Data Processing Addendum — MiraVoice
Last Updated: 12 October 2026
This Data Processing Addendum ("DPA") forms part of the Customer Agreement between Helios Core AI LLC ("Helios") and Customer (the "Agreement") and applies to Helios's processing of Personal Data on Customer's behalf in connection with MiraVoice. Processing in connection with Mira Resolve is governed by the Mira Resolve Data Processing Addendum at https://helios-core.com/legal/dpa.
Self-serve subscriptions. This DPA also forms part of the Mira Voice Platform Terms of Service, which govern MiraVoice subscriptions taken without an Order Form. Where it applies on that basis, "the Agreement" means those Terms, "Customer" means the Subscriber under them, and a reference here to a numbered Section of the Agreement is to the corresponding provision of those Terms, or, where there is none, has no effect. Where this DPA requires notice to the notices contact identified in the Order Form, for a self-serve subscription that means the account email address Helios holds for the Subscriber. Nothing in this paragraph brings the Customer Agreement into a self-serve subscription.
Scope note. The Services are offered for use in the United States and Canada (Agreement §13.2). This DPA is drafted for United States state privacy law and Canadian federal privacy law. It does not include provisions for the EU/UK General Data Protection Regulation, and Helios does not presently offer data residency outside the United States.
1. DEFINITIONS
"Personal Data" means information relating to an identified or identifiable individual that Helios processes on Customer's behalf in providing the Services.
"Privacy Laws" means the privacy and data protection laws applicable to the processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and comparable state statutes, and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
"Process" and its variants have the meaning given in the Privacy Laws.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data.
"Sub-processor" means a third party engaged by Helios that Processes Personal Data.
Terms not defined here have the meaning given in the Agreement.
2. ROLES
Customer is the controller, or the business, in respect of Personal Data. Helios Processes Personal Data as a processor, and as a service provider within the meaning of the CCPA.
Helios will:
(a) Process Personal Data only on Customer's documented instructions, which comprise the Agreement, this DPA, Customer Configuration, and any further written instruction Customer gives;
(b) not sell or share Personal Data, as those terms are defined in the CCPA;
(c) not retain, use or disclose Personal Data for any purpose other than performing the Services, or as otherwise permitted by the Privacy Laws;
(d) not retain, use or disclose Personal Data outside the direct business relationship between the parties; and
(e) not combine Personal Data with personal information received from another source, except as permitted by the Privacy Laws.
Helios will notify Customer if it determines it can no longer meet these obligations.
3. PROCESSING DETAILS
The subject matter, nature and purpose of the Processing, the categories of Personal Data and data subjects, and the retention applicable to the Service are set out in Annex A.
The duration of Processing is the Subscription Term plus the periods described in Section 8.
4. CONFIDENTIALITY AND PERSONNEL
Helios will ensure that personnel authorized to Process Personal Data are bound by confidentiality obligations, receive appropriate training, and are granted access on a role-based, need-to-know basis.
5. SECURITY
Helios will implement and maintain reasonable administrative, technical, physical and organizational measures designed to protect Personal Data against a Security Incident, taking into account the state of the art, the costs of implementation, and the nature, scope and purposes of the Processing. Helios will not materially diminish those measures during a Subscription Term.
Helios's current measures are described in its Security Overview, available on request.
Location. All Helios-controlled Processing and storage takes place in the United States, other than transit through the global edge network identified in the Sub-processor list. There is no per-tenant region selection. The Sub-processor list identifies each provider and, for infrastructure providers, the country in which it Processes; AI model inference may be performed at a provider's regional or global endpoint. Changes to the list are governed by Section 6.2.
Certifications. Any third-party security certification Helios holds that applies to the Services is available on request. Helios claims no certification it has not provided on request.
6. SUB-PROCESSORS
6.1 Authorization
Customer authorizes Helios to engage the Sub-processors listed at https://helios-core.com/legal/subprocessors-voice, which identifies each Sub-processor and the purpose of the Processing. AI and model providers are identified separately from infrastructure providers.
