Gasta AI — Terms of Service

16.1 Nature and Purpose of Processing

Gasta AI acts as a data processor on your behalf for the following purposes:

• Receiving and routing inbound telephone calls to your business telephone number provisioned through Twilio.
• Automatically sending SMS replies to callers who reach you outside of business hours or when their call goes unanswered (Tier 1).
• Conducting AI-powered SMS conversations with your customers in response to inbound text messages, including answering questions about your services and booking appointments (Tier 2).
• Answering inbound calls using a voice AI, engaging callers in natural conversation, collecting booking details, and logging call outcomes (Tier 3).
• Storing call logs, message records, and booking records in your account for your review and management.
• Applying automated data retention rules to delete or redact personal data in accordance with our retention policy and your instructions.

The processing is carried out solely for the purpose of providing the Service to you and shall not be used for any other purpose without your prior written instruction.

16.2 Types of Personal Data Processed

The following categories of personal data belonging to your customers may be processed:

• Caller telephone numbers (in E.164 format, e.g. +447700900123).
• Caller names, where provided by the caller or inferred by the AI during a call.
• The content of voice calls, including transcriptions and summaries generated by the AI.
• The content of SMS messages sent to or from your Twilio number.
• Booking details, including the caller's name, telephone number, requested service, preferred date and time, and any notes provided during the call.
• Call metadata, including call timestamps, call duration, call status (answered, missed, busy), and whether an auto-reply was sent.
• Session data created during Tier 3 voice calls, including the conversation history between the caller and the AI.

No special category data (as defined in Article 9 UK GDPR) is intentionally collected. You must not configure the Service in a way that causes callers to disclose special category data. If you become aware that such data has been collected, notify us immediately so that it can be deleted. The data subjects whose personal data is processed are your customers and other individuals who contact your business telephone number.

16.3 Obligations of Gasta AI as Data Processor

As data processor, Gasta AI shall:

• Process personal data only on your documented instructions, including those set out in these Terms, and notify you if we believe any instruction infringes UK GDPR or other applicable data protection law.
• Ensure that all personnel with access to personal data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures as described in clause 16.5.
• Assist you in responding to data subject rights requests (see clause 16.8) within the timeframes required by UK GDPR.
• Assist you in ensuring compliance with your obligations under Articles 32 to 36 UK GDPR, including in relation to security, data protection impact assessments (DPIAs), and prior consultation with the Information Commissioner's Office (ICO).
• Notify you without undue delay — and in any event within 72 hours of becoming aware — of any personal data breach affecting data processed on your behalf, in accordance with clause 16.7.
• At your election, delete or return all personal data at the end of the service relationship and delete existing copies, unless retention is required by applicable law.
• Make available to you all information reasonably necessary to demonstrate compliance with this DPA and cooperate with any audits or inspections you or a regulator conduct, subject to reasonable advance notice.
• Apply the automated data retention policy described in our Privacy Policy, which anonymises or deletes personal data after 90 days unless you instruct otherwise.

16.4 Obligations of the Business as Data Controller

As data controller, you are responsible for:

• Ensuring that you have a valid lawful basis under UK GDPR for processing your customers' personal data via the Service (for example, legitimate interests or contractual necessity).
• Providing all legally required privacy information to your customers — including that their calls may be answered or recorded by an AI system — in your own privacy notices and through appropriate disclosures before or at the time of the call.
• Ensuring the Service is used only in accordance with applicable law, including the UK Privacy and Electronic Communications Regulations (PECR).
• Not instructing us to process personal data in a way that would cause us to breach UK GDPR or any other applicable law.
• Handling data subject rights requests (see clause 16.8) received directly from your customers.
• Promptly forwarding to us any data subject rights request that requires us to retrieve, restrict, or delete data we hold on your behalf.
• Carrying out a Data Protection Impact Assessment (DPIA) where required by UK GDPR before using the Service for any high-risk processing activities.
• Registering with the Information Commissioner's Office (ICO) as a data controller where required and paying the applicable data protection fee.

