8x Dialer Data Processing Agreement
Version: 2026-10-22
1. What this agreement covers
This agreement is between 8x Social, Inc., a Delaware corporation, 1111B S Governors Ave STE 47647, Dover, DE 19904, United States ("8x"), and the business that uses the 8x Dialer (the "client", "you"). It is part of the 8x Dialer Customer Terms and governs the personal data 8x processes for you.
Client personal data is the personal data in what you and your people put into the 8x Dialer or create with it: your leads, your calls and their recordings and transcripts, the AI outputs about them, your notes and outcomes, your bookings and who joined their meetings, and your do-not-contact list.
2. Who decides, and who processes
- You decide why and how client personal data is used. You are its controller (in US state laws, the "business").
- 8x processes it for you, as your processor and service provider, only to provide the 8x Dialer and as this agreement says. 8x follows your instructions: this agreement, the customer terms, and what you and your people do in the 8x Dialer.
- 8x never sells or shares client personal data, and never uses it for anyone but you, except as section 4 says.
- You are responsible for having the right to give 8x client personal data, and a lawful basis to call each lead.
3. The processing
| Whose data | The people your reps call and their colleagues; the people who join the meetings 8x books for you; your own people, in their calls, practice calls and meetings |
| What data | Names, job titles, companies, business phone numbers and email addresses, profile links, and what the call adds: recordings, transcripts, AI summaries, scores and flags, the live coach's lines, notes, outcomes and bookings, and who joined each booked meeting |
| What 8x does with it | Stores it; places, records and transcribes your calls; runs the AI features for you; screens numbers against the do-not-contact lists and the US National Do Not Call Registry; books meetings and reads who joined them; exports and deletes it |
| How long | While you are a client, then as sections 7 and 8 say |
Who joined your meetings. 8x reads who joined the meetings it books into your calendar, to confirm they were held. After a meeting it booked, 8x reads who joined its Google Meet: through the host's Google connection, once the host has agreed to this when connecting their Google Calendar, or through 8x's own Google account for a meeting on 8x's calendar. For each participant it keeps on the booking:
- the name Google shows (for someone who joined by phone, a partly hidden phone number);
- whether they joined signed in to Google, as a guest or by phone, and their Google account id when signed in;
- when they first joined and last left; and
- whether 8x recognised them as the host, someone on the invite, one of your people or 8x staff, or did not recognise them.
For a meeting on 8x's own calendar, 8x also keeps the email address of a participant who was signed in to Google, from 8x's Google Meet audit log. 8x never reads a meeting it did not book. From the meetings it books it reads only who joined: it never records them, and never reads their recording, transcript or chat from Google.
You never put sensitive data (health, race, religion, sexual life, political views, biometric data or financial account details) into the 8x Dialer.
4. What 8x does with client personal data on its own account
8x also uses client personal data, as its own controller, to run the 8x Dialer properly:
- Review for quality and compliance. 8x may open any of your calls, with its recording, transcript and flags, to review it for quality and compliance.
- Review to provide, evaluate and improve the 8x Dialer. 8x reviews content, such as calls and transcripts, to provide, evaluate and improve the 8x Dialer. 8x reads it where it is stored: it never copies your content into another client's output, or into prompts or examples shared between clients.
- No training. 8x never trains AI models on client personal data.
- Abuse, complaints and the law. 8x computes calling signals from your calls, answers complaints and tracebacks, keeps the dial record and the closure record (section 8), bills you, and keeps the records the law requires.
5. How 8x keeps it safe
- Where it lives. Client personal data is stored in the United States, in 8x's database and file storage on Supabase (AWS us-east-1), and is encrypted at rest. What a subprocessor holds to do its work is where section 6 says.
- Files. Recordings and other files sit in private storage, reached only through short-lived links that expire within an hour, made for a person allowed to see them.
- Recordings at the carrier. Once 8x has its own copy of a call's recording, it deletes the telephony provider's copy.
- Kept apart. Each client's data is kept apart from every other client's: one client's people never see another client's data.
- People at 8x. Only the 8x staff who need it to run the 8x Dialer can reach client personal data, and they keep it confidential.
- Breaches. If 8x learns of a breach of security that affects client personal data, it tells your Owners without undue delay, with what it knows and what it is doing about it.
