provide uptime guarantees for successful notification delivery.

12. AI Services#

CallSignal Answer and CallSignal Audit use artificial intelligence. CallSignal does not guarantee factual accuracy, completeness, absence of hallucinations, or suitability for legal or regulatory decisions. AI-generated output is excluded from SLA performance commitments.

13. Exclusions#

The following do not count toward Service Availability calculations:

• Scheduled maintenance
• Emergency maintenance
• Customer configuration errors
• Customer internet outages
• Customer firewall issues
• Customer identity provider failures
• Telecommunications carrier failures
• SignalWire outages
• Microsoft outages
• Slack outages
• DNS failures outside CallSignal's control
• Force majeure events
• Third-party infrastructure failures outside CallSignal's reasonable control
• Suspension under the Agreement
• Beta features
• Unsupported configurations
• Customer-developed integrations

14. Planned Maintenance Notifications#

Where reasonably practical, maintenance notifications will include the anticipated start time, estimated duration, affected components, and expected customer impact. Notifications may be delivered through email, the administrative portal, a status page, or other customer communication channels.

15. Disaster Recovery#

CallSignal maintains commercially reasonable disaster recovery procedures intended to restore production operations following significant infrastructure failures. Recovery objectives vary depending upon the nature and scope of the incident. This SLA does not guarantee a specific Recovery Time Objective (RTO) or Recovery Point Objective (RPO) unless expressly stated in an executed Enterprise Order Form.

16. Customer Responsibilities#

To receive SLA coverage, Customer must:

• Maintain active subscription status
• Promptly report issues
• Cooperate with troubleshooting
• Maintain supported configurations
• Follow published documentation
• Maintain current contact information
• Designate technical contacts

Failure to meet these responsibilities may affect eligibility for Service Credits.

17. Escalation Process#

If a Customer believes an incident requires management attention, the issue may be escalated through the CallSignal support organization. Escalation may include Technical Support, Engineering, Operations, and Executive review, where appropriate. Severity levels may be adjusted as additional information becomes available.

18. Beta Features#

Beta, preview, early-access, experimental, and pre-release features are provided "AS IS". Beta features are excluded from all SLA commitments.

19. Third-Party Services#

CallSignal integrates with third-party providers including SignalWire, Microsoft, Slack, cloud hosting providers, email providers, and telecommunications carriers. CallSignal cannot guarantee the availability, performance, or uptime of third-party services.

20. Force Majeure#

Service interruptions caused by events beyond CallSignal's reasonable control are excluded from this SLA, including natural disasters, internet outages, carrier failures, government actions, labor disputes, war, terrorism, pandemics, and utility failures.

21. Modifications#

CallSignal may modify this SLA from time to time. Material changes become effective upon publication or as otherwise communicated, except where an executed Enterprise agreement specifies otherwise.

22. Contact Information#

• Support — support@getcallsignal.com
• Billing — billing@getcallsignal.com
• Legal — legal@getcallsignal.com
• Status inquiries — status@getcallsignal.com
• Website — https://www.getcallsignal.com

23. Order of Precedence#

If there is a conflict between this SLA and the Master Services Agreement regarding service levels, this SLA governs only with respect to the Service Availability commitments expressly described herein. All other provisions of the Agreement remain unchanged.

This Subprocessor List ("Subprocessor List") forms part of the CallSignal Master Services Agreement ("MSA"), Privacy Policy, and Data Processing Addendum ("DPA").

It identifies third-party service providers ("Subprocessors") that may process Customer Data or Personal Data on behalf of CallSignal in connection with providing the Service.

This list reflects the expected architecture of the CallSignal platform. Actual subprocessors may vary based on Customer configuration, region, or future platform changes.

1. Purpose#

CallSignal uses carefully selected third-party service providers to deliver portions of the Service. Subprocessors may assist with cloud hosting, voice services, SMS delivery, authentication, email delivery, monitoring, logging, payment processing, AI processing, customer support, and security.

Each Subprocessor is contractually required to protect Customer information consistent with applicable law and the obligations contained in the CallSignal Data Processing Addendum.