16.5 Security Measures

Gasta AI implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. These include:

• Encryption in transit: all data transmitted between the mobile app, the backend server, and third-party sub-processors is encrypted using TLS 1.2 or higher.
• Encryption at rest: personal data stored in the database is held on Railway's managed infrastructure, which encrypts data at rest.
• Access controls: access to the production database and admin dashboard is restricted to authorised personnel, protected by strong credentials and, where available, multi-factor authentication.
• Least privilege: application components are granted only the minimum database permissions required for their function.
• Data minimisation: the Service collects only the personal data necessary to provide the requested functionality.
• Automated retention: voice transcripts are cleared, SMS message bodies are redacted, and caller names are anonymised after 90 days. Blocked calendar slots are deleted after one year. Applied automatically by a nightly scheduled job.
• Phone number hashing: the compliance log for erasure requests stores a SHA-256 hash of the phone number rather than the number itself, ensuring the log cannot be used to re-identify a data subject.
• Separation of customer data: each business account's data is logically separated in the database using business ID references.
• Vulnerability management: dependencies are reviewed and updated regularly to address known security vulnerabilities.

16.6 Sub-Processors

You provide general written authorisation for Gasta AI to engage the sub-processors listed below. We will inform you of any intended changes to this list (additions or replacements) with at least 14 days' notice, giving you the opportunity to object before the change takes effect.

Each sub-processor is contractually bound by data protection obligations at least equivalent to those in this DPA. Where sub-processors are located outside the UK, appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses or equivalent mechanisms approved by the Information Commissioner's Office.

16.7 Data Breach Notification

In the event of a personal data breach affecting data processed on your behalf, Gasta AI will:

• Notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• Provide you with sufficient information to allow you to meet your own notification obligations to the ICO and, where required, to affected data subjects.
• Include in our notification (to the extent known at the time): a description of the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach and prevent recurrence.
• Cooperate with you in investigating the breach and take all reasonable steps to mitigate its effects.
• Not make any public statement or notify data subjects or regulators about the breach without your prior written consent, unless required to do so by law.

You are responsible for assessing whether a breach requires notification to the ICO (within 72 hours of becoming aware, where feasible) and to affected data subjects. Gasta AI will provide all reasonable assistance in making these assessments and in preparing required notifications.

16.8 Rights of Data Subjects and How to Handle Requests

Under UK GDPR, your customers have the following rights in respect of their personal data processed through the Service:

• Right of access (Article 15): The right to obtain a copy of the personal data held about them.
• Right to rectification (Article 16): The right to have inaccurate personal data corrected.
• Right to erasure — "right to be forgotten" (Article 17): The right to have personal data permanently deleted where one of the Article 17 grounds applies.
• Right to restriction of processing (Article 18): The right to request that processing is restricted while a complaint or challenge is pending.
• Right to data portability (Article 20): The right to receive personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): The right to object to processing carried out on the basis of legitimate interests.
• Rights in relation to automated decision-making (Article 22): The right not to be subject to solely automated decisions that produce significant legal or similarly significant effects.

Where a data subject contacts Gasta AI directly with a rights request, we will:

• Forward the request to you within 5 business days, as you are the data controller responsible for responding.
• Assist you in fulfilling the request by retrieving, restricting, correcting, or deleting the relevant data from our systems as you instruct.
• Not respond to the data subject on your behalf without your written authorisation, unless required to do so by law.

Gasta AI provides a Data Subject Rights tool within the admin dashboard that enables you to search for all personal data held for a specific telephone number and permanently erase it across all data tables (calls, messages, bookings, and voice sessions). Each erasure is recorded in a compliance log that stores a cryptographic hash of the phone number — not the number itself — the date and time of erasure, the number of records deleted in each category, and any ticket reference you provide. This log is accessible at any time from the admin dashboard. You must respond to data subject rights requests within one calendar month of receipt. This may be extended by a further two months for complex or numerous requests, provided you inform the data subject of the extension and the reason within the first month.

16.9 Duration and Termination of this DPA

This DPA remains in force for the duration of the subscription and terminates automatically on the termination or expiry of the Terms of Service. On termination:

• We will retain your account data for 30 days to allow you to export any information you require.
• After 30 days, all personal data associated with your account will be permanently deleted from our systems and those of our sub-processors, except where retention is required by applicable law (for example, financial records required for tax or regulatory compliance).
• On written request made within 6 months of termination, we will provide written confirmation that deletion has been completed.