Data Processing Addendum
When Penny handles your customers' data, we act as your processor. This addendum explains that relationship and the safeguards behind it.
Last updated October 12, 2026
Scope and roles
This Data Processing Addendum supplements our Terms of Service and applies when Penny Labs LLC processes personal data on your behalf. You (the customer) are the controller; Penny is the processor. It covers personal data in calls, website chats, transcripts, captured details, and account information processed to provide the service.
Our commitments as processor
- We process personal data only on your documented instructions — which include your settings and our agreement.
- People who handle the data are bound by confidentiality.
- We keep appropriate technical and organizational security measures (see our Security page).
- We help you respond to data-subject requests and meet your own obligations where the law requires.
- On termination, we delete or return personal data, except where we're required to retain it.
Sub-processors
We use a small set of vetted providers to deliver the service, each under contract to protect personal data:
- Twilio: connecting and carrying your calls, holding a voicemail recording until Penny has transcribed it, and running the speech-to-text and text-to-speech engines used on calls (Deepgram, ElevenLabs and Amazon Polly, as Twilio's own sub-processors).
- Amazon Web Services: cloud hosting, storage, compute, and account sign-in.
- Postmark: delivers the summaries and alerts Penny sends you, sign-in emails, and the one-time codes Penny emails your customers when you choose an emailed code for identity verification.
- Google: language-model processing, voicemail transcription, calendar integration when you connect it, and Google Tag Manager, which loads on our website and dashboard and receives the visitor's network address and the address of the page.
- OpenRouter: routes language-model requests to Google's models on our behalf; conversation text passes through it.
- Microsoft: calendar integration when you connect an Outlook or Microsoft 365 calendar.
- Pinecone: the search index Penny uses to answer from your website and reference material, including the questions Penny looks up in it.
- Firecrawl: reads your public website when you add or refresh it.
- ElevenLabs: plays voice samples in your dashboard; it receives only the greeting text you preview.
- Stripe: payment processing and billing.
- PostHog: product analytics about how our website, dashboard and service are used, and error reports; identifies account owners, never callers.
- Cloudflare: checks that a website chat is started by a person (Turnstile) when a visitor opens the chat; it receives the visitor's network address and browser signals, and no conversation text.
International transfers
Where personal data is transferred across borders, we rely on appropriate safeguards such as the Standard Contractual Clauses. Our providers above operate under their own transfer mechanisms as well.
Security and breach notification
We maintain the safeguards described on our Security page and will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification duties.
Audits and assistance
On reasonable request, we'll provide the information needed to demonstrate compliance with this addendum and assist with your data-protection obligations, including impact assessments where applicable.
How to request a signed copy
Need a countersigned DPA for your records, or have questions about our processing? Email support@pennyassistant.com and we'll take care of it.
Data Processing Addendum for Penny, operated by Penny Labs LLC. This page is provided for transparency and isn’t legal advice.
Give Penny a call before you forward yours.
Try the HVAC demo, then set up Penny for your business. Your account starts with 14 days of Pro, including 100 phone minutes and 300 website conversations; Free keeps your website chat after the trial.
14 days of Pro, including 100 phone minutes and 300 website conversations. No credit card.