2. SignalWire#

SignalWire provides telecommunications infrastructure supporting voice calling, SIP communications, telephony APIs, AI voice interactions, call routing, and call events. Depending upon Customer configuration, SignalWire may process:

• Telephone numbers
• Caller ID
• Called number
• Call recordings
• Audio streams
• Call duration
• Call metadata
• SIP signaling information

SignalWire operates as an independent service provider subject to its own security and privacy practices.

3. DigitalOcean#

DigitalOcean provides the primary cloud infrastructure hosting the CallSignal platform. Depending upon platform architecture, hosted information may include:

• Customer Data
• Uploaded documents
• Configuration information
• AI-generated summaries
• Account information
• Audit logs
• Application databases

DigitalOcean does not determine the purposes of processing and acts solely as an infrastructure provider.

4. Cloudflare#

Cloudflare may provide a Content Delivery Network (CDN), DNS, Web Application Firewall (WAF), DDoS mitigation, TLS termination, traffic optimization, and security filtering. Cloudflare may process:

• IP addresses
• Browser information
• Request metadata
• Security logs
• Connection information

5. Stripe#

Stripe provides subscription billing and payment processing. Payment card information is processed directly by Stripe. CallSignal does not store full payment card numbers or card verification values (CVVs). Stripe may process:

• Billing name
• Billing address
• Email address
• Subscription information
• Payment metadata

6. Microsoft#

Where Customers install Microsoft Teams integrations, Microsoft may process:

• User identifiers
• Tenant identifiers
• Authentication tokens
• Teams channel information
• Application permissions

Only information required to support authorized Teams functionality is accessed.

7. Slack#

Slack integrations may process:

• Workspace identifiers
• User identifiers
• Authentication tokens
• Channel identifiers
• Limited application message metadata

Only information required for Customer-authorized integrations is processed.

8. Artificial Intelligence Providers#

Certain AI functionality may utilize third-party AI providers. Depending upon Customer configuration, information submitted to AI providers may include:

• Call transcripts
• Customer-provided prompts
• Uploaded knowledge base excerpts
• Configuration data necessary to generate responses

Unless expressly authorized by the Customer, CallSignal does not use Customer Content to train publicly available foundation AI models.

9. Email Delivery Providers#

CallSignal uses one or more transactional email providers for password reset emails, account verification, billing notifications, administrative alerts, and product communications. Typical information processed includes:

• Email address
• Message metadata
• Delivery status
• Bounce information

10. Monitoring Providers#

Monitoring providers may process system performance metrics, diagnostic information, error logs, service availability information, and infrastructure telemetry. Monitoring providers do not process Customer Content except where diagnostic logs generated by the Customer's use of the Service contain Customer information.

11. Future Subprocessors#

CallSignal may engage additional subprocessors to support new features, improve security, increase reliability, or replace existing vendors. Material additions will be reflected in this Subprocessor List.

12. Customer Notification#

Updated versions of this Subprocessor List will be published at https://www.getcallsignal.com/subprocessors. Enterprise Customers who have executed a Data Processing Addendum may object to a newly added Subprocessor on reasonable documented data protection grounds within thirty (30) days after publication.

13. Customer Objections#

If a Customer objects to a new Subprocessor:

• Customer must provide written documentation describing the objection.
• CallSignal will work in good faith to determine whether a reasonable solution exists.
• If no reasonable solution exists, Customer may terminate the affected Service in accordance with the Data Processing Addendum.

14. Due Diligence#

Before engaging a Subprocessor, CallSignal evaluates factors including security posture, reliability, business continuity, privacy practices, regulatory compliance, operational maturity, and service availability.

15. Contractual Requirements#

CallSignal requires subprocessors that process Personal Data on its behalf to enter into agreements containing obligations appropriate to the services provided, including confidentiality and data protection commitments where applicable.

16. International Processing#

Some subprocessors may process information outside the Customer's country. Where required by applicable law, CallSignal implements appropriate transfer mechanisms, including Standard Contractual Clauses or other recognized legal safeguards.

17. Shared Responsibility#

Customers remain responsible for evaluating whether the Service and its subprocessors satisfy their own regulatory, contractual, and organizational requirements.

18. Contact Information#

Questions regarding subprocessors may be directed to:

• Privacy — privacy@getcallsignal.com
• Legal — legal@getcallsignal.com
• Compliance — compliance@getcallsignal.com
• Website — https://www.getcallsignal.com

19. Revision History#

CallSignal may update this Subprocessor List from time to time as service providers are added, removed, or replaced. The version published at https://www.getcallsignal.com/subprocessors is the current authoritative version. Material changes will be reflected by an updated revision date.

