Adovex LLC · Effective October 30, 2026 · Part of the Adovex Terms of Service
The short version. Your leads, calls, texts and campaign data are yours. We use them only to run your advertising and intake for you. We don't sell them, we don't use them for anyone else's advertising, and we don't let our AI providers train on them. We protect them, tell you quickly if something goes wrong, help you answer people's privacy requests, and delete them when you leave. The companies that help us are listed below and held to the same rules.
1. What this covers
This Data Processing Addendum (“DPA”) is part of the agreement between Adovex LLC (“Adovex”, “we”) and the law firm or business that uses our Services (“Customer”, “you”), made up of the Adovex Terms of Service, any order form, and this DPA. It applies when Adovex processes Customer Personal Data on your behalf. If this DPA and the Terms disagree about Customer Personal Data, this DPA controls.
2. Definitions
- Customer Personal Data means personal information we process for you in providing the Services: information about the people who visit your landing pages and website, call your tracking or ScreenCall numbers, submit your forms, chat with your SiteChat or receive your TapVerify texts; the leads, recordings, transcripts and notes that result; and information about your own staff in the portal.
- Privacy Laws means the U.S. federal and state laws that apply to Customer Personal Data, including the California Consumer Privacy Act as amended (“CCPA”) and comparable state consumer privacy laws, the Telephone Consumer Protection Act, and state call-recording laws.
- Subprocessor means a company Adovex engages that processes Customer Personal Data to help provide the Services.
- Security Incident means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
Terms such as “business”, “service provider”, “controller”, “processor”, “sell”, “share” and “consumer” have the meanings given in the Privacy Laws.
3. Roles
For Customer Personal Data, you are the business or controller and Adovex is your service provider or processor. Adovex is a separate business for information about your own account with us (your contacts, billing and your use of the portal), which our Privacy Policy covers. The advertising platforms (Google, Meta, OpenAI) are separate businesses under your own agreements with them.
4. How we use Customer Personal Data
- Only to provide the Services. We process Customer Personal Data only to provide, support, secure and improve the Services for you, as described in Annex 1, and as you direct through the portal, your intake rules and your instructions. We'll tell you if we believe an instruction breaks the law.
- Reporting to ad platforms. At your direction, we report conversions from your campaigns to Google Ads, Google Analytics and Meta, using hashed contact details, so your campaigns can be measured and optimized. Those platforms process that data under your agreements with them. You can turn this off for any platform.
- What we don't do. We don't sell or share Customer Personal Data for cross-context behavioral advertising for anyone but you; keep, use or disclose it for any purpose other than the business purposes in this DPA, or outside our direct business relationship with you; combine it with personal information from other clients or sources, except as the Privacy Laws allow a service provider to; or use your leads, recordings and transcripts to train AI models, or allow our providers to.
- Improving the Services. We may use information about how the Services perform, in a form that doesn't identify the people in your leads, such as aggregate conversion rates, to improve them.
- If we can't comply. We'll tell you if we can no longer meet our obligations under the Privacy Laws, and you may take reasonable steps to stop and remedy any unauthorized use.
- Our certification. We understand the restrictions in this section and will comply with them.
5. Your responsibilities
You're responsible for the notices and consents the Privacy Laws require for the data your campaigns collect: a privacy policy on your website and landing pages (we link to it on pages we build), consent for texts sent in your name, and call recording being lawful where your callers are. ScreenCall and FirstTrack announce recording at the start of every call; tell us if you need recording turned off for a state or a different announcement. Don't ask us to collect information the Services don't need, such as Social Security numbers.
If you're a healthcare provider or your campaigns collect health information, tell us before we start, so we can agree on any additional terms the law requires.
6. Subprocessors
- Approval. You approve the Subprocessors in Annex 3.
- Contracts. We have a written contract with each Subprocessor that protects Customer Personal Data at least as well as this DPA, and we're responsible for their compliance.
- Changes. We'll update the list at least 15 days before a new Subprocessor starts processing Customer Personal Data, and email your account owner. If you object for a reasonable privacy or security reason within those 15 days, we'll try to resolve it; if we can't, you may end the engagement without penalty.
7. Security
We maintain the technical and organizational measures in Annex 2. Everyone at Adovex who can access Customer Personal Data is bound to confidentiality and accesses it only as needed to run and support the Services. We may update these measures as long as the overall level of protection doesn't go down.
8. Security incidents
If we confirm a Security Incident affecting your Customer Personal Data, we'll tell you without undue delay, and within 72 hours of confirming it: what happened, what data was involved and what we're doing about it, with updates as we learn more. We'll take reasonable steps to contain it and help you meet any notice obligations you have. Telling you about an incident isn't an admission of fault.
