Privacy Policy & Data Processing Addendum

Stephen Sawka d/b/a Sawka Solutions ("Provider", "we", "us", or "our") operates https://sawkasolutions.help and provides automated voice intake, telephony routing, and dispatch notification services to commercial repair shops and trade contractors ("Clients"). This document sets forth our Privacy Policy regarding public website visitors and serves as a formal Data Processing Addendum ("DPA") governing the processing of personal data on behalf of our Clients.

PART 1: PUBLIC WEBSITE PRIVACY POLICY

1. Information We Collect on Our Website

When you visit https://sawkasolutions.help or interact with our web resources, we collect:

• Contact Information: Name, phone number, email address, trade niche, and business name voluntarily submitted through intake or inquiry forms.
• Device & Usage Data: IP address, browser user-agent, operating system, and referral headers collected automatically via Cloudflare and our secure hosting infrastructure.
• Operational Metrics: Estimated call volume, average ticket size, and business capacity metrics entered into our ROI estimators.

2. How We Use Website Data

We use website data solely to:

• Deliver requested onboarding quotes, lead analysis reports, and demo phone links;
• Respond to client support and sales inquiries;
• Maintain server security, monitor network integrity, and prevent fraudulent bot submissions.

3. Cookies & Tracking

Our website uses essential session cookies to preserve user preferences. We never sell, rent, or trade visitor personal data to third-party data brokers or marketing aggregators.

PART 2: B2B DATA PROCESSING ADDENDUM (DPA)

This Part 2 governs the telephone audio, conversational transcripts, caller phone numbers, and operational dispatch logs processed by Provider when answering forwarded calls on behalf of Client.

4. Scope, Roles, and Jurisdiction

4.1. Controller vs. Processor Roles: Under the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.), the New York SHIELD Act, and the New Jersey Data Privacy Act:

• Client is the Data Controller: Client collects customer inquiries and determines the commercial rules of the telephone answering service.
• Provider is the Data Processor: Provider processes caller telephone audio, caller names, and diagnostic notes solely on behalf of Client and in accordance with Client’s documented instructions.

4.2. Categories of Data Processed:

• Caller telephone number (Caller ID / ANI);
• Caller name, physical breakdown/drop-off location, and address;
• Vehicle Year/Make/Model and repair symptoms;
• Date, time, duration, and audio recording of calls;
• Generated natural-language transcripts and SMS notification payloads.

5. Data Processor Covenants & Security Controls

5.1. Confidentiality: Provider processes customer personal data strictly to deliver the contracted telephone intake and dispatch services, and never for any secondary commercial purposes.

5.2. Technical Safeguards: All API communications, telephony webhooks, and database requests utilize Transport Layer Security (TLS 1.2 or TLS 1.3). Transcripts and recordings are stored in encrypted environments utilizing AES-256 encryption.

5.3. 90-Day Rolling Purge Cycle: In accordance with data minimization principles, Provider maintains an automated 90-day rolling purge cycle. Call audio recordings and conversational transcripts are permanently deleted from active production databases ninety (90) days following call completion.

7. PCI-DSS Payment Card Exclusion

The Voice Agent system is explicitly out of scope for PCI-DSS compliance. The system is programmed to refuse credit cards over the phone. Automated regex filters detect and redact payment card patterns before data is stored or transmitted. Client warrants that it will not instruct callers to volunteer payment card numbers over the telephone.

8. Security Incident Notification SLA

Provider commits to notifying Client in writing without undue delay, and in no event later than seventy-two (72) hours, upon confirming any unauthorized security compromise or accidental disclosure involving Client’s customer personal data.

9. Authorized Sub-Processors

Client authorizes Provider to engage the following sub-processors for infrastructure delivery:

• Twilio Inc. (Telephony carrier and SMS routing);
• Cloudflare, Inc. (DNS security, SSL termination, Edge routing);
• Vapi Inc. (Voice AI orchestration);
• Deepgram, Inc. (Speech-to-text transcription models);
• ElevenLabs Inc. (Voice synthesis models);
• Stripe, Inc. (Payment processing and recurring billing).

10. Contact Information

For privacy questions, data deletion requests, or DPA inquiries, contact:
Stephen Sawka d/b/a Sawka Solutions
Email: [email protected]
Colorado Springs, Colorado 80920