6.2 New Sub-processors
Helios will notify Customer of a new Sub-processor that Processes Personal Data by updating the Sub-processor list, and by email to Customer's notices contact identified in the Order Form (Agreement §13.6), at least thirty (30) days before that Sub-processor Processes Personal Data.
Customer may object within that period (the "Objection Window") only on the grounds that engaging the Sub-processor would cause (i) Customer to be in material breach of Privacy Laws, or (ii) Helios to be in breach of Section 5 (Security) or Section 7 (AI Processing). On a timely objection, Helios will either resolve the grounds for the objection or not permit that Sub-processor to Process Customer's Personal Data. If Helios cannot reasonably do either, Customer may terminate the affected Order Form on notice and receive a refund of prepaid, unused fees.
6.3 Terms and Liability
Helios will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains liable to Customer for a Sub-processor's performance.
6.4 Conditional Sub-processors
Certain Sub-processors are engaged only where Customer enables a specific feature. These are identified as conditional in the Sub-processor list and are not engaged unless Customer configures the corresponding capability.
7. AI PROCESSING
7.1 No Training
Helios will not use Customer Data to train, fine-tune or improve any machine learning model. For each AI Sub-processor, Helios uses only an offering, account tier, contractual arrangement or configuration under which that Sub-processor is not permitted to use Customer Data to train its models, and will provide the basis for any listed Sub-processor on request. Section 7.3 of the Agreement governs, and sets out the narrow aggregated-and-de-identified exception, which does not apply where a Business Associate Addendum is in force.
7.2 Content Transmitted to Model Providers
Customer acknowledges that providing the Services requires transmitting Customer Content to the AI Sub-processors identified in the Sub-processor list, and that this may include:
(a) the text of conversations, messages and email;
(b) raw call audio, transmitted to the speech-recognition provider on every call and, where Customer selects a live-audio provider, to that provider bidirectionally; and
(c) embeddings derived from knowledge base content.
7.3 Unstructured Content
The Services accept unstructured content from Customer's users and do not classify or filter it by category. Customer is responsible for what its users submit and for instructing them accordingly. Where Customer's users may submit protected health information, the Business Associate Addendum must be executed first.
8. RETENTION AND DELETION
8.1 Configurable Retention
Customer may configure a retention period for each Service. Customer Content processed in that Service is deleted, or its content scrubbed, after the configured period. Helios retains the records it needs to operate, bill and secure the Service, which do not include the content of calls, conversations, tickets or messages.
8.2 On Termination
For thirty (30) days after expiry or termination of the Order Form, or self-serve subscription, under which Personal Data was Processed, Customer may request that Helios make that Personal Data available in a commonly used electronic format. Helios will delete that Personal Data within sixty (60) days after the end of that period, whether or not Customer has requested deletion, and will confirm deletion on written request. Agreement §7.6 governs.
8.3 Limits on Deletion
Deletion under this Section does not extend to:
(a) data held in a Connected System, which is governed by Customer's own agreement with that provider;
(b) copies of call recordings retained by the telephony provider under Customer's or Helios's account with that provider, deletion of which is governed by that provider's retention settings;
(c) backups, which are overwritten on their ordinary cycle; or
(d) data Helios is required by law to retain.
Helios will continue to protect any Personal Data it retains under this Section in accordance with this DPA.
9. SECURITY INCIDENTS
Helios will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Security Incident affecting Customer's Personal Data. The notification will describe the nature of the incident, the categories and approximate volume of Personal Data affected, the likely consequences, and the measures taken or proposed.
Helios will cooperate reasonably with Customer's investigation and with any notification Customer is required to make. Customer is responsible for notifications to individuals and regulators unless the parties agree otherwise.
Helios's notification is not an acknowledgement of fault or liability.