6. Subprocessors
You authorise 8x to use these subprocessors. Each processes client personal data under its own terms with 8x.
| Subprocessor | What it does for the 8x Dialer | Where |
|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | United States (AWS us-east-1) |
| Vercel Inc. | Hosting | United States, with a global edge network |
| Twilio Inc. | Calls, phone numbers and call recording, until 8x has its own copy | United States |
| Deepgram, Inc. | Speech-to-text transcription of calls | United States |
| OpenAI, L.L.C. | AI features: transcription, summaries, scoring, the coach, practice calls and playbook drafting | United States |
| Anthropic, PBC | AI features: summaries, scoring, the coach, practice calls and playbook drafting | United States |
| Resend (Plus Five Five, Inc.) | Email: invitations and notices to your people, and booking invitations to the people you call | United States |
| Stripe, Inc. | Payments and invoices: your billing details only | United States |
| Slack Technologies, LLC | 8x's own Slack workspace, where 8x's staff work: 8x's copy of your people's chat with 8x, and 8x's alerts about your account, such as your application, your calling signals, complaints about your calls and your payments. | United States |
| Google LLC | Google Workspace on 8x's own Google account: the meetings 8x books on its own calendar (for example, for a host who has not connected a Google Calendar), their Google Meet rooms, and who joined them | Wherever Google keeps data centres, the United States among them |
| PostHog, Inc. | Product analytics and error reports about how your people use the 8x Dialer | European Union |
Services you connect with your own account, such as your Google Calendar or your Slack, are your own providers, not 8x's subprocessors.
Your Slack. When an Owner connects your Slack, 8x posts there on your instruction, in the channels and direct messages your settings choose. A post never carries a phone number, an email address, a recording or file link, a transcript or a return call's message. When you erase a person, 8x deletes every post and direct message it sent there that names them. If your Slack is disconnected at the time, the erasure's confirmation names the posts 8x could not reach, and 8x deletes them if your Slack is connected again.
Changes. 8x tells your Owners at least 30 days before a new subprocessor starts processing client personal data, unless security or keeping the 8x Dialer running needs a faster change, in which case 8x tells them as soon as it can. If you object, you may end your plan before the change takes effect. 8x answers any question about how a subprocessor handles client personal data at privacy@8x.social.
7. How long 8x keeps client personal data
| What | Kept |
|---|---|
| Call recordings and practice-call audio, including any copy left at the telephony provider | 90 days |
| Transcripts and the live coach's lines | 12 months |
| Call history: outcomes, notes, AI summaries, scores and flags | While you are a client |
| Leads, bookings and who joined their meetings, uploads and your do-not-contact list | While you are a client |
| Recent exports | 7 days |
These periods run whatever your plan's status, a pause included.
8. Erasure, closing and deletion
Erasing a person. An Owner may erase a person from your data at any time, in the 8x Dialer or by asking 8x. Erasure removes the lead with its phones and emails; every recording, transcript, coach's line, summary, note and score of their calls; the names, email addresses and Google account ids of everyone who joined their meetings; and every post and direct message 8x sent to your Slack that names them (section 6). Files go first, then rows. It does not remove a meeting already on a calendar, or Google's own record of who joined it. It keeps a hashed entry of the person's phones and emails so they are never imported again, and it stops at the dial record (below). Copies outside 8x, such as your CRM, your exports, your downloads and anything your people copied from a Slack post, are yours to erase.
A request made to 8x. When a person asks 8x to remove their data, 8x passes the request within 2 business days to every client that holds them.
When your account closes. For 14 days your account is read-only and your Owners can export your data; then 8x deletes it, or at once if you ask. If your plan is Paused for non-payment, 8x never deletes your data for 12 months; after 12 months Paused, it gives your Owners 30 days' notice and then deletes it. Deletion removes every row and file of yours and the sign-in accounts of your people who belong nowhere else. Files are removed at once; the database's backups clear within 14 days.
What 8x keeps after deletion, for its own legal duties, and only 8x can see:
- The closure record, for 4 years after deletion: your application and its approval; closures, complaints and tracebacks; your do-not-contact list and the hashed entries of erased people; and the audit logs of downloads, exports and erasures. If your business is approved again, it gets its do-not-contact list back.
- The dial record, for 4 years after deletion: one row per call placed, with the number called from, the number called, the time, the length, the campaign, the client and who dialled; no audio, transcript, note or lead details. Neither an erasure nor a deletion changes it; it answers complaints and tracebacks.
- Billing records, for 7 years.
9. Helping you
8x helps you answer requests from the people whose data you hold, and gives you the information you reasonably need to show that 8x keeps this agreement. Most requests you can answer yourself in the 8x Dialer: your Owners can see and export your data, and erase a person.
10. How long this agreement lasts
This agreement lasts as long as 8x processes client personal data for you, including the periods in section 8. If it and the customer terms differ about personal data, this agreement governs.
11. Contact
Privacy: privacy@8x.social · 8x Social, Inc., 1111B S Governors Ave STE 47647, Dover, DE 19904, United States