This Communications Compliance Policy ("Policy") describes the legal and operational requirements governing the use of CallSignal, CallSignal Escalate, CallSignal Audit, CallSignal Verify, and CallSignal Answer.

The purpose of this Policy is to help Customers operate the Service responsibly while complying with applicable communications, telecommunications, and privacy laws. This Policy forms part of the CallSignal Master Services Agreement, Terms of Service, and Acceptable Use Policy.

1. Purpose#

This Policy describes the legal and operational requirements governing the use of the CallSignal products and helps Customers operate the Service responsibly while complying with applicable communications, telecommunications, and privacy laws.

2. Scope#

This Policy applies to every Customer, Authorized User, API integration, and third-party application using the CallSignal platform. It applies to communications delivered through:

• Telephone calls
• VoIP
• SIP
• SMS
• Email
• Microsoft Teams
• Slack
• AI Voice
• Future communication channels supported by CallSignal

3. Customer Responsibility#

Customer is solely responsible for ensuring its use of the Service complies with all applicable laws. CallSignal provides software tools. CallSignal does not determine:

• who Customer contacts;
• whether Customer has obtained required consent;
• whether Customer's communications are lawful;
• whether Customer's content complies with applicable regulations.

4. Applicable Laws#

Depending upon Customer location and usage, applicable regulations may include:

United States

• Telephone Consumer Protection Act (TCPA)
• Telemarketing Sales Rule (TSR)
• CAN-SPAM Act
• FCC regulations
• State telemarketing laws
• State privacy laws
• State call recording laws

International

• GDPR
• UK GDPR
• ePrivacy Directive
• Canadian Anti-Spam Legislation (CASL)
• Other applicable telecommunications regulations

Customers are responsible for determining which laws apply to their business.

5. Consent#

Customer represents that it has obtained all legally required permissions before using the Service. Examples include calling individuals, sending SMS messages, leaving voicemail, recording conversations, AI transcription, and AI analysis. Where written consent is required by law, Customer is responsible for maintaining documentation demonstrating consent.

6. Consent Records#

Customers should maintain records including:

• Name
• Phone number
• Email
• Date consent obtained
• Method of consent
• Consent language
• Source document
• IP address (where applicable)
• Timestamp
• Opt-in confirmation

CallSignal may provide tools to assist with documenting consent but does not verify its legal sufficiency.

7. Revocation of Consent#

Customers must promptly honor lawful requests to withdraw consent. Where required by law, Customers should maintain suppression lists or equivalent mechanisms to prevent future communications. CallSignal may provide suppression functionality; however, Customer remains responsible for ensuring it is properly configured and maintained.

8. Artificial Intelligence Communications#

Customers using AI-powered communications remain responsible for AI prompts, AI-generated responses, AI decisions, and Customer-provided knowledge bases. AI output should be reviewed before being relied upon in legal, financial, employment, regulatory, or safety-critical contexts.

9. Call Recording#

Customers are solely responsible for complying with all applicable recording laws. Before recording or transcribing communications, Customers must determine whether notice or consent is required. Depending upon jurisdiction, requirements may include one-party consent, two-party consent, or all-party consent. CallSignal does not determine applicable legal requirements.

10. AI Transcription#

Customers enabling transcription acknowledge that:

• conversations may be converted to text;
• transcripts may contain inaccuracies;
• AI summaries may contain errors;
• human review may be appropriate before business use.

11. STIR/SHAKEN#

Customers shall:

• use only authorized telephone numbers;
• accurately identify themselves;
• avoid misleading caller identification;
• comply with applicable STIR/SHAKEN requirements.

Caller ID spoofing intended to deceive recipients is prohibited.

12. A2P 10DLC#

Where applicable, Customers are responsible for:

• Brand Registration
• Campaign Registration
• Message classification
• Carrier compliance
• Opt-in management
• Opt-out management
• Message content compliance

Failure to maintain carrier registrations may result in message blocking, throughput reduction, carrier rejection, or account suspension.

13. Telemarketing#

Customers shall comply with all applicable telemarketing laws. Examples include calling time restrictions, Do Not Call rules, internal suppression lists, consent requirements, and disclosure requirements.

14. Caller Identification#

Customers shall not:

• impersonate another organization;
• use deceptive caller ID;
• intentionally mislead recipients;
• present telephone numbers without authorization.

Customers remain responsible for proving ownership or authorization for all numbers used.

15. Robocalling#

Customers shall not use the Service to conduct unlawful robocalling. Examples include illegal telemarketing, scam calls, fraudulent campaigns, deceptive political communications, and harassment campaigns.

16. Emergency Communications#

CallSignal is not designed for:

• 911
• Emergency dispatch
• Medical alert systems
• Fire alarms
• Life-safety notification
• Public warning systems

Customers must maintain independent redundant communications for emergency situations.

17. High-Risk Use#

Customers may not rely upon the Service where communication failure could reasonably result in death, serious bodily injury, environmental harm, or catastrophic property damage.

18. Telecommunications Providers#

Customer acknowledges the Service depends upon independent providers including SignalWire, telecommunications carriers, internet providers, email providers, SMS providers, Microsoft, and Slack. CallSignal cannot control:

• carrier filtering;
• routing decisions;
• network congestion;
• outages;
• spam blocking;
• throughput limits.

19. Notification Delivery#

CallSignal Escalate attempts to deliver notifications using Customer-configured workflows. Successful delivery depends upon numerous factors outside CallSignal's control. CallSignal does not guarantee:

• telephone answer rates;
• voicemail availability;
• SMS acceptance;
• carrier delivery;
• email delivery;
• recipient acknowledgement.

Customers should regularly test escalation workflows.

20. CallSignal Audit#

Customers using CallSignal Audit remain responsible for ensuring recording is lawful, that AI analysis complies with employment and privacy laws, and that reports are reviewed by appropriate personnel before disciplinary or employment decisions. AI-generated scoring should not be the sole basis for employment actions.

21. CallSignal Answer#

Customers remain responsible for the accuracy of documents uploaded to CallSignal Answer. AI responses generated from Customer documents should be periodically reviewed for accuracy and currency.

22. CallSignal Verify#

Verification reports are informational. Verification does not constitute legal proof of ownership, regulatory compliance, routing status, or service availability.

23. Fraud Prevention#

Customers shall not use the Service for toll fraud, traffic pumping, PBX compromise, phishing, impersonation, identity theft, financial scams, or illegal solicitation.

24. Compliance Investigations#

CallSignal may investigate suspected violations involving spam complaints, carrier complaints, fraud reports, abuse reports, law enforcement inquiries, and regulatory investigations. Customers agree to cooperate with reasonable investigations.

25. Suspension#

CallSignal may immediately suspend Service where reasonably necessary to:

• prevent fraud;
• protect other Customers;
• comply with legal obligations;
• respond to carrier requirements;
• preserve platform integrity;
• investigate abuse.

Notice will be provided where reasonably practicable.

26. Customer Certifications#

By using the Service, Customer certifies that:

• it has lawful authority to use all configured telephone numbers;
• it has obtained required permissions and consents;
• it will comply with applicable communications laws;
• it will not use the Service for unlawful robocalling or spam;
• it will maintain accurate contact information;
• it understands the Service is not an emergency notification system.

27. Compliance Assistance#

CallSignal may provide documentation, workflow tools, audit logs, reporting features, suppression functionality, and administrative controls. These tools assist Customers but do not constitute legal advice or guarantee regulatory compliance.

28. Changes to this Policy#

CallSignal may update this Policy from time to time to reflect changes in law, telecommunications regulations, carrier requirements, platform capabilities, or security practices. Continued use of the Service constitutes acceptance of the updated Policy.

29. Reporting Compliance Concerns#

Questions regarding communications compliance may be directed to:

• Compliance Team — compliance@getcallsignal.com
• Privacy questions — privacy@getcallsignal.com
• Legal questions — legal@getcallsignal.com
• Security concerns — security@getcallsignal.com
• Website — https://www.getcallsignal.com

30. Entire Policy#

This Policy supplements, and does not replace, the Master Services Agreement, Terms of Service, Privacy Policy, Data Processing Addendum, Security Addendum, Acceptable Use Policy, and any applicable Order Forms. In the event of a conflict regarding communications compliance obligations, the stricter applicable legal requirement shall govern.