10. ASSISTANCE
10.1 Individual Rights
Helios will provide reasonable assistance, at Customer's expense where the effort is more than trivial, in responding to a verified request from an individual to access, correct, delete, or restrict the Processing of their Personal Data. Where Helios receives such a request directly, it will forward it to Customer and will not respond except as Customer directs or the law requires.
10.2 Assessments
Helios will provide information reasonably necessary for Customer to conduct a privacy impact or risk assessment required by the Privacy Laws.
11. AUDIT
Helios will make available information reasonably necessary to demonstrate compliance with this DPA, including any then-current third-party audit report or certification it holds.
Where that information is insufficient, Customer may, not more than once in any twelve-month period and on at least thirty (30) days' notice, conduct an audit limited to Helios's processing of Customer's Personal Data, during business hours, subject to confidentiality obligations, and at Customer's expense. An audit must not unreasonably disrupt Helios's operations or compromise the confidentiality or security of another customer's data.
12. GENERAL
This DPA supplements the Agreement. In the event of conflict between this DPA and the Agreement in respect of Personal Data, this DPA controls; the order of precedence in Agreement §2 otherwise applies. The liability provisions of the Agreement apply to this DPA. This DPA terminates with the Agreement, subject to Section 8.
13. CANADA
13.1 Federal
Where Customer is subject to PIPEDA or substantially similar provincial legislation, Helios Processes Personal Data under Customer's accountability as the organization that collected it. Customer acknowledges that Personal Data is transferred to, processed and stored in the United States and is subject to United States law, and is responsible for any notice to individuals that this transfer requires under the law applicable to Customer.
13.2 Quebec
Where Personal Data concerns individuals in Quebec, the parties acknowledge that:
(a) the communication of Personal Data outside Quebec is Customer's decision as the person carrying on the enterprise, and the privacy impact assessment required by section 17 of the Act respecting the protection of personal information in the private sector before that communication is Customer's to perform;
(b) Helios will provide, on request, the information about its processing, safeguards, sub-processors and location reasonably required for that assessment — this DPA and its Annexes are intended to supply it, and Helios will answer reasonable supplementary questions;
(c) Helios will notify Customer of a confidentiality incident affecting Quebec Personal Data in accordance with Section 9, and Customer is responsible for any notification to the Commission d'accès à l'information and to individuals, and for maintaining the register of incidents the Act requires of it;
(d) Helios will, on Customer's written instruction, cease Processing and delete Personal Data of a Quebec individual in accordance with Section 8 and Section 10.1; and
(e) Helios does not offer processing or storage within Quebec or elsewhere in Canada, and Customer should not enter into an Order Form if its assessment under (a) requires it.
ANNEX A — MIRAVOICE
Nature and purpose: provision of an AI voice reception and outbound calling service, including answering inbound calls, placing outbound calls, transcription, summarization, appointment and lead handling, SMS and email correspondence, and associated administration.
Categories of data subject: Customer's callers and prospective customers; Customer's personnel and administrative users.
Categories of Personal Data:
| Category | Detail |
|---|---|
| Contact identifiers | Caller and called telephone numbers, names, email addresses |
| Call content | Call recordings, transcripts, AI-generated summaries, extracted fields |
| Message content | SMS message bodies; email subject, body and headers |
| Sales records | Lead records including name, company, contact details, notes, scores and call outcomes |
| Technical | IP address and user agent on inbound web requests; call and recording identifiers |
| Account | Administrative user accounts, billing contact and address |
Retention. The retention period Customer configures under Section 8.1 applies to the Customer Content described in this Annex.
Conditional Sub-processors. Where Customer selects a third-party outbound calling provider for sales calling, that provider is engaged for those calls only. Where Customer supplies its own telephony or speech provider credentials, Customer is the contracting party with that provider for the corresponding traffic.
Helios Core AI LLC · legal@helios-core.com