This addendum forms part of the terms of service between you (“Customer”) and Bright Thoughts Technologies (“Ansabel”), and applies whenever Ansabel processes personal data on your behalf.
For data about your callers, website visitors and form submitters, you are the controller and Ansabel is the processor (in CCPA/CPRA terms, you are the business and Ansabel is a service provider). For data about your own account — your login, billing and audit records — Ansabel is the controller and its privacy policy applies.
| Purpose | Answering, recording, transcribing, summarising and analysing telephone calls and web enquiries, and providing the resulting records, CRM, tickets and notifications to you |
| Duration | For as long as your account is open, plus the deletion window in section 9 |
| Categories of data subject | Your callers, your website visitors, and people your outbound campaigns contact |
| Categories of personal data | Phone number, call audio, call transcript, AI-generated summary and sentiment, name, email address, company name, stated reason for calling, and any additional answers your intake questions collect |
| Special category data | Not requested by Ansabel. Callers may nonetheless volunteer it — health information to a clinic, for example. You are responsible for having a lawful basis, and for configuring your receptionist not to solicit it |
You are responsible for having a lawful basis to record, transcribe and process your callers' data, for giving them the notice their jurisdiction requires, and for the accuracy of what you configure the receptionist to say and ask. Recording notice and AI disclosure are enabled by default; switching them off is your instruction and your risk.
Ansabel maintains technical and organisational measures appropriate to the risk, including: encryption in transit (TLS), salted scrypt password hashing, per-workspace query scoping so no customer can read another's data, signed outbound webhooks, session expiry, rate limiting on public endpoints, and an audit log of security-relevant actions available to you in the app.
You give general authorisation for Ansabel to engage the sub-processors listed at ansabel.com/subprocessors, which states what each receives. We impose data protection obligations on each of them no less protective than these, and we remain liable for their performance.
We will give notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected part of the service.
Our sub-processors operate internationally, so personal data may be processed outside your country, including in the United States. Where a transfer requires a lawful mechanism, we rely on the Standard Contractual Clauses or an equivalent, as incorporated into our agreements with each sub-processor.
Where a caller contacts us directly, we will not respond on your behalf beyond confirming that they should contact you, and we will forward the request. We will assist you in responding to access, correction, deletion, portability and objection requests, using the tools in the app where possible.
We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need for your own notifications.
You can delete call records, contacts and tickets from within the app at any time, and export your call log as CSV. On termination we delete workspace personal data within 30 days, except where retention is required by law. Backups age out on their own cycle.
On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate compliance with this addendum.
If this addendum conflicts with the terms of service, this addendum governs for matters of personal data processing.
Last updated 9 August 2026. Questions: [email protected]. Postal address available on request.
© 2026 Ansabel, by Bright Thoughts Technologies ·
Home · Pricing · Features ·
How it works · Contact
Privacy · Terms · DPA ·
Sub-processors