9. Requests from people
If someone asks us to access, correct, delete or copy their information from your campaigns, we'll refer them to you, or tell you about it, and won't respond directly unless you ask us to or the law requires it. We'll help you respond, mostly through the portal, where you can find, export and delete leads, recordings and transcripts, and we'll give reasonable help with any data protection assessment you're required to do.
10. Information and audits
On written request, no more than once a year (or more often if a regulator requires it or after a Security Incident), we'll answer a reasonable security questionnaire and give you the information you need to show compliance with this DPA. If the Privacy Laws require more, we'll agree on a reasonable, confidential assessment by you or an independent assessor, at your cost, with reasonable notice and without disrupting the Services.
11. Retention and deletion
While you're a client, Customer Personal Data stays available to you in the portal, and you can export it at any time. When the engagement ends, we give you an export of your leads on request, and we delete Customer Personal Data within 30 days of your written request, or in any case within 12 months after the engagement ends, except what the law requires us to keep, which we keep only as long as required and protect under this DPA. Deleted data leaves backups as they're replaced.
12. Location, liability and term
- Location. We store Customer Personal Data in the United States. Some Subprocessors deliver web traffic through servers in other countries.
- Liability. Adovex's liability under this DPA is subject to the limitations in the Terms of Service.
- Term. This DPA lasts as long as we process Customer Personal Data for you.
- Changes. We may update this DPA to reflect changes in the law or the Services. We'll tell you before a material change takes effect, and changes won't reduce the protection of Customer Personal Data.
Annex 1 · Details of the processing
| Purpose | Running your advertising campaigns and the intake around them: tracking visits, calls and form submissions to your ads; answering and screening calls (ScreenCall); confirming leads by text (TapVerify); answering website chat (SiteChat); recording, transcribing and summarizing calls for your review; aggregating leads in your portal; reporting conversions to the ad platforms you use; and support. |
| Duration | While you're a client, then until deletion under section 11. |
| People | Visitors to your landing pages and website, people who call or text your numbers, people who submit your forms or use your chat, and your staff who use the portal. |
| Information | Names, phone numbers, email addresses, what people say and write about their situation, call recordings and transcripts, text messages, visit and device data (IP address, pages viewed, ad clicked), and your intake notes and lead status. |
| Sensitive information | Callers and form submitters often describe injuries, medical treatment, arrests, immigration status or family matters. We process it only for your intake and treat it as sensitive. |
Annex 2 · Security measures
- Encryption in transit. All traffic to the portal, the tracking endpoints and our APIs uses HTTPS.
- Sign-in. Portal sign-in is handled by a dedicated provider (Clerk). We never see or store passwords.
- Separate clients. Every request is checked against the client it belongs to, so one firm can't see another's leads.
- Access by our team. Limited to the people who need it to run and support the Services, through protected administrative tools.
- Recordings and files. Stored in access-controlled object storage and available only to signed-in users of your portal and our team.
- Monitoring. Errors are monitored with a dedicated error-reporting service.
- Backups and deletion. Backups are kept by our hosting provider; deleted data leaves them as they're replaced.
- Providers. Established providers with their own security programs (Annex 3).
Annex 3 · Subprocessors
These companies process Customer Personal Data to help us provide the Services. They store it in the United States; some deliver web traffic through servers in other countries.
| Company | What they do |
|---|---|
| Railway | Runs our servers and database, where leads, transcripts and campaign data are stored. |
| Cloudflare | Domain records and delivery for our sites and your tracking domain, and storage for call recordings and files (R2). |
| Vercel | File storage for some documents and images. |
| Clerk | Portal accounts and sign-in. |
| Telnyx | Phone numbers, call routing, recording and text messages for FirstTrack, ScreenCall and TapVerify, including the AI models Telnyx uses for ScreenCall. |
| Twilio | Text messages on some client numbers. |
| OpenAI | Transcribes and summarizes call recordings. |
| Anthropic | AI analysis in the portal and the SiteChat assistant. |
| Brevo | Sends lead notifications and portal emails. |
| Sentry | Error reports. |
| Fastmail | Our own email, for what you send us about your account. |
Google, Meta and OpenAI's advertising platforms receive conversion data from your campaigns at your direction, under your own agreements with them. They aren't Subprocessors.
Questions about this DPA: write to Adovex LLC, 3172 North Rainbow Boulevard #1196, Las Vegas, NV 89108, email support@adovex.com, or use our contact form.