Data processing

Last updated: October 26, 2026

This page is for plumbing businesses that use Office by Sam. It explains in short how we handle the information of people who call your business. The binding terms are in the Data Processing Addendum, Schedule C of our Customer Agreement (Master Services Agreement), which you accept at checkout. If this page and the Customer Agreement differ, the Customer Agreement applies.

Your callers' information

• You own your business data and your callers' information.
• For your callers' information, we act as your service provider (in some state laws, your "processor"). We use it only on your instructions, which are the Customer Agreement and your approved setup, and only to provide, support and secure the service for you.
• We don't sell or share it. We don't combine it with information from other sources, except as the law allows service providers to.
• We don't use it to train or fine-tune any AI model. Where our service providers offer a setting for this, we set it so that they don't either.

What we handle

Callers' name, callback number, address and ZIP code, problem description, access details, preferred time, booking records, call transcripts (text only, no audio), call summaries, consent records, and texts about the caller's request.

Who helps us

The service providers that handle call data are listed in Schedule C, Annex C-1: Telnyx (phone line and text messages), xAI (Grok Voice: the AI model and voice that process the conversation in real time), ElevenLabs (backup voice provider, used only if the primary provider is unavailable), Cloudflare (hosting of the software that connects the telephone line with the AI assistant during calls), Supabase (stores transcripts and consent records in the United States), and Google Workspace (the read-only job calendar we share with you, with the job details your callers give).

• Each of them is bound by a written contract to protect the data at least as strictly as our Customer Agreement.
• We email you at least 15 days before we add or replace one. You can object in writing on reasonable data-protection grounds within 5 days. If we can't resolve it, you can cancel, as the Customer Agreement explains.
• On request, we give you each provider's own list of subcontractors.

How long we keep it

• Call transcripts: deleted automatically 30 days after the call.
• Call summaries: deleted automatically 30 days after the caller's last call.
• Consent records: kept for 4 years after the last call or text that relies on that consent.
• We don't make audio recordings.
• When your subscription ends, you have 30 days to ask for an export, and we then delete your data, except where the law requires us to keep it.

We keep records longer only while a claim, complaint or legal inquiry about them is open. Deletion makes the information unreadable.

If something goes wrong

If a security incident affects your callers' information, we notify you immediately after we discover it, give you the information you need for any notices you must send, and help you with them.

Caller requests

If a caller asks us to see, correct or delete their information, we tell you and direct the caller to you, and we help you respond.

Checking our work

Once every 12 months, and again after a security incident, you can ask for the information that shows how we meet Schedule C, and you can carry out a reasonable assessment, as the Customer Agreement explains.

Questions

Email info@officebysam.com. You can open the Customer Agreement at checkout before you agree, and you get a PDF copy by email right after purchase.