Product: Frix Law
Processor: Frix Labs LLC (“Processor” or “Frix”)
Controller: The customer entity identified on the Order Form or account (“Controller” or “Customer”)
Effective date: August 1, 2026
Last updated: August 10, 2026
Version: 1.0
This Data Processing Agreement (“DPA”) forms part of the agreement between Customer and Frix Labs LLC for the Frix Law Service (the “Agreement”). It applies when Frix processes Personal Data on behalf of Customer in providing the Service. Capitalized terms not defined here have the meaning in the Agreement or in Applicable Data Protection Law.
1. Definitions
- Applicable Data Protection Law means the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA (as a service provider), and other privacy laws applicable to the processing under this DPA.
- Personal Data, Controller, Processor, Processing, Data Subject, Personal Data Breach, and Sub-processor have the meanings in the GDPR (or nearest equivalent under other laws).
- Customer Data means Personal Data uploaded to or generated in the Service by or for Customer (including caller and client data, documents, transcripts, and firm user content processed for Customer).
- SCCs means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), as applicable, and the UK International Data Transfer Addendum where required.
2. Roles
- Customer is Controller (or “business”); Frix Labs LLC is Processor (or “service provider”) with respect to Customer Data.
- Frix acts as an independent Controller for account administration, billing, product telemetry about firm users, and website visitor data, as described in the Privacy Policy.
- Each party will comply with its obligations under Applicable Data Protection Law.
3. Customer instructions
- Frix will Process Customer Data only: (a) to provide, secure, and support the Service; (b) as documented in the Agreement and this DPA; and (c) as otherwise instructed by Customer in writing (including configuration in the product), unless required by law (in which case Frix will notify Customer unless legally prohibited).
- Customer’s use of the Service is the complete documented instruction set as of the Effective Date. Additional instructions require mutual written agreement and may affect fees.
- Customer warrants it has a valid legal basis and has provided required notices and consents (including for call recording, AI processing, SMS, and sensitive data) for the Personal Data it submits.
4. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosted SaaS for legal intake, CRM, documents, and AI assistance (Frix Law) |
| Duration | Term of the Agreement plus the retention and deletion period in Section 10 |
| Nature | Collection, storage, organization, retrieval, transmission, erasure, automated analysis (OCR, transcription, embeddings, LLM inference) |
| Purpose | Provide the Service as configured by Customer |
| Data subjects | Customer’s personnel; callers; clients; opposing parties and witnesses if present in uploads; other individuals appearing in Customer Data |
| Categories of data | Identity and contact data; communications content; matter facts; financial and insurance data if uploaded; health and injury data if uploaded; audio and video; device and usage metadata tied to firm users |
| Sensitive data | May include health data and other special categories if Customer uploads them; Customer is responsible for assessing necessity and safeguards |
5. Confidentiality and personnel
Frix ensures personnel authorized to Process Customer Data are bound by confidentiality and receive appropriate privacy and security training. Access is limited on a need-to-know basis.
6. Security
Frix implements technical and organizational measures appropriate to the risk, including:
- Encryption of data in transit (TLS) and encryption at rest for primary datastores;
- Access control, authentication, and least-privilege roles;
- Logging and monitoring of production systems;
- Network segmentation and hardened cloud configuration;
- Vulnerability management and dependency updates on a reasonable cadence;
- Backup and recovery procedures;
- Vendor security review for material Sub-processors;
- Incident response processes.
A high-level security overview and insurance posture are described in Cyber Liability Insurance. Customer may request a current security summary under NDA.
7. Sub-processors
- Customer authorizes Frix to use Sub-processors to deliver the Service. The current list is below and may be updated with notice as described in this Section.
- Frix will impose data-protection terms on Sub-processors no less protective than this DPA.
- Frix remains liable for Sub-processors’ performance of delegated obligations.
- Frix will provide notice of material new Sub-processors by email or website post at least fifteen (15) days in advance where practicable. Customer may object on reasonable data-protection grounds; the parties will discuss in good faith. If unresolved, Customer may terminate the affected Service for a pro‑rata refund of prepaid unused fees.
Current Sub-processors
| Provider | Purpose | Primary region |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, databases, queues, object storage | United States (us-east-1) |
| Amazon Transcribe (AWS) | Audio and video transcription | United States |
| Amazon Bedrock (AWS) | Large language model inference for AI features | United States |
| Vapi | Voice AI orchestration for phone calls | United States |
| Twilio, Inc. | Telephony numbers, voice connectivity, SMS | United States |
| Resend | Transactional email delivery | United States |
| Tavily | Firm website crawl and indexing during onboarding | United States |
| Payment processor (as configured for billing) | Subscription billing and payment metadata | United States |
8. International transfers
Where Customer Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties hereby enter into the SCCs (and UK Addendum as applicable), completed as follows:
- Data exporter: Customer
- Data importer: Frix Labs LLC
- Module: Two (Controller to Processor)
- Governing law for SCCs Clause 17: Ireland (for EU SCCs); England and Wales for the UK Addendum where applicable
Primary processing location: United States.
9. Assistance to Controller
Taking into account the nature of Processing, Frix will assist Customer by appropriate technical and organizational measures with:
- Data Subject requests (Frix will not respond directly to Customer’s clients or callers except to redirect them to Customer, unless legally required);
- Security and DPIA or consultation obligations, upon reasonable request;
- Personal Data Breach notification (Section 11).
Reasonable requests beyond standard product features may be chargeable at Frix’s then-current professional services rates if they require material engineering effort.
10. Return and deletion
Upon termination of the Agreement, at Customer’s choice notified within thirty (30) days, Frix will return a commercially reasonable export of Customer Data then available in the product, or delete Customer Data from active systems within sixty (60) days, and from backups within ninety (90) additional days, except where retention is required by law or needed for dispute resolution (in which case data remains protected and isolated from production use).
11. Personal Data Breach
Frix will notify Customer without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer Data, with information reasonably available to help Customer meet its notification duties. Frix will investigate and take reasonable steps to mitigate.
12. Audits
Upon reasonable written notice (no more than once annually, unless a Breach or regulator request), Customer may: (a) receive Frix’s latest security questionnaire responses or SOC report summary if available; and/or (b) conduct a remote audit of relevant policies under NDA, during business hours, without unreasonably disrupting operations. On-site audits require mutual agreement and Customer bears its own costs (and Frix’s reasonable costs if an on-site audit is not required by a confirmed Breach attributable to Frix).
13. CCPA / CPRA service provider terms
Frix will not: (a) sell or share Customer Personal Information; (b) retain, use, or disclose it outside the business purpose of providing the Service or as otherwise permitted by the CPRA for service providers; or (c) combine it with personal information from other sources except as permitted for service providers. Frix certifies it understands these restrictions. Customer is responsible for providing required consumer notices.
14. Liability
Liability under this DPA is subject to the limitations in the Agreement, except that nothing excludes liability that cannot be limited under Applicable Data Protection Law.
15. Order of precedence
If this DPA conflicts with the Terms of Service, this DPA controls for data-protection matters. If an executed MSA conflicts with this DPA on the same topic, the MSA controls unless it expressly states otherwise. SCCs prevail over this DPA for international transfer compliance where required.
16. Contact
Processor privacy contact: privacy@frixlaw.com
Security incidents: security@frixlaw.com
Legal: legal@frixlaw.com
Processor: Frix Labs LLC, United States