This is version 2026-10-10-web-form, which takes effect October 16, 2026. Version 2026-10-05-r4, effective October 15, 2026, is the one in effect now; version 2026-10-07-home-services takes effect October 16, 2026, then version 2026-10-07-towing takes effect October 16, 2026, then version 2026-10-08-small-business takes effect October 16, 2026, then version 2026-10-09-postmark-role takes effect October 16, 2026.

Data Processing Addendum (DPA)

Effective date: 2026-09-23 Last updated: 2026-10-10

This Data Processing Addendum ("DPA") is between Intake Gateway LLC, a New Mexico limited liability company ("Processor," "we") and the Firm identified in its Intake Gateway account ("Controller," "you"), and is incorporated by reference into the Terms of Service. It governs our processing of Caller Personal Data on your behalf as described in the Privacy Policy.

1. Definitions

• "Caller Personal Data" means personal data of callers answered by the Service on your behalf and, where you have placed the Service's website chat on your own site, of visitors who use that chat and, where you have connected your own website contact form to the Service, of visitors who send it — call audio, transcripts, chat and form messages, and structured intake data (name, contact information, incident/injury details and, for a work injury, employment and claim-status details or, for an arrest or criminal charge, the charge, custody and court-date details or, for a family matter, the matter, the other party, the number of children, whether it is safe to call back, the state and county of residence, court-date and order details, and any mention of abuse the caller volunteers or, for any other new legal matter, the matter in the caller's words, the other side's name, the state and city or county and any coming date or, for an immigration matter, the matter in the caller's words, the name of any criminal charge the caller names as part of it, any employer or petitioner named, whether the person is held by immigration and where, whether it is safe to call back, the state and city or county and any coming date or, for a home-services business, the address where the work is needed, the problem in the caller's words, how urgent it is and a time to call back or, for a towing business, where the vehicle is, whether the caller is somewhere safe, the vehicle and what happened or, for another kind of small business, why the caller is calling and a time to call back) as described in the Privacy Policy. "Caller" in this DPA includes such a visitor.
• "Processing" has its ordinary meaning (collecting, recording, storing, transmitting, and deleting data), consistent with how the term is used industry-wide, including under frameworks like the CCPA/CPRA (whose "service provider" concept this DPA is written to satisfy for California-resident callers) even though this DPA does not itself claim GDPR applicability (the Service is US-only).
• "Sub-processor" means a third party we use to help deliver the Service and that processes Caller Personal Data as part of that.

2. Roles

You are the Controller (or, under the CCPA, the "Business") for Caller Personal Data — it's your prospective-client relationship, and you decide what the Service is used for. We are your Processor (or "Service Provider") — we process Caller Personal Data only to deliver the Service as you've configured it and to maintain and improve its quality as Section 4 describes, and only on your instructions (given through your account configuration and your use of the Service).

3. Nature and purpose of processing

4. Our obligations as Processor

We will:

• Process only on your documented instructions — meaning the configuration you set in your account (your agent's settings, the accounts you connect, the numbers you forward) and your ordinary use of the Service. We may, but are not required to, tell you if we believe an instruction violates applicable law, and we may decline to act on it.
• Keep Caller Personal Data confidential, limiting access to personnel and systems that need it to deliver the Service or to carry out the quality review described below.
• Maintain technical and organizational security measures appropriate to the nature of the data and the scale of a self-serve platform. Our measures evolve as the Service does; we may change them at any time provided we do not materially reduce overall security, and no particular control, architecture, vendor, or certification is promised or guaranteed by this DPA.
• Notify you without undue delay after we confirm a breach affecting Caller Personal Data we process on your behalf, with the information reasonably available to us at that time. Our notice is not an acknowledgement of fault or liability, and making it does not discharge any notification obligation the law places on you as Controller.
• Provide reasonable assistance, at your request and your expense, in responding to data subject requests relating to Caller Personal Data. Responding to those requests is your obligation as Controller, not ours.
• Not sell or share Caller Personal Data, and not retain, use, or disclose it other than to perform the Service for you, for the quality review and improvement described in the next item, or as otherwise permitted for a service provider under applicable law.
• Use it to improve the Service only in these ways. Your use of the Service instructs us to use Caller Personal Data to maintain and improve the quality of the Service — one product, so an improvement made from any call reaches every Firm's agent: our personnel who need to may review call recordings, transcripts and intake data to check and improve how the Service answers, understands, summarizes and routes calls, and we may use what we learn — never the recordings, transcripts or intake data themselves — to change the Service's instructions, configuration and tests. That review uses the Service's own systems and the sub-processors in Section 5, and does not extend how long any data is kept. We will not use Caller Personal Data to build a profile of any caller, to contact or market to any caller, to serve advertising, or to perform services for anyone else. Apart from the sub-processors in Section 5, who receive it only to help deliver and review the Service, we will not disclose it to anyone. We may also create de-identified or aggregated data from Caller Personal Data — data that no longer identifies, and cannot reasonably be linked to, any caller — and use it to operate, secure and improve the Service; we will keep it in that form, will not attempt to re-identify it, and will require anyone we give it to not to.
• Provide the same level of privacy protection for Caller Personal Data as applicable privacy law requires of you, and comply with the obligations that law places on a service provider.
• Not combine Caller Personal Data with personal information we receive from or on behalf of anyone else, or that we collect ourselves, except as a service provider is permitted to do under applicable law.
• Tell you if we determine that we can no longer meet our obligations under this DPA or under applicable privacy law.

We may delete Caller Personal Data at any time, including during and after the term. We give no undertaking as to how long any data is kept or when it is removed: we do not commit to retaining it, to deleting it by any date or by any particular method, or to confirming or certifying deletion, and data may persist in backups and in sub-processors' systems until those cycle in the ordinary course.

4A. Your obligations as Controller

You are responsible for:

• Notice and consent. Giving any notice to, and obtaining any consent from, callers that applicable law requires for the recording, transcription, and automated handling of their calls — including in two-party (all-party) consent states. The Service is designed to give a default disclosure at the start of each call as a convenience — that is a design intention, not a warranty that any particular call carried it (Terms of Service Section 5) — and deciding whether that disclosure is sufficient for your callers and your jurisdictions is your decision, not ours.
• Lawful instructions. Ensuring your configuration and use of the Service, and the personal data your use causes us to process, comply with the laws that apply to you and with your own professional-responsibility obligations.
• Your own disclosures. Maintaining your own privacy notice and responding to the data-subject requests you receive, with the assistance described in Section 4.

Your indemnity in Section 14 of the Terms of Service applies to claims arising from these responsibilities.

5. Sub-processors

The list below reflects the sub-processors we used, or had engaged for a feature the Terms of Service describe, as of this DPA's date; a sub-processor for a feature you have not switched on or installed receives nothing of yours until you do. We may add, remove, or replace a sub-processor at any time, and we do not undertake to keep this list current, to publish an updated one, or to notify you of a change. You consent to our use of sub-processors, and if you object to any of them, your sole and exclusive remedy is to stop using the Service and cancel under the Cancellation + Refund Policy.

Your own connected accounts are not our sub-processors. Clio and Cal.com are services you contract with directly and connect to your Intake Gateway account using your own credentials. When the Service writes to them at your direction, it is acting on your instruction to move your data into your own vendor account. Your relationship with those providers, including any data-processing terms, is between you and them, and we are not responsible for their processing, availability, or security.

6. Security diligence and your right to verify

Once in any twelve-month period, at no charge and on written request, we will give you a written description of the technical and organizational security measures we then maintain. You have the right to take reasonable and appropriate steps to ensure that we use Caller Personal Data in a manner consistent with your obligations under applicable privacy law, and, on notice to us, to take reasonable and appropriate steps to stop and remediate any unauthorized use of it. That written description is how those rights are exercised under this DPA.

We provide no other diligence. We do not offer on-site or third-party audits, inspections, penetration testing of our systems, bespoke security questionnaires, certifications, or attestations, and nothing in this DPA obliges us to provide any of them. This is a self-serve platform sold at a self-serve price, and diligence of that kind is not part of what it includes.

7. International transfers

The Service is built and operated for US use, and we do not intend for Caller Personal Data to be processed outside the United States. We do not, however, warrant the processing location of any sub-processor, and we make no commitment as to where data is processed or stored.

8. Liability

Liability under this DPA is subject to the limitation of liability in the Terms of Service, Section 13. Claims under this DPA and claims under the Terms of Service share a single aggregate cap; this DPA does not create a separate or additional one.

9. Term

This DPA is in effect for as long as we process Caller Personal Data on your behalf.

10. Acceptance

This DPA is incorporated into the Terms of Service by reference and accepted the same way — see the Master Subscription Agreement for how self-serve acceptance